Fix: phishing controller c2 optimization (#6388)

## Explanation

`isMaliciousC2Domain` previously checked each request against the C2
blocklist using `Array.includes`, which performs a linear O(n) scan of
hashed domain strings on every call. For a list in the
thousands-of-entries range, each call scans the full list up to 6 times
— once for the exact hostname hash, up to 5 times for parent domain
hashes.

This PR switches the internal representation to `Set<string>`, reducing
each of those scans to an O(1) hash lookup.

**Benchmark results (internal profiling):**
- Per-request time: 2–8ms → 0.05–0.5ms (~10–100x improvement depending
on page complexity; ~50x averaged across pages)
- Potential CPU savings: up to ~300ms per page load
- Background tabs also benefit — confirmed they generate significant
background network requests that all route through this check

**Implementation notes:**
- The conversion from `string[]` → `Set<string>` happens once at
construction time via a new unexported
`InternalPhishingDetectorConfiguration` type. The public
`PhishingDetectorConfiguration` type keeps `c2DomainBlocklist?:
string[]` unchanged — no API break for downstream consumers.
- `isMaliciousC2Domain` now uses `.size` / `.has` in place of `.length`
/ `.includes`
- `getDefaultPhishingDetectorConfig` accepts and threads
`c2DomainBlocklist` through as `string[]`; `processConfigs` no longer
performs a redundant intermediate `Set` construction

Fixes: MetaMask/MetaMask-planning#5611

## References

- Fixes MetaMask/MetaMask-planning#5611

## Checklist

- [x] I've updated the test suite for new or updated code as appropriate
- [x] I've updated documentation (JSDoc, Markdown, etc.) for new or
updated code as appropriate
- [x] I've communicated my changes to consumers by [updating changelogs
for packages I've
changed](https://github.com/MetaMask/core/tree/main/docs/contributing.md#updating-changelogs),
highlighting breaking changes as necessary
- [x] I've prepared draft pull requests for clients and consumer
packages to resolve any breaking changes


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Behavior-preserving internal data-structure change on a hot path;
public types and matching logic are unchanged.
> 
> **Overview**
> **C2 domain blocklist checks** in
`PhishingDetector.isMaliciousC2Domain` now use a `Set` internally
instead of scanning a `string[]` with `includes`, so each hostname and
parent-domain hash lookup is O(1) rather than O(n) (up to several
lookups per request).
> 
> Arrays from config are converted to `Set<string>` once in the
constructor via an internal `InternalPhishingDetectorConfiguration`
type; the exported `PhishingDetectorConfiguration` still exposes
`c2DomainBlocklist?: string[]`. `getDefaultPhishingDetectorConfig` now
accepts and forwards an optional `c2DomainBlocklist` override. The
changelog records the performance change.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
0efe622. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Author: mindofmar

packages/phishing-controller/CHANGELOG.md

@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- Optimize C2 domain blocklist lookups by switching internal storage from `Array` to `Set`, reducing per-lookup complexity from O(n) to O(1) ([#6388](https://github.com/MetaMask/core/pull/6388))
 - Bump `@metamask/transaction-controller` from `^69.5.2` to `^69.6.1` ([#9960](https://github.com/MetaMask/core/pull/9960), [#9969](https://github.com/MetaMask/core/pull/9969))
 
 ## [17.4.0]
@@ -259,6 +260,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Bump `@metamask/base-controller` from `^8.0.1` to `^8.4.0` ([#6284](https://github.com/MetaMask/core/pull/6284), [#6355](https://github.com/MetaMask/core/pull/6355), [#6465](https://github.com/MetaMask/core/pull/6465), [#6632](https://github.com/MetaMask/core/pull/6632))
 - Bump `@metamask/controller-utils` from `^11.11.0` to `^11.14.0` ([#6303](https://github.com/MetaMask/core/pull/6303), [#6620](https://github.com/MetaMask/core/pull/6620), [#6629](https://github.com/MetaMask/core/pull/6629))
+
 - Bump `@noble/hashes` from `^1.4.0` to `^1.8.0` ([#6101](https://github.com/MetaMask/core/pull/6101))
 
 ## [13.1.0]

packages/phishing-controller/src/PhishingDetector.ts

@@ -51,14 +51,21 @@ export type PhishingDetectorConfiguration = {
   version?: number | string;
   allowlist: string[][];
   blocklist: string[][];
-  blocklistPaths?: PathTrie;
   c2DomainBlocklist?: string[];
+  blocklistPaths?: PathTrie;
   fuzzylist: string[][];
   tolerance: number;
 };
 
