[Bug Report] Improper rule priority handling of DOMAIN-KEYWORD

SurgeUser1

How to reproduce

Create a test1.list under Profiles folder with the following content:

.github.io

Create a test2.list under Profiles folder with the following content:

DOMAIN-KEYWORD,github

Create a test.conf under Profiles folder with the following content:

[General]
skip-proxy = 192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12, 127.0.0.1, localhost, *.local

[Rule]
DOMAIN-SET,./test1.list,DIRECT
RULE-SET,./test2.list,DIRECT
FINAL,DIRECT

Switch the profile to test.
Open the terminal, use Copy Shell Export Command to configure the proxy environment variables.
Execute curl https://github.io and curl https://example.github.io in the terminal.

Expected Behavior

Both https://github.io and example.github.io should be matched by the test1.list, because it is defined first in the [Rule] section.

Actual Behavior

Only https://github.io is matched by the test1.list, while example.github.io is actually matched by the test2.list. See the attached screenshot:

cc @SurgeTeam

SurgeTeam

The DOMAIN-SET rule doesn't support include an eTLD suffix. (.github.io is an eTLD)

Here is the full list: https://publicsuffix.org/list/

SurgeUser1

SurgeTeam

I have tested it with gitlab.io and example.gitlab.io, pages.dev and example.pages.dev, vercel.app and example.vercel.app (They are all in the Public Suffix List as well) but the DOMAIN-SET still works.

The issue is about although DOMAIN-SET being in the first of the [Rule] section, Surge still doesn't honor the priority and prefers the DOMAIN-KEYWORD defined in the RULE-SET (which is in the later of the [Rule] section). The issue is NOT about DOMAIN-SET not working properly.

SurgeTeam

SurgeUser1 Surge definitely tries to match rules in order. The issue is that the ".github.io" in a DOMAIN-SET won't match "example.github.io".

SurgeUser1

SurgeTeam

According to the Surge Manual, and here I quote:

if a line begins with . matches all sub-domains and the domain name itself.

And also according to RFC1034 3.1, and here I quote:

A domain is a subdomain of another domain if it is contained within that domain. This relationship can be tested by
seeing if the subdomain's name ends with the containing domain's name. For example, A.B.C.D is a subdomain of B.C.D, C.D, D, and " "

So even though .github.io itself is an eTLD, example.github.io should be considered as a subdomain of github.io, and also a subdomain of .io, and a subdomain of ..

SurgeTeam

SurgeUser1 It's a special limitation for DOMAIN-SET due to performance optimization. Please use RULE-SET instead.