feat: add option to add custom blocked domains by Justin24506 · Pull Request #41 · Shantanugupta43/SuggestPilot

Justin24506 · 2026-04-03T15:41:13Z

Foundation laid for custom blocked domains.

Need to

- Strip http:// / https:// from pasted URLs

and more.

Shantanugupta43 · 2026-04-03T17:26:02Z

Hey I am curious what you are working on. If possible can you also include the description in issues tab? Cheers

Justin24506 · 2026-04-04T01:45:03Z

#42 Done.

Copilot

Pull request overview

Adds an initial “custom blocked domains” feature to the extension so users can configure domains where suggestions should be disabled.

Changes:

Adds a “Blocked Sites” UI in the popup settings with tag-style add/remove behavior.
Persists blockedDomains into extension config and returns it via getConfig.
Updates the content script to disable itself on blocked domains (now intended to be configurable).

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
src/popup/popup.js	Adds blocked domain input handling, domain sanitization, and tag rendering; saves `blockedDomains` into config.
src/popup/popup.html	Adds the “Blocked Sites” section and container markup in Settings.
src/popup/popup.css	Adds styling for the blocked domain tags/input container.
src/content/content-script.js	Attempts to load blocked domains from config and short-circuit initialization on blocked sites.
src/config/config-manager.js	Adds `blockedDomains` to stored config initialization defaults.
src/background/service-worker.js	Exposes `blockedDomains` via `getConfig` response.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-04T16:52:11Z

src/content/content-script.js

+import configManager from "../config/config-manager.js";



import configManager ... will throw in a Manifest V3 content script unless the content script is loaded as an ES module (otherwise you get “Cannot use import statement outside a module”). Either update the manifest content_scripts entry to load this file as a module, or remove the import and fetch blockedDomains via chrome.runtime.sendMessage / chrome.storage directly.

Suggested change

import configManager from "../config/config-manager.js";

const configManager = {

async get(key, defaultValue = null) {

try {

const syncResult = await chrome.storage.sync.get(key);

if (syncResult[key] !== undefined) {

return syncResult[key];

}

const localResult = await chrome.storage.local.get(key);

if (localResult[key] !== undefined) {

return localResult[key];

}

} catch (error) {

console.warn("Failed to read config from extension storage:", error);

}

return defaultValue;

},

async getBlockedDomains() {

const blockedDomains = await this.get("blockedDomains", []);

return Array.isArray(blockedDomains) ? blockedDomains : [];

},

};

Copilot · 2026-04-04T16:52:11Z

src/content/content-script.js

-      return;
+  async function initialize() {
+    try {
+      const blockedDomains = (await configManager.get("blockedDomains")) || [];


Blocked domains are read via configManager.get("blockedDomains") without calling await configManager.initialize(). Since get() just reads this.config and this.config is null until initialized, this will always fall back to [] and the blocking feature won’t work. Initialize the config manager first (and you can drop the unnecessary await on get).

Suggested change

const blockedDomains = (await configManager.get("blockedDomains")) || [];

await configManager.initialize();

const blockedDomains = configManager.get("blockedDomains") || [];

Copilot · 2026-04-04T16:52:12Z

src/content/content-script.js

+    if (!Array.isArray(blockedDomains)) return false;
    const host = window.location.hostname.toLowerCase();
-    return BLOCKED_DOMAINS.some(domain => host.includes(domain));
+    return blockedDomains.some((domain) => host.includes(domain));


host.includes(domain) will produce false positives (e.g. blocking in.com blocks linkedin.com, blocking linkedin.com blocks notlinkedin.com). Domain matching should be based on exact host match or a subdomain suffix check (e.g. host === domain || host.endsWith('.' + domain)).

Suggested change

return blockedDomains.some((domain) => host.includes(domain));

return blockedDomains.some((domain) => {

if (typeof domain !== "string") return false;

const normalizedDomain = domain.trim().toLowerCase().replace(/^\.+/, "");

if (!normalizedDomain) return false;

return (

host === normalizedDomain || host.endsWith(`.${normalizedDomain}`)

);

});

Copilot · 2026-04-04T16:52:12Z

src/popup/popup.js

-    derivationEl.className = 'suggestion-derivation';
+    const derivationEl = document.createElement("div");
+    derivationEl.className = "suggestion-derivation";
    derivationEl.innerHTML = `<strong>Why:</strong> ${derivation}`;


derivationEl.innerHTML = ... ${derivation} injects untrusted LLM-provided text into the extension popup as HTML, which is an XSS vector (LLM output can contain tags). Prefer setting textContent for the derivation portion (or sanitize/escape before assigning to innerHTML).

