Commit 4a2916b9 authored by Luc Didry's avatar Luc Didry

Protect against redirection to malicious URLs

parent cd41d07e
EXTRACTFILES=utilities/locales_files.txt
EN=lib/Lstu/I18N/en.po
FR=lib/Lstu/I18N/fr.po
XGETTEXT=carton exec local/bin/xgettext.pl
CARTON=carton exec
REAL_LSTU=script/application
LSTU=script/lstu
locales:
$(XGETTEXT) -f $(EXTRACTFILES) -o $(EN)
$(XGETTEXT) -f $(EXTRACTFILES) -o $(EN) 2>/dev/null
$(XGETTEXT) -f $(EXTRACTFILES) -o $(FR) 2>/dev/null
test:
$(CARTON) $(REAL_LSTU) test
......
......@@ -82,6 +82,36 @@ sub startup {
}
);
$self->helper(
is_spam => sub {
my $c = shift;
my $url = shift;
my $nb_redir = shift;
if ($nb_redir++ <= 10) {
my $res = check_fqdn($url->host);
if (defined $res) {
return {
is_spam => 1,
msg => $c->l('The URL host or one of its redirection(s) ([_1]) is blacklisted at Spamhaus. I refuse to shorten it.', $url->host)
}
} else {
my $res = $c->ua->get($url)->res;
if ($res->code >= 300 && $res->code < 400) {
return $c->is_spam(Mojo::URL->new($res->headers->location), $nb_redir);
} else {
return { is_spam => 0 };
}
}
} else {
return {
is_spam => 1,
msg => $c->l('The URL redirects 10 times or most. It\'s most likely a dangerous URL (spam, phishing, etc.). I refuse to shorten it.', $url->host)
}
}
}
);
$self->hook(
after_dispatch => sub {
shift->provisioning();
......@@ -138,9 +168,9 @@ sub startup {
} elsif (defined($custom_url) && LstuModel::Lstu->count('WHERE short = ?', $custom_url) > 0) {
$msg = $c->l('The shortened text ([_1]) is already used. Please choose another one.', $custom_url);
} elsif (is_http_uri($url->to_string) || is_https_uri($url->to_string)) {
my $res = check_fqdn($url->host);
if (defined $res) {
$msg = $c->l('The URL host ([_1]) is blacklisted at Spamhaus. I refuse to shorten it.', $url->host);
my $res = $c->is_spam($url, 0);
if ($res->{is_spam}) {
$msg = $res->{msg};
} else {
my @records = LstuModel::Lstu->select('WHERE url = ?', $url);
......
......@@ -20,11 +20,11 @@ msgstr ""
"X-Poedit-SourceCharset: UTF-8\n"
#. ($url)