rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Skip shared infrastructure in domain matching

Browse Source 
The deterministic tracker-mapping heuristics group patterns by shared
initiator domain, but tag managers, customer-data platforms, and
generic CDNs (Google Tag Manager, Segment, cloudfront.net, ...)
initiate trackers for many unrelated vendors. Grouping on such a
domain mis-attributes one vendor's tracker to another.

Add uri.FilterSharedInfrastructureDomains backed by a curated eTLD+1
denylist and apply it once in resolveDeterministic, so sibling
grouping, catalog domain matching, and the sibling re-enqueue cascade
all ignore shared-infrastructure hosts. Vendor-specific domains such
as google-analytics.com are intentionally kept as a same-vendor
signal. The agent path is unchanged: it still sees observed domains,
now with a prompt caveat about shared infrastructure.

Update the two sibling tests that used googletagmanager.com as the
initiator domain to a vendor domain, since that host is now stripped
before grouping.

Signed-off-by: Émile Ré <emile@probo.com>
This commit is contained in:
Émile Ré
2026-05-29 20:22:46 +02:00
parent 54c05ebe6a
commit 323fe4b5c3
4 changed files with 192 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
pkg/cookiebanner/tracker_mapping_worker_test.go
View File

@@ -512,8 +512,10 @@ func TestMatchBySiblingOrigin_SiblingWithThirdPartyID(t *testing.T) {
}
// Detected trackers store the eTLD+1 (uri.ExtractDomain), so the
// sibling lookup matches on that exact value.
initiatorDomain := "googletagmanager.com"
// sibling lookup matches on that exact value. Use a vendor-specific
// domain rather than shared infrastructure (e.g. googletagmanager.com),
// which resolveDeterministic strips before sibling grouping.
initiatorDomain := "google-analytics.com"
siblingDetected := coredata.DetectedTracker{
ID: gid.New(fx.scope.GetTenantID(), coredata.DetectedTrackerEntityType),
CookieBannerID: fx.banner.ID,
@@ -569,7 +571,7 @@ func TestMatchBySiblingOrigin_SiblingWithThirdPartyID(t *testing.T) {
require.NoError(t, client.WithTx(ctx, func(ctx context.Context, tx pg.Tx) error {
var err error
got, err = h.matchBySiblingOrigin(ctx, tx, unmappedPattern, []string{"googletagmanager.com"})
got, err = h.matchBySiblingOrigin(ctx, tx, unmappedPattern, []string{"google-analytics.com"})
return err
}))
@@ -1120,7 +1122,10 @@ func TestProcess_BackfillsCommonThirdPartyFromSibling(t *testing.T) {
UpdatedAt: now,
}
initiatorDomain := "googletagmanager.com"
// A vendor-specific initiator domain: resolveDeterministic strips
// shared infrastructure (e.g. googletagmanager.com) before sibling
// grouping, so the backfill must be driven by a real vendor domain.
initiatorDomain := "google-analytics.com"
siblingDetected := coredata.DetectedTracker{
ID: gid.New(fx.scope.GetTenantID(), coredata.DetectedTrackerEntityType),