Suggested change

derivationEl.innerHTML = `<strong>Why:</strong> ${derivation}`;

const derivationLabelEl = document.createElement("strong");

derivationLabelEl.textContent = "Why:";

derivationEl.appendChild(derivationLabelEl);

derivationEl.appendChild(document.createTextNode(` ${derivation}`));

Copilot · 2026-04-04T16:52:12Z

src/popup/popup.css

+.tag {
+    background: var(--primary);
+    color: white;
+    padding: 4px 10px;
+    border-radius: 6px;
+    display: inline-flex;
+    align-items: center;
+    gap: 6px;
+    font-size: 13px;
+    font-weight: 500;
+    user-select: none;
+    animation: fadeIn 0.2s ease;
+}


.tag uses animation: fadeIn 0.2s ease; but there is no @keyframes fadeIn defined in this stylesheet, so the animation won’t run (and can generate warnings in devtools). Define the keyframes or remove the animation reference.

src/popup/popup.html

src/popup/popup.js

src/popup/popup.css

Justin24506 · 2026-04-04T16:55:21Z

I've made some fixes:

urls are stripped of https:// and only the hostname is added
invalid urls are handled

I'll now try to fix the errors pointed out by Copliot.

- Replaced content script import with inline config to fix Manifest V3 module errors - Swapped .innerHTML for text nodes to prevent XSS in popup - Added aria-labels and focus outlines for better accessibility

Justin24506 · 2026-04-04T17:40:28Z

Sorry for cluttering this up, didn't realize Copilot's automatic review was on.

Shantanugupta43 · 2026-04-04T17:43:13Z

Since you did a draft PR, it triggered copilots auto reviewer. It doesn't trigger on default pull requests

feat: add option to add custom blocked domains

40843aa

fix: sanitize urls entered in blocked domains

70d270e

Justin24506 marked this pull request as ready for review April 4, 2026 16:47

Justin24506 requested a review from Shantanugupta43 as a code owner April 4, 2026 16:47

Copilot AI review requested due to automatic review settings April 4, 2026 16:47

Justin24506 changed the title ~~feat(WIP): add option to add custom blocked domains~~ feat: add option to add custom blocked domains Apr 4, 2026

Copilot started reviewing on behalf of Justin24506 April 4, 2026 16:48 View session

Copilot AI reviewed Apr 4, 2026

View reviewed changes

fix: address module imports, security, and a11y

d05b335

- Replaced content script import with inline config to fix Manifest V3 module errors - Swapped .innerHTML for text nodes to prevent XSS in popup - Added aria-labels and focus outlines for better accessibility

Justin24506 mentioned this pull request Apr 4, 2026

Feature: Option to add custom blocked domains #42

Open

This was referenced Apr 5, 2026

fix: blocked domains #51

Open

сhore: eslint prettier config #52

Open

-import configManager from "../config/config-manager.js";
+const configManager = {
+  async get(key, defaultValue = null) {
+    try {
+      const syncResult = await chrome.storage.sync.get(key);
+      if (syncResult[key] !== undefined) {
+        return syncResult[key];
+      }
+      const localResult = await chrome.storage.local.get(key);
+      if (localResult[key] !== undefined) {
+        return localResult[key];
+      }
+    } catch (error) {
+      console.warn("Failed to read config from extension storage:", error);
+    }
+    return defaultValue;
+  },
+  async getBlockedDomains() {
+    const blockedDomains = await this.get("blockedDomains", []);
+    return Array.isArray(blockedDomains) ? blockedDomains : [];
+  },
+};

	const blockedDomains = (await configManager.get("blockedDomains")) \|\| [];
	await configManager.initialize();
	const blockedDomains = configManager.get("blockedDomains") \|\| [];

-    return blockedDomains.some((domain) => host.includes(domain));
+    return blockedDomains.some((domain) => {
+      if (typeof domain !== "string") return false;
+      const normalizedDomain = domain.trim().toLowerCase().replace(/^\.+/, "");
+      if (!normalizedDomain) return false;
+      return (
+        host === normalizedDomain || host.endsWith(`.${normalizedDomain}`)
+      );
+    });

-    derivationEl.innerHTML = `<strong>Why:</strong> ${derivation}`;
+    const derivationLabelEl = document.createElement("strong");
+    derivationLabelEl.textContent = "Why:";
+    derivationEl.appendChild(derivationLabelEl);
+    derivationEl.appendChild(document.createTextNode(` ${derivation}`));

Uh oh!

Conversation

Justin24506 commented Apr 3, 2026 • edited by Shantanugupta43 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Shantanugupta43 commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Justin24506 commented Apr 4, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Justin24506 commented Apr 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Justin24506 commented Apr 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Shantanugupta43 commented Apr 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Justin24506 commented Apr 3, 2026 •

edited by Shantanugupta43

Loading

Shantanugupta43 commented Apr 3, 2026 •

edited

Loading

Justin24506 commented Apr 4, 2026 •

edited

Loading

Justin24506 commented Apr 4, 2026 •

edited

Loading