Preventing malicious linking

Feature
21

Didn’t thought about that :open_mouth: . Thats the best way I guess @codinghorror . Then i will start implementing

22

Can it not be made so that there is a scheduled task every 6 months to re check the posted links which were flagged earlier?

1 Like
23

Again why check something that has not been clicked in 3 months. All of this should key on someone clicking it.

1 Like
24

That’s fair but my Question was in reference to Your idea!

if a link was flagged for the first time it was clicked and then an year later it is still flagged but safebrowsing has then whitelisted it! … when will the recheck happen? and how to determine when is the right time to do the recheck if any?

1 Like
25

In google api documentation they say that

We are constantly updating site definitions

I think we have to recheck the URLs against the safebrowsing database in a certain time interval and flag them. We can specify multiple urls at a single time too. Thus I think a routine check will be a better option. They say ,

Lookup API (v4): You can query up to 500 URLs in a single POST request.
Lookup API (v4) and Update API (v4): A single API key can make requests for up to 10,000 clients per 24-hour period.

1 Like
26

The only acceptable way to do this is on click, then cache result for a period of time (months).

2 Likes
27

Hi,
I will be building a plugin for preventing malicious linking. I would like to do it in two phases.

Phase 1 :

  • Query each link in google safe browsing API for the first time and if it is a malicious link, store the details in the plugin store.
  • When the user clicks the same link after the first time, the plugin will know that the link is malicious by querying the plugin store.

Phase 2 :

  • I will implement a way to cache the results from google API .
  • Cache will be expired after a given time period.
28

Are you going to alert the user only on second time? You can check all the links with Google API at the time post creation itself. DiscourseEvent triggers can help you for that. Also you can flag the post immediately after the malicious URL detection. It will be more helpful.

5 Likes
29

I wanted to say that it will alert the users in the first time using the results directly from the Google’s API and after that it will use the cached results. I was thinking about the links that are not being clicked even once, if I query those links it would be a waste of resources. What do you guys think ?
@vinothkannans ?

30

I don’t think so. We already querying almost all the links for Onebox. Is that means waste of resources? Here main objective is Preventing malicious linking. How will you prevent if someone opened the malicious link from email notification? What if he copied the link and opened in new browser? There are many more ways where you can’t stop users from opening the link.

7 Likes
31

Good point @vinothkannans :roll_eyes: never thought about that. So the plugin will check links when the post with the link is created . Thank you a lot for the help. I will continue posting updates.

2 Likes
32

That is a good point, and a solid argument in favor of checking at post create time…

6 Likes
33

Hi all,
Would it be appropriate to use the PluginStore for storing data etc : flagged post id’s and malicious urls ?

34

Hi all ,
currently my plugin is showing this kind of a basic warning

image
image.png808×245 13.2 KB

It successfully identifies malicious urls and adds the warning automatically.

3 Likes
35

Here is my plugin

6 Likes