[PM-13115] Allow users to disable extension content script injections by domain #11826

jprusik · 2024-11-01T19:31:13Z

🎟️ Tracking

📔 Objective

Create a concept of disabled domains for the Bitwarden extension; unlike the excluded domains in the notification settings, a page belonging to the disabled domain list would prevent the Bitwarden extension from interacting with the page at all.

Notes

This feature is gated by the block-browser-injections-by-domain feature flag
While this work is functionally complete, there are follow up UX/design tasks (see tracked tasks in the ticket) that must be completed before this is released (via feature-flag)
This would not replace or otherwise impact the “excluded domains” concept for notifications (at least not within the scope of this PR; see comment)
Changes made to the blocked domains will not be reflected until the next content script injection to the page (typically a page navigation or refresh)
Supporting presentational experience work split to [PM-16804] Add supporting Vault component presentational updates for blocked domains #12720 enable more incremental development

Screen capture

Kapture.2024-12-16.at.11.09.36.mp4

Kapture.2024-12-16.at.11.28.39.mp4

🦮 Reviewer guidelines

👍 (:+1:) or similar for great changes
📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
❓ (:question:) for questions
🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
🎨 (:art:) for suggestions / improvements
❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
⛏ (:pick:) for minor or nitpick changes

github-actions · 2024-11-11T22:18:16Z

Checkmarx One – Scan Summary & Details – f39b8b59-7177-4af7-ae94-062678ef5beb

Fixed Issues

Severity	Issue	Source File / Package
	Client_Privacy_Violation	/apps/browser/src/autofill/deprecated/overlay/pages/list/autofill-overlay-list.deprecated.ts: 393
	Client_Privacy_Violation	/apps/browser/src/vault/popup/components/vault-v2/vault-list-items-container/vault-list-items-container.component.html: 15

jprusik · 2024-12-16T14:59:02Z

apps/browser/src/autofill/popup/settings/autofill.component.ts

@@ -67,7 +66,6 @@ import { PopupPageComponent } from "../../../platform/popup/layout/popup-page.co
    JslibModule,
    LinkModule,
    PopOutComponent,
-    PopupFooterComponent,


PopupFooterComponent was not in use anywhere here or in the template

jprusik · 2024-12-16T15:07:27Z

apps/browser/src/autofill/popup/settings/blocked-domains.component.ts

This file is largely a copy of apps/browser/src/autofill/popup/settings/excluded-domains.component.ts

We have an open bug for the existing UI here PM-13808 with the input styling. Do you think we can get that fixed so we don't duplicate the UI into this new component?

I added a note to that ticket to include the blocked URIs view that would be introduced by this work

jprusik · 2024-12-16T15:11:12Z

...popup/components/vault-v2/autofill-vault-list-items/autofill-vault-list-items.component.html

@@ -3,6 +3,7 @@
  [ciphers]="ciphers"
  [title]="'autofillSuggestions' | i18n"
  [showRefresh]="showRefresh"
+  [sectionIndicators]="sectionIndicators"


This concept allows for the conditional addition of icon indicators alongside the section title (in this case, an informational icon indicating the view contains ciphers for a domain that has been added to the user's block list).

apps/browser/src/vault/popup/components/vault/vault-v2.component.html

jprusik · 2024-12-16T15:49:09Z

apps/browser/src/vault/popup/components/vault/vault-v2.component.ts

+        this.domainSettingsService
+          .setBlockedInteractionsUris({
+            ...blockedURIs,
+            [this.autofillTabHostname]: { bannerIsDismissed: true },


using the existing NeverDomains data shape give us tons of flexibility in the future if we implement more granular injection-blocking options.

As it is, we could merge the neverDomains state concept (expressed in the interface as "Excluded Domains" and currently used to allow users to block the notification bar on specified domains) into blockedInteractionsUris concept with a state migration.