+type InternalPhishingDetectorConfiguration = Omit<
+  PhishingDetectorConfiguration,
+  'c2DomainBlocklist'
+> & {
+  c2DomainBlocklist?: Set<string>;
+};
+
 export class PhishingDetector {
-  readonly #configs: PhishingDetectorConfiguration[];
+  readonly #configs: InternalPhishingDetectorConfiguration[];
 
   readonly #legacyConfig: boolean;
 
@@ -75,17 +82,23 @@ export class PhishingDetector {
   constructor(opts: PhishingDetectorOptions) {
     // recommended configuration
     if (Array.isArray(opts)) {
-      this.#configs = processConfigs(opts);
+      this.#configs = processConfigs(opts).map((config) => ({
+        ...config,
+        c2DomainBlocklist: new Set<string>(config.c2DomainBlocklist),
+      }));
       this.#legacyConfig = false;
       // legacy configuration
     } else {
       this.#configs = [
-        getDefaultPhishingDetectorConfig({
-          allowlist: opts.whitelist,
-          blocklist: opts.blacklist,
-          fuzzylist: opts.fuzzylist,
-          tolerance: opts.tolerance,
-        }),
+        {
+          ...getDefaultPhishingDetectorConfig({
+            allowlist: opts.whitelist,
+            blocklist: opts.blacklist,
+            fuzzylist: opts.fuzzylist,
+            tolerance: opts.tolerance,
+          }),
+          c2DomainBlocklist: new Set<string>(),
+        },
       ];
       this.#legacyConfig = true;
     }
@@ -296,11 +309,11 @@ export class PhishingDetector {
     const domainsToCheck = generateParentDomains(sourceParts.reverse(), 5);
 
     for (const { c2DomainBlocklist, name, version } of this.#configs) {
-      if (!c2DomainBlocklist || c2DomainBlocklist.length === 0) {
+      if (!c2DomainBlocklist || c2DomainBlocklist.size === 0) {
         continue;
       }
 
-      if (c2DomainBlocklist.includes(hostnameHash)) {
+      if (c2DomainBlocklist.has(hostnameHash)) {
         return {
           name,
           result: true,
@@ -311,7 +324,7 @@ export class PhishingDetector {
 
       for (const domain of domainsToCheck) {
         const domainHash = sha256Hash(domain);
-        if (c2DomainBlocklist.includes(domainHash)) {
+        if (c2DomainBlocklist.has(domainHash)) {
           return {
             name,
             result: true,

packages/phishing-controller/src/utils.ts

@@ -231,28 +231,30 @@ export const processDomainList = (list: string[]): string[][] => {
  * @param override.blocklist - the optional blocklist to override.
  * @param override.fuzzylist - the optional fuzzylist to override.
  * @param override.tolerance - the optional tolerance to override.
+ * @param override.c2DomainBlocklist - the optional c2DomainBlocklist to override.
  * @returns the default phishing detector configuration.
  */
 export const getDefaultPhishingDetectorConfig = ({
   allowlist = [],
   blocklist = [],
+  c2DomainBlocklist = [],
   fuzzylist = [],
   tolerance = DEFAULT_TOLERANCE,
 }: {
   allowlist?: string[];
   blocklist?: string[];
+  c2DomainBlocklist?: string[];
   fuzzylist?: string[];
   tolerance?: number;
-}): PhishingDetectorConfiguration => {
-  return {
-    allowlist: processDomainList(allowlist),
-    // We can assume that blocklist is already separated into hostname-only entries
-    // and hostname+path entries so we do not need to separate it again.
-    blocklist: processDomainList(blocklist),
-    fuzzylist: processDomainList(fuzzylist),
-    tolerance,
-  };
-};
+}): PhishingDetectorConfiguration => ({
+  allowlist: processDomainList(allowlist),
+  // We can assume that blocklist is already separated into hostname-only entries
+  // and hostname+path entries so we do not need to separate it again.
+  blocklist: processDomainList(blocklist),
+  c2DomainBlocklist,
+  fuzzylist: processDomainList(fuzzylist),
+  tolerance,
+});
 
 /**
  * Processes the configurations for the phishing detector, filtering out any invalid configs.