fix(18194): fix trigger to close window when clicking "back to safety"

[DDDDDanica]

Fixes: https://app.zenhub.com/workspaces/extension-client-team-63529dce65cbb100265a3842/issues/gh/metamask/metamask-extension/18194

Before:

• [user visits blocked page] -> [window.location.href = "warning page URL" in contentScript] -> [warning page] -> [user clicks "Back to safety"] -> [ window.close() ] -> not working in Firefox

Trials:

• [user visits blocked page] -> [ location.href = "warning page URL" ] -> [warning page] -> [user clicks "Back to safety"] -> [window.open('location', '_self', '');window.close();] -> not working for Firefox

• [user visits blocked page] -> [window.location.replace("warning page URL") ] -> [warning page] -> [user clicks "Back to safety"] -> [window.close() ] -> not working for Firefox

• [user visits blocked page] -> [window.location.hrer("warning page URL") ] -> [warning page] -> [user clicks "Back to safety"] -> [open a new blank page] -> [document.visibilitystate === hidden, detect user has left previous warning page] -> [window.close() inactive page] -> not working for Firefox

Temporary solution:

• [user visits blocked page] -> [ location.href = "warning page URL" ] -> [warning page] -> [user clicks "Back to safety"] -> [ location.replace("about:blank") ] -> page stays open on blank tab, works for both browsers

Proposed by @danjm :
- [user visits blocked page] -> [ location.href = "warning page URL" ] -> [warning page] -> [user clicks "Back to safety"] -> [ location.replace(MM extension expanded view)] -> page stays open on a specific route, works for both browsers

After:

phishing.mov

[Gudahtt]

Huh, interesting solution! It seems that this is an attempt to circumvent browser protections against programmatically closing a window, by "opening" the window programmatically first before closing it. I have seen references to this approach not working on some browser versions, but I don't know how that affects the range of versions we support.

The e2e tests here are passing, but the test for this close button might not be sufficient. Right now that test is configured to ensure the length of history on the phishing warning page is exactly 1 so that the browser considers it as being opened programmatically. The reason this test didn't catch the bug in the extension is that today the extension redirects to this page, resulting in a history length of 2. We should try to ensure the test accurately captures this scenario, so that it can protect against future regressions.

So I have 2 suggestions overall: consider browser support, and ensure the test is updated to catch this problem.

[danjm]

with the change here, the tab is now left open, right? fca89f3

[danjm]

Looks good. Just Mark's test suggestion to address

[danjm]

LGTM

[Gudahtt]

LGTM!