search

powercord-community / suggestions

Repo where you can find and share plugin suggestions for Powercord
27 stars 4 forks source link

An automatic link unshortener so we can see where shortened links redirect to and if they are safe. #667

Open SolninjaA opened 2 years ago

SolninjaA commented 2 years ago

Description

An automatic link unshortener so we can see where shortened links redirect to and if they are safe.

More info

Hi everyone! I had this really handy idea, a plugin that could automatically unshorten links that have already been shortened (e.g. bit.ly). This would be useful for security reasons, because you can't see exactly where a shortened link is going you may accidentally go to a website that is malicious. This is where this plugin would come in, it would automatically unshorten URLs so you can see where they actually go!

Example: Before plugin: https://bit.ly/shortenedlink

After plugin: https://maliciouswebsite.net

Here is a website that does exactly what I would like, automatically on Discord: https://unshorten.it/

I hope this makes sense. Thanks!

pythonmcpi commented 2 years ago

Looks like sending a POST request to the /main/get_long_url path of https://unshorten.it would work. However, a plugin that does this automatically risks sending private links to a third party website, which violates other users' privacy. (Guidelines 2 & 7) In my opinion, a link unshortener plugin should do it on demand, not automatically.

Another possible solution is to send a HEAD request to a short link and see if it redirects. The problem with this approach that it leaks the user's ip address to any websites sent in chat, which is undesirable. (Guideline 7) Hence, doing it on-demand is the only safe solution.

Both https://unshorten.it and the HEAD request method will fail to find the final destination of adf.ly (and other non-instant shorteners) links. For example, https://user3456.insomnia247.nl/chicken redirects to a youtube video, but https://unshorten.it shows this: https://nitro-scam.discowd.com/chrome_Dx8XRIoW3k.png (basically, it says the link isn't a shortened url).

SolninjaA commented 2 years ago

Looks like sending a POST request to the /main/get_long_url path of https://unshorten.it would work. However, a plugin that does this automatically risks sending private links to a third party website, which violates other users' privacy. (Guidelines 2 & 7) In my opinion, a link unshortener plugin should do it on demand, not automatically.

Another possible solution is to send a HEAD request to a short link and see if it redirects. The problem with this approach that it leaks the user's ip address to any websites sent in chat, which is undesirable. (Guideline 7) Hence, doing it on-demand is the only safe solution.

Both https://unshorten.it and the HEAD request method will fail to find the final destination of adf.ly (and other non-instant shorteners) links. For example, https://user3456.insomnia247.nl/chicken redirects to a youtube video, but https://unshorten.it shows this: https://nitro-scam.discowd.com/chrome_Dx8XRIoW3k.png (basically, it says the link isn't a shortened url).

Thanks for the reply, I am not necessarily sure how to start making a plugin like that but I can try. Thanks for your insight.

12944qwerty commented 2 years ago

Could be a port of this? https://github.com/hoofer-vizality/links-flagger. It doesn't show where shortened links redirect to but does show if they're safe or not

SolninjaA commented 2 years ago

Could be a port of this? https://github.com/hoofer-vizality/links-flagger. It doesn't show where shortened links redirect to but does show if they're safe or not

Thanks for the reply! I tried installing that but it doesn't seem to work.

12944qwerty commented 2 years ago

Because it's for vizality? I said we could port it

SolninjaA commented 2 years ago

Oh, didn’t see that, my bad.

SolninjaA commented 2 years ago

Because it's for vizality? I said we could port it

It might be a good idea, I like the plugin functionality.

Scraft161 commented 2 years ago

this plugin is definitely a must have for less privacy-minded individuals, (maybe also add a feature to highlight links from link shortners with a warning that the content behind might be unsafe). I would love to make this plugin a reality, but am not familiar enough with the powercord api to do this.

for the rest this is definitely a plugin worth porting.