For example (not a well-considered data shape, just for illustrative purposes):

{ "banking-portal.real-tld": { "blockedInjections": null, // all injections blocked "dismissedMessages": ['autofillBlockedBanner'] }, "duckduckgo.com": { "blockedInjections": ["notifications", "inline-menu"], "dismissedMessages": [] } }

For example (not a well-considered data shape, just for illustrative purposes):

💭 You might want to update this example to account for our "no-null" guidance. If you want to keep the example short, I'd just swap out the null for true or "all" (no list).

A more comprehensive example that would be easier to port to Rust (as an enum) uses a discriminated union.

type ScriptType = "notifications" | "inline-menu"; type Injectable = { type: "allow-all" } | { type: "deny-list", injections: ScriptType[] } | { type: "deny-all" };

noted; a fair point and we'll pull this into our design when we get to migrating excluded domains (or other NeverDomain concepts) in

jprusik · 2024-12-16T16:00:19Z

apps/browser/src/platform/services/browser-script-injector.service.ts

+    if (!injectionAllowedInTab) {
+      throw new Error("This URI of this tab is on the blocked domains list.");
+    }


This is purposeful blocking, no? Do we want a visible error like this?

I was thinking it might be helpful to have some kind of dev/console visibility in case people set a blocked domain and forget later (and then are wondering why the extension isn't working). But yeah, I think that would be better served as a warning or informational log

updated in f6c1a55

audreyality

There's a nit, but it doesn't block merge.

shane-melton

This looks pretty good from a Vault's perspective and I'm excited for the feature!

I did have two suggestions for how we could better encapsulate the autofill logic and avoid adding complexity to the generic vault components. Let me know what you think!

shane-melton · 2025-01-06T17:51:27Z

apps/browser/src/vault/popup/components/vault/vault-v2.component.html

@@ -22,6 +22,16 @@
    </bit-no-items>
  </div>

+  <bit-banner


🎨 How would you feel if we encapsulated this banner in its own blocked-injection-script-banner component? It would let us move the handleScriptInjectionIsBlockedBannerDismiss() and showScriptInjectionIsBlockedBanner logic out of the top-level vault.

This is a problem we have in the Web vault component today -- it has a lot of various business logic in a single component -- and I'm hoping we can avoid repeating that in the new refreshed Browser vault by breaking logic out into their own components.

shane-melton · 2025-01-06T18:05:32Z

...popup/components/vault-v2/vault-list-items-container/vault-list-items-container.component.ts

🎨 I would prefer we use content projection instead of introducing sectionIndicator strings. We could use something like this in the template:

<h2 bitTypography="h6"> {{ title }} <ng-content select="[slot=title-icon]"></ng-content> </h2>

And then the autofill-vault-list-items component could do something like:

<app-vault-list-items-container ...> <i slot="title-icon" *ngIf="showAutofillBlockedIndicator" class="bwi bwi-info-circle" [appA11yTitle]="'autofillBlockedTooltip' | i18n"> </i> </app-vault-list-items-container>

This would help reduce the amount of bespoke autofill logic in our generic vault item components. Let me know what you think!

jprusik self-assigned this Nov 1, 2024

jprusik force-pushed the pm-13115 branch 2 times, most recently from 77d3472 to e8ddd67 Compare November 1, 2024 19:53

jprusik force-pushed the pm-13115 branch from e8ddd67 to 5b208b3 Compare November 11, 2024 22:07

jprusik force-pushed the pm-13115 branch from c03f070 to f96b5f1 Compare November 15, 2024 22:56

jprusik force-pushed the pm-13115 branch 3 times, most recently from 308c302 to 2695a47 Compare December 16, 2024 14:51

jprusik commented Dec 16, 2024

View reviewed changes

apps/browser/src/vault/popup/components/vault/vault-v2.component.html Outdated Show resolved Hide resolved

jprusik commented Dec 16, 2024

View reviewed changes

jprusik force-pushed the pm-13115 branch 7 times, most recently from 1dd180e to ab2f085 Compare December 19, 2024 20:54

jprusik changed the title ~~[PM-13115] Allow users to disable the Bitwarden extension by domain~~ [PM-13115] Allow users to disable extension content script injections by domain Dec 19, 2024

