etld.js

// GPC Watchdog — eTLD+1 / same-site matching via the Public Suffix List.
// Implements the PSL algorithm (https://publicsuffix.org/list/): exception
// rules beat wildcards, longest rule wins, unlisted TLDs fall back to the
// implicit "*" rule. Rules come from data/psl.js (generated, punycode-ASCII —
// matching what URL.hostname yields for request hosts).
// Loaded by the background page (see manifest.json) and by test/etld.test.js.

const PSL = (() => {
  const rules =
    typeof PSL_RULES !== "undefined"
      ? PSL_RULES
      : require("./data/psl.js").PSL_RULES;
  const normal = new Set();
  const wildcards = new Set(); // stored without the "*." prefix
  const exceptions = new Set(); // stored without the "!" prefix
  for (const rule of rules) {
    if (rule.startsWith("!")) exceptions.add(rule.slice(1));
    else if (rule.startsWith("*.")) wildcards.add(rule.slice(2));
    else normal.add(rule);
  }
  return { normal, wildcards, exceptions };
})();

function normalizeHost(host) {
  if (typeof host !== "string") return "";
  let h = host.trim().toLowerCase();
  if (h.endsWith(".")) h = h.slice(0, -1);
  return h;
}

function isIpLiteral(host) {
  if (host.startsWith("[") || host.includes(":")) return true; // IPv6
  return /^\d{1,3}(\.\d{1,3}){3}$/.test(host);
}

// The registrable-domain boundary: longest matching rule wins, exceptions
// (always one label longer than their wildcard) are checked at each length
// first, so they naturally take priority.
function publicSuffix(host) {
  const h = normalizeHost(host);
  if (!h || isIpLiteral(h)) return null;
  const labels = h.split(".");
  for (let i = 0; i < labels.length; i++) {
    const candidate = labels.slice(i).join(".");
    const parent = labels.slice(i + 1).join(".");
    if (PSL.exceptions.has(candidate)) return parent;
    if (PSL.normal.has(candidate)) return candidate;
    if (parent && PSL.wildcards.has(parent)) return candidate;
  }
  return labels[labels.length - 1]; // implicit "*" rule: unlisted TLD
}

// The registrable domain (suffix + one label), or null when the host IS a
// public suffix (or an IP / empty).
function etldPlusOne(host) {
  const h = normalizeHost(host);
  const suffix = publicSuffix(h);
  if (!suffix || h === suffix) return null;
  const suffixLabels = suffix.split(".").length;
  const labels = h.split(".");
  return labels.slice(labels.length - suffixLabels - 1).join(".");
}

// First-party test for the detection pipeline: same registrable domain.
// IPs and hosts without a registrable domain (localhost, bare suffixes)
// match only as exact strings.
function sameSite(hostA, hostB) {
  const a = normalizeHost(hostA);
  const b = normalizeHost(hostB);
  if (!a || !b) return false;
  if (isIpLiteral(a) || isIpLiteral(b)) return a === b;
  const siteA = etldPlusOne(a) || a;
  const siteB = etldPlusOne(b) || b;
  return siteA === siteB;
}

if (typeof module !== "undefined" && module.exports) {
  module.exports = { publicSuffix, etldPlusOne, sameSite, normalizeHost };
}