python-discord / meta

Issue tracker for suggestions and other questions relating to our community
https://pythondiscord.com
31 stars 5 forks source link

Feature: check tiny/short URLs destinations #88

Closed TruncatedDinoSour closed 3 years ago

TruncatedDinoSour commented 3 years ago

What?

here's a suggestion: so i found out that shortened URLs bypass the discord invite link protection thing; so my suggestion is that we should test the URLs destanations: https://stackoverflow.com/questions/2454149/detect-destination-of-shortened-or-tiny-url

Justification

to check if people are seding people malicious URLs, to other short URLs(that are probably malicious cuz who makes a short url for a short URL for a normal thing??) and discord invites as the discord bot does't check the destination of the URL's , it only checks something like "does this URL have discord.gg in it?"

Implementation

one of these answers should help: https://stackoverflow.com/questions/2454149/detect-destination-of-shortened-or-tiny-url

you could get the distantion of the URL and ofc it would be a pain to test every URL, but we can add some flags:

- URLs shorter than 25 characters?
- URLs with the top-level domain of like .it, .io, .ly, .at?
- known URL shortners, like bit.ly, shorturl.at, etc. stored maybe in a seperate file as a list?

and ofc probably more flags, but i can't think of any other ones and y'all could check if the destination has gone to discord.gg or discord.com/invite, i mean they could make a short URL for another short URL, but wouldn't the destination be discord.gg or discord.com/invite? or any other weird URL? for example that downloadsa file or something like that?

sorry for mistakes or anything i said weirdly, if any confusion occurs comment under this issue:)

jb3 commented 3 years ago

We're not interested in automatically following redirects since it opens several security holes and is a large cost for little benefit.

We'll look into automatically alerting for known short URLs to manually investigate through available services.