feat(safari): strip DNR rules WebKit cannot compile#3280
Merged
Conversation
Safari silently drops rules whose urlFilter/regexFilter the WebKit URL filter parser rejects, so any pattern using features like disjunctions, character classes, or arbitrary atom repetitions is a no-op for Safari users. The Xcode build now runs the validator from ghostery/WebKit against every ruleset and removes the rejected rules before packaging, so the shipped lists match what Safari will actually enforce. The validator binary is downloaded on demand by a postinstall hook from the latest ghostery/WebKit release and kept out of the repo.
smalluban
requested changes
Apr 22, 2026
smalluban
approved these changes
Apr 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
urlFilter/regexFilterpatterns it does not support (disjunctions, character classes, arbitrary atom repetitions, etc.). Those rules ship to users but never match, producing gaps in ads/tracking/annoyance protection specific to Safari.validate-dnr-rulestool against every ruleset produced indist/rule_resources/—dnr-ads,dnr-tracking,dnr-fixes,dnr-annoyances,dnr-redirect-protection, and alldnr-lang-*regional lists — and drops any rules WebKit would reject.ghostery/WebKitrelease by apostinstallhook and kept out of the repo. Unsupported host platforms (e.g. Windows, Linux arm64) skip the download silently so regularnpm installis unaffected; Xcode Cloud's macOS arm64 runners pick up the correct asset.On the current rulesets this removes 342 rules across 29 of 31 files — top offenders are
dnr-ads(130),dnr-redirect-protection(80),dnr-tracking(18),dnr-lang-pl(19),dnr-lang-tr(16),dnr-lang-ja(12).Test plan
dnr-adsregex rules) and verify the page still renders correctly — the rule being dropped should not regress user-visible behaviour, since it was already a no-op in Safari.