[PM-41548] Consider frame URLs when resolving blocked domain entries

[jprusik]

🎟️ Tracking

PM-41548

📔 Objective

Blocking a URL that matches the tab URL prevents injection on the page as well as in the iframe. But, blocking only the URL of a subframe of the tab doesn’t prevent injection anywhere, including the iframe at that location. These changes additionally check the frame urls against the blocklist, allowing for the prevention of injection within frames without also blocking the parent frame.

Note, similar frame URL considerations are being coordinated in PM-43104

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the extraction of the blocked-domain check into findBlockedInjectionUrl in apps/browser/src/platform/services/browser-script-injector.service.ts and the accompanying spec changes. The tab-URL check still short-circuits before any frame lookup, the frame lookup is skipped for top-level (frame === 0/absent) and all_frames injections, and the empty-blocklist early return keeps the common path free of extra chrome.webNavigation calls. The getFrameDetails(...).then(...).catch(() => undefined) shape matches the existing pattern in runtime.background.ts and autofill-orchestrator.ts, and webNavigation is present in both manifests, so the frame lookup is available on every supported target. The spec rewrite also repairs two previously vacuous assertions (await expect(fn).not.toHaveBeenCalled() on a non-mock) and adds the jest.clearAllMocks() needed for the suite-level spies to make not.toHaveBeenCalled() meaningful.

No findings met the bar for an inline comment.

[codecov]

Codecov Report

❌ Patch coverage is 80.00000% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 55.58%. Comparing base (7972df6) to head (09d127b).
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
...atform/services/browser-script-injector.service.ts	80.00%	1 Missing and 2 partials ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #23018   +/-   ##
=======================================
  Coverage   55.57%   55.58%           
=======================================
  Files        4412     4412           
  Lines      140969   140978    +9     
  Branches    22392    22394    +2     
=======================================
+ Hits        78350    78361   +11     
+ Misses      56918    56916    -2     
  Partials     5701     5701           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.