Please edit the wiki, and add a few bits of information about filters from untrusted sources

[unforgettableid]

Prerequisites

• I verified that this is not a filter list issue. Report any issues with filter lists or broken website functionality in the uAssets issue tracker.
• This is NOT a YouTube, Facebook or Twitch report. These sites MUST be reported by clicking their respective links.
• This is not a support issue or a question. For support, questions, or help, visit /r/uBlockOrigin.
• I performed a cursory search of the issue tracker to avoid opening a duplicate issue.
• The issue is not present after disabling uBO in the browser.

I tried to reproduce the issue when...

• uBO is the only extension.
• uBO uses default lists and settings.

Steps to Reproduce

1. Visit the "My filters" dashboard pane, at: chrome-extension://cjpalhdlnbpafiamejdnhcphjbkeiagm/dashboard.html#1p-filters.html
2. Notice the bold text: "Do not add filters from untrusted sources."
3. Wonder why it says that. (I might sometimes copy and paste filters from Reddit, Discourse, and/or other places.)
4. Click the help icon () to visit the relevant wiki page, to try to get more information.

Expected behavior

I was hoping that the wiki page would explain the following few things:

A.) (Advice:) Why I shouldn't add filters from untrusted sources.
B.) (Harm reduction:) If I'm going to add untrustworthy filters anyway: How I can to try to determine whether or not they're likely malicious?
C.) (Information:) If there's a way to manually mark a single rule as untrusted, please tell me how to do so.

Actual behavior

The wiki page did not explain any of that information.

It would be good if you could please add all of the above few pieces of information. Thank you!

uBO version

1.56.0

Browser name and version

Chrome 123.0.6312.60

[garry-ut99]

The wiki page did not explain any of that information.
It would be good if you could please add all of the above few pieces of information. Thank you!

No need to add them all because most of things you're asking are self-explanatory and obvious enough, also already explained in:

• Thinking of considering _My filters_ pane as untrusted by default #2895
• My Filters is not a trusted source uAssets#21038
• Trusted lists in uBO uAssets#18589

A) +3) Read the above links, in short: because they can be abused and malicious, especially given a fact uBO, just like every software in the world, might contain unfixed bug and vulnerabilities.
B) You need to become an advanced uBO user, and get skilled in how uBO works.
C) Not possible currently, you can only:
---- enable/disable all trusted filters in "My filters" via a main switch "Allow custom filters requiring trust"
---- enable/disable trusted filters in particular filter lists via : https://github.com/gorhill/uBlock/wiki/Advanced-settings#trustedlistprefixes
---- disable/ignore specific filters by commenting them out using Tab as already described in Wiki
---- convert a specific trusted filter to a normal (untrusted) filter if possible (for example trusted-set-cookie to set-cookie)

Also try to keep consistency in nomenclature:

unforgettableid : filters, a single rule

because filters are filters, and rules are rules, they are not the same thing:
https://github.com/gorhill/uBlock/wiki/Dashboard:-My-filters vs
https://github.com/gorhill/uBlock/wiki/Dashboard:-My-rules

[gwarser]

Discussion https://www.reddit.com/r/uBlockOrigin/comments/1bpvq8d/what_damage_could_a_malicious_filter_list_entry_do/

[awebeer256]

As far as I can tell, the wiki never even mentions the concept of filters that do vs. don't require trust, except to mention that one advanced setting linked above. What kinds of filters even require trust? e.g. /\/aaaaaa/ requires trust, but add one more 'a' and it no longer does. Is this information written down anywhere?

[stephenhawk8054]

/\/aaaaaa/

No, this is related to regex filter syntax/parsing, not related to trusted filters.

---

Currently some of the trusted scriptlets are marked and documented here: https://github.com/gorhill/uBlock/wiki/Resources-Library

[garry-ut99]

awebeer256 : As far as I can tell, the wiki never even mentions the concept of filters that do vs. don't require trust, except to mention that one advanced setting linked above.

Maybe you have problem with your eyes then, because it also contains a link to uBO release notes which explains concept of trusted filters :

https://github.com/gorhill/uBlock/wiki/Advanced-settings#trustedlistprefixes : uBO 1.52.3rc2 and above