jprusik marked this pull request as ready for review December 19, 2024 21:05

jprusik requested review from a team as code owners December 19, 2024 21:05

jprusik requested review from addisonbeck and shane-melton December 19, 2024 21:05

jprusik force-pushed the pm-13115 branch from ee6df26 to fdca2e3 Compare January 3, 2025 14:51

refactor feature flag state fetching and update tests

2b1a004

jprusik force-pushed the pm-13115 branch from fdca2e3 to 2b1a004 Compare January 3, 2025 15:14

document domain settings service

958a738

jprusik requested a review from audreyality January 3, 2025 15:50

cagonzalezcs mentioned this pull request Jan 3, 2025

Performance Issue with Autofill Functionality in Vite + Vue 3 Application #12031

Open

1 task

addisonbeck previously approved these changes Jan 3, 2025

View reviewed changes

gbubemismith previously approved these changes Jan 3, 2025

View reviewed changes

audreyality previously approved these changes Jan 6, 2025

View reviewed changes

jprusik enabled auto-merge (squash) January 6, 2025 17:33

shane-melton reviewed Jan 6, 2025

View reviewed changes

jprusik disabled auto-merge January 6, 2025 21:32

jprusik added 2 commits January 6, 2025 16:36

Merge remote-tracking branch 'origin/main' into pm-13115

f408574

remove vault component presentational updates

fe40dd8

jprusik dismissed stale reviews from audreyality, gbubemismith, and addisonbeck via fe40dd8 January 6, 2025 21:41

jprusik mentioned this pull request Jan 6, 2025

[PM-16804] Add supporting Vault component presentational updates for blocked domains #12720

Open

jprusik requested review from shane-melton, addisonbeck, audreyality and gbubemismith and removed request for shane-melton January 6, 2025 21:57

gbubemismith approved these changes Jan 6, 2025

View reviewed changes

jprusik enabled auto-merge (squash) January 6, 2025 22:03

audreyality approved these changes Jan 6, 2025

View reviewed changes

addisonbeck approved these changes Jan 6, 2025

View reviewed changes

differsthecat approved these changes Jan 6, 2025

View reviewed changes

jprusik merged commit 15faf52 into main Jan 6, 2025
91 checks passed

jprusik deleted the pm-13115 branch January 6, 2025 22:10

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[PM-13115] Allow users to disable extension content script injections by domain #11826

[PM-13115] Allow users to disable extension content script injections by domain #11826

jprusik commented Nov 1, 2024 •

edited

Loading

github-actions bot commented Nov 11, 2024 •

edited

Loading

jprusik Dec 16, 2024 •

edited

Loading

jprusik Dec 16, 2024

danielleflinn Dec 19, 2024

jprusik Dec 23, 2024

jprusik Dec 16, 2024

jprusik Dec 16, 2024

audreyality Dec 20, 2024

jprusik Jan 3, 2025

jprusik Dec 16, 2024

coltonhurst Dec 20, 2024

jprusik Dec 23, 2024

jprusik Dec 23, 2024

audreyality left a comment

shane-melton left a comment

shane-melton Jan 6, 2025

shane-melton Jan 6, 2025 •

edited

Loading

[PM-13115] Allow users to disable extension content script injections by domain #11826

[PM-13115] Allow users to disable extension content script injections by domain #11826

Conversation

jprusik commented Nov 1, 2024 • edited Loading

🎟️ Tracking

📔 Objective

Notes

Screen capture

🦮 Reviewer guidelines

github-actions bot commented Nov 11, 2024 • edited Loading

Fixed Issues

jprusik Dec 16, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

audreyality left a comment

Choose a reason for hiding this comment

shane-melton left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

shane-melton Jan 6, 2025 • edited Loading

Choose a reason for hiding this comment

jprusik commented Nov 1, 2024 •

edited

Loading

github-actions bot commented Nov 11, 2024 •

edited

Loading

jprusik Dec 16, 2024 •

edited

Loading

shane-melton Jan 6, 2025 •

edited

Loading