Whitelist csgofast.store - official marketing mirror of csgofast.com (false positive)#1812
Open
K00pash wants to merge 1 commit intophantom:masterfrom
Open
Whitelist csgofast.store - official marketing mirror of csgofast.com (false positive)#1812K00pash wants to merge 1 commit intophantom:masterfrom
K00pash wants to merge 1 commit intophantom:masterfrom
Conversation
📝 WalkthroughWalkthroughThe PR extends a URL whitelist configuration by adding two new domains, ChangesWhitelist Configuration Update
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Review rate limit: 4/5 reviews remaining, refill in 12 minutes. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
whitelist.yaml (1)
33-34: Add whitelist-vs-blocklist conflict checks to CI before merge.Verification confirms
nftplus.ioandcsgofast.storeare absent from all blocklist files (blocklist.yaml, nft-blocklist.yaml, eth-blocklist.yaml, and fuzzylist.yaml), but the current CI implementation lacks validation to prevent this conflict. The suggested CI guard inci.jsto cross-check whitelist entries against blocklists is needed to prevent accidental domain conflicts in future contributions.Suggested CI hardening for `ci.js`
const yaml = require('js-yaml'); const fs = require('fs'); const blocklist = yaml.load(fs.readFileSync('./blocklist.yaml', 'utf8')); const nftBlocklist = yaml.load(fs.readFileSync('./nft-blocklist.yaml', 'utf8')); const whitelist = yaml.load(fs.readFileSync('./whitelist.yaml', 'utf8')); const fuzzylist = yaml.load(fs.readFileSync('./fuzzylist.yaml', 'utf8')); const ethBlocklist = yaml.load(fs.readFileSync('./eth-blocklist.yaml', 'utf8')); + +const toSet = (arr) => new Set(arr.map((item) => item.url).filter(Boolean)); +const whitelistSet = toSet(whitelist); +const blocklistSet = toSet(blocklist); +const ethBlocklistSet = toSet(ethBlocklist); +const fuzzylistSet = toSet(fuzzylist); + +const intersects = (a, b) => [...a].some((x) => b.has(x)); if(blocklist.some(item => !item.url)) { console.log("Not every blocklist item has a `url` attribute"); process.exit(1); } @@ if(fuzzylist.length > 0) { console.log("Fuzzylist entry detected without the fuzzylist being explicitly enabled"); process.exit(1); } + +if (intersects(whitelistSet, blocklistSet) || + intersects(whitelistSet, ethBlocklistSet) || + intersects(whitelistSet, fuzzylistSet)) { + console.log("Conflict detected: URL present in both whitelist and block/fuzzy list"); + process.exit(1); +}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@whitelist.yaml` around lines 33 - 34, Add a CI guard in ci.js that reads whitelist.yaml and cross-checks each domain against blocklist.yaml, nft-blocklist.yaml, eth-blocklist.yaml, and fuzzylist.yaml; implement (or extend) a function such as checkWhitelistVsBlocklists/validateLists to load and parse all YAMLs, normalize entries (lowercase, trim, strip schemes/www), detect any exact or fuzzy overlaps, and if any conflicts are found log the conflicting domain(s) with source file names and exit the process with a non-zero code to fail the CI. Ensure the check runs as part of existing CI validation flow so PRs cannot be merged when whitelist entries appear in any blocklist files.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@whitelist.yaml`:
- Line 33: Remove the unrelated whitelist entry "nftplus.io" from the change so
the PR only contains the intended domain addition (`csgofast.store`); locate the
`url: nftplus.io` entry in whitelist.yaml and delete that line (or revert that
specific hunk) and ensure the final commit includes only the `csgofast.store`
whitelist addition with no other domains.
---
Nitpick comments:
In `@whitelist.yaml`:
- Around line 33-34: Add a CI guard in ci.js that reads whitelist.yaml and
cross-checks each domain against blocklist.yaml, nft-blocklist.yaml,
eth-blocklist.yaml, and fuzzylist.yaml; implement (or extend) a function such as
checkWhitelistVsBlocklists/validateLists to load and parse all YAMLs, normalize
entries (lowercase, trim, strip schemes/www), detect any exact or fuzzy
overlaps, and if any conflicts are found log the conflicting domain(s) with
source file names and exit the process with a non-zero code to fail the CI.
Ensure the check runs as part of existing CI validation flow so PRs cannot be
merged when whitelist entries appear in any blocklist files.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hi Phantom team,
Submitting this as a PR since
phantom/blocklisthas Issues disabled and the README points to PRs as the submission channel for both blocklist and whitelist changes.csgofast.store is an official marketing mirror of csgofast.com, a CS2/CSGO skin platform live since 2015. Users have reported that Phantom flags
csgofast.storeas malicious.I could not find
csgofast.storein any of the YAML files onmasteror in commit history, so the warning seen in-wallet may be coming from a downstream provider Phantom integrates with (Blowfish? GoPlus?). Filing here regardless — this repo is the public surface, and awhitelist.yamlentry is the right preventive signal either way. Happy to refile elsewhere if you point me at the right channel.Why this is a false positive
The brand-on-different-TLD pattern is exactly what makes legitimate marketing mirrors look indistinguishable from typosquatting clones to automated detectors. We understand the heuristic, we just want to clear this one specific case:
How to verify (any of these works)
csgofast.com/.well-known/mirrors.jsonlisting every marketing mirror if you want a machine-readable signal for future reviews — happy to coordinate on the exact format.Asks
whitelist.yamlproactively? Publish a/.well-known/manifest? Userel=canonicalor JSON-LDsameAsfrom the mirrors to the primary domain?Thanks for the work — automated phishing detection is necessary, we do not want to make your job harder, just get our domain off the wrong list.
— csgofast.com team
Summary by CodeRabbit