Bypass 1: a sentence around the trusted name. Any whitespace in the link text disabled the check, so "Log in at chat.lotusguild.org" → evil.example wasn't flagged.
hostsFromText now scans each word for host-shaped tokens, and the link is flagged if any named host is a different site.
Bare file names (main.py, report.pdf) and version numbers are skipped inside sentences, so ordinary links aren't flagged.
Bypass 2: shared hosting. Sites on a shared hosting domain counted as one site: alice.github.io vs evil.github.io, *.pages.dev, netlify.app, vercel.app and so on.
registrableDomain now treats a curated list of them as public suffixes (longest match first, including s3.amazonaws.com).
It's curated rather than the full Public Suffix List, to stay inside the bundle budget.
Verified with 2 new unit tests, and headless on real messages:
link text → destination
flagged
"Log in at chat.lotusguild.org" → evil.example
✅ yes
"chat.lotusguild.org (official)" → evil.example
✅ yes
"lotusguild.pages.dev" → evil.pages.dev
✅ yes
"alice.github.io" → evil.github.io
✅ yes
"Log in at chat.lotusguild.org" → chat.lotusguild.org/login
no
"see main.py and report.pdf" → github.com
no
"release v1.2.3 notes" → github.com
no
"click here" → evil.example
no
tsc clean · unit tests pass · ESLint/Prettier clean.
Fixes #335.
**Bypass 1: a sentence around the trusted name.** Any whitespace in the link text disabled the check, so "Log in at chat.lotusguild.org" → `evil.example` wasn't flagged.
- `hostsFromText` now scans each word for host-shaped tokens, and the link is flagged if **any** named host is a different site.
- Bare file names (`main.py`, `report.pdf`) and version numbers are skipped inside sentences, so ordinary links aren't flagged.
**Bypass 2: shared hosting.** Sites on a shared hosting domain counted as one site: `alice.github.io` vs `evil.github.io`, `*.pages.dev`, `netlify.app`, `vercel.app` and so on.
- `registrableDomain` now treats a curated list of them as public suffixes (longest match first, including `s3.amazonaws.com`).
- It's curated rather than the full Public Suffix List, to stay inside the bundle budget.
**Verified** with 2 new unit tests, and headless on real messages:
| link text → destination | flagged |
|---|---|
| "Log in at chat.lotusguild.org" → evil.example | ✅ yes |
| "chat.lotusguild.org (official)" → evil.example | ✅ yes |
| "lotusguild.pages.dev" → evil.pages.dev | ✅ yes |
| "alice.github.io" → evil.github.io | ✅ yes |
| "Log in at chat.lotusguild.org" → chat.lotusguild.org/login | no |
| "see main.py and report.pdf" → github.com | no |
| "release v1.2.3 notes" → github.com | no |
| "click here" → evil.example | no |
`tsc` clean · unit tests pass · ESLint/Prettier clean.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
Two easy bypasses of the "this link goes somewhere else" check:
- Any whitespace in the link text disabled it, so "Log in at
chat.lotusguild.org" → evil.example wasn't flagged. hostsFromText now
scans each word for host-shaped tokens; a link is flagged if any named
host is a different site. Bare file names (main.py, report.pdf) and
version numbers are skipped inside sentences so ordinary links aren't
flagged.
- Shared-hosting suffixes counted as one site (alice.github.io vs
evil.github.io, *.pages.dev, netlify.app, vercel.app, …).
registrableDomain now treats a curated list of them as public suffixes
(longest match, incl. s3.amazonaws.com). Curated rather than the full
PSL to stay inside the bundle budget.
Verified with unit tests and headless on real messages: the four bypass
cases are flagged; the honest sentence, file/version text and "click
here" are not.
Fixes#335
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fixes #335.
Bypass 1: a sentence around the trusted name. Any whitespace in the link text disabled the check, so "Log in at chat.lotusguild.org" →
evil.examplewasn't flagged.hostsFromTextnow scans each word for host-shaped tokens, and the link is flagged if any named host is a different site.main.py,report.pdf) and version numbers are skipped inside sentences, so ordinary links aren't flagged.Bypass 2: shared hosting. Sites on a shared hosting domain counted as one site:
alice.github.iovsevil.github.io,*.pages.dev,netlify.app,vercel.appand so on.registrableDomainnow treats a curated list of them as public suffixes (longest match first, includings3.amazonaws.com).Verified with 2 new unit tests, and headless on real messages:
tscclean · unit tests pass · ESLint/Prettier clean.🤖 Generated with Claude Code
https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5