From b5f74456a44352e803fbb0615a1f19e0b1a802bf Mon Sep 17 00:00:00 2001
From: Raymond Hill <gorhill@users.noreply.github.com>
Date: Sat, 1 Nov 2025 13:00:05 -0400
Subject: [PATCH] Fix custom prefixes unduly assigning trust to external lists

Related discussion:
https://github.com/uBlockOrigin/uBlock-issues/issues/3843#issuecomment-3475894380
---
 src/js/storage.js | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/js/storage.js b/src/js/storage.js
index 758ae9bd3..66a335239 100644
--- a/src/js/storage.js
+++ b/src/js/storage.js
@@ -433,7 +433,10 @@ onBroadcast(msg => {
                 }
             }).filter(prefix => prefix !== undefined);
     }
+    const match = /^[a-z-]+:\/\/[^/]+\//.exec(assetKey);
+    const assetOrigin = match && match[0];
     for ( const prefix of this.parsedTrustedListPrefixes ) {
+        if ( assetOrigin && prefix.length < assetOrigin.length ) { continue; }
         if ( assetKey.startsWith(prefix) ) { return true; }
     }
     return false;