Skip to content

Improved heuristics for detecting TPRs in gadet code

Samuel (WMF) requested to merge improved-detection-heuristics into main

Reduce false positives by combining a few conditions:

  • Single-line or multiple-line comments are ignored during code scan
  • Gadget code contains some URLs that aren't part of the allow-list
  • Gadget code matches abritrary rules such as the presence of mw.loader or iframe.

Still, some gadgets won't be caught if they load TPRs in a way that evades those rules.

Bug: T335892

Edited by Samuel (WMF)

Merge request reports