Stripping Outlook Safe Link URLs?

Contribute Feature
6

Safe Links scans incoming email for known malicious hyperlinks. Scanned URLs are rewritten or wrapped using the Microsoft standard URL prefix: https://nam01.safelinks.protection.outlook.com .

We might be able to unwrap these, can you post some examples of how they’re rewritten?

Trawling my inbox I have two:

https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fvcacanada.com%2F&data=02%7C01%7Cinternalmedicine.altavista%40vca.com%7C8b234337846c4b26704608d859d038fb%7Ca2bdfa5ebe874736892b6db8bbf91546%7C1%7C0%7C637358098123527523&sdata=2b8GyZaj5cH3XNVMQ7KuIB8zgv2n4rEqX2MJutsQn2c%3D&reserved=0
https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtube.com%2Fembed%2F4qo27xcVS5I&data=02%7C01%7C%7C53e03ffe911442ddf50108d6492424d0%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636776816911303670&sdata=vzPKnv1BDVf6LL4z9P3faVYkxxcLcyjnnrLcch%2B1npA%3D&reserved=0

This does look pretty easy:

def un_safelink(link):
    try:
        parsed = urllib.parse.urlparse(link)
        if parsed.netloc != 'nam01.safelinks.protection.outlook.com':
            return link
        query = urllib.parse.parse_qs(parsed.query)
        return query['url'][0]
    except:
        return link
4 Likes