Improved heuristics for detecting TPRs in gadet code
Reduce false positives by combining a few conditions:
- Single-line or multiple-line comments are ignored during code scan
- Gadget code contains some URLs that aren't part of the allow-list
- Gadget code matches abritrary rules such as the presence of
mw.loader
oriframe
.
Still, some gadgets won't be caught if they load TPRs in a way that evades those rules.
Bug: T335892
Edited by Samuel (WMF)