Filter separator-only glob templates in tracker pattern analysis

Unrelated third-party trackers that happened to share a leading
separator run (e.g. __support__, __darkreader__wasEnabledForHost,
__EXT_APP_REFRESH_BLACK_SUB_DOMAINS__) were being merged under
overly broad globs such as __* because templateCandidates emitted
every prefix at each '_' or '-' position without requiring any
fixed anchor.

Add a templateHasFixedAnchor helper and apply it to both
templateCandidates loops and the heuristicTemplate result so
candidates consisting solely of '_', '-', and '*' are rejected.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/cookiebanner/pattern_analysis_worker.go

@@ -432,7 +432,12 @@ func heuristicTemplate(name string) (string, bool) {
 		return "", false
 	}
 
-	return prefix.String() + joinTokens(resultTokens, resultSeps) + suffix, true
+	tmpl := prefix.String() + joinTokens(resultTokens, resultSeps) + suffix
+	if !templateHasFixedAnchor(tmpl) {
+		return "", false
+	}
+
+	return tmpl, true
 }
 
 func templateCandidates(name string) []string {
@@ -440,7 +445,10 @@ func templateCandidates(name string) []string {
 
 	for i, ch := range name {
 		if ch == '_' || ch == '-' {
-			candidates = append(candidates, name[:i+1]+"*")
+			tmpl := name[:i+1] + "*"
+			if templateHasFixedAnchor(tmpl) {
+				candidates = append(candidates, tmpl)
+			}
 		}
 	}
 
@@ -450,7 +458,9 @@ func templateCandidates(name string) []string {
 			left := joinTokens(tokens[:pos], seps[:pos-1])
 			right := joinTokens(tokens[pos+1:], seps[pos+1:])
 			tmpl := left + string(seps[pos-1]) + "*" + string(seps[pos]) + right
-			candidates = append(candidates, tmpl)
+			if templateHasFixedAnchor(tmpl) {
+				candidates = append(candidates, tmpl)
+			}
 		}
 	}
 
@@ -575,6 +585,22 @@ func joinTokens(tokens []string, seps []byte) string {
 	return b.String()
 }
 
+// templateHasFixedAnchor reports whether tmpl contains at least one
+// character beyond separators and wildcards. Templates like "_*",
+// "__*", "-*", "--*", "__*__" would merge unrelated third parties
+// (e.g. __support__, __darkreader__wasEnabledForHost,
+// __EXT_APP_REFRESH_BLACK_SUB_DOMAINS__) under a single glob, so
+// candidates without any fixed alphanumeric anchor are rejected.
+func templateHasFixedAnchor(tmpl string) bool {
+	for _, ch := range tmpl {
+		if ch != '*' && ch != '_' && ch != '-' {
+			return true
+		}
+	}
+
+	return false
+}
+
 func globMatch(pattern, name string) bool {
 	parts := strings.Split(pattern, "*")
 	if len(parts) == 1 {