Please edit the wiki, and add a few bits of information about filters from untrusted sources

[unforgettableid]

Prerequisites

• I verified that this is not a filter list issue. Report any issues with filter lists or broken website functionality in the uAssets issue tracker.
• This is NOT a YouTube, Facebook or Twitch report. These sites MUST be reported by clicking their respective links.
• This is not a support issue or a question. For support, questions, or help, visit /r/uBlockOrigin.
• I performed a cursory search of the issue tracker to avoid opening a duplicate issue.
• The issue is not present after disabling uBO in the browser.

I tried to reproduce the issue when...

• uBO is the only extension.
• uBO uses default lists and settings.

Steps to Reproduce

1. Visit the "My filters" dashboard pane, at: chrome-extension://cjpalhdlnbpafiamejdnhcphjbkeiagm/dashboard.html#1p-filters.html
2. Notice the bold text: "Do not add filters from untrusted sources."
3. Wonder why it says that. (I might sometimes copy and paste filters from Reddit, Discourse, and/or other places.)
4. Click the help icon () to visit the relevant wiki page, to try to get more information.

Expected behavior

I was hoping that the wiki page would explain the following few things:

A.) (Advice:) Why I shouldn't add filters from untrusted sources.
B.) (Harm reduction:) If I'm going to add untrustworthy filters anyway: How I can to try to determine whether or not they're likely malicious?
C.) (Information:) If there's a way to manually mark a single rule as untrusted, please tell me how to do so.

Actual behavior

The wiki page did not explain any of that information.

It would be good if you could please add all of the above few pieces of information. Thank you!

uBO version

1.56.0

Browser name and version

Chrome 123.0.6312.60

[gwarser]

Discussion https://www.reddit.com/r/uBlockOrigin/comments/1bpvq8d/what_damage_could_a_malicious_filter_list_entry_do/

[awebeer256]

As far as I can tell, the wiki never even mentions the concept of filters that do vs. don't require trust, except to mention that one advanced setting linked above. What kinds of filters even require trust? e.g. /\/aaaaaa/ requires trust, but add one more 'a' and it no longer does. Is this information written down anywhere?

[stephenhawk8054]

/\/aaaaaa/

No, this is related to regex filter syntax/parsing, not related to trusted filters.

---

Currently some of the trusted scriptlets are marked and documented here: https://github.com/gorhill/uBlock/wiki/Resources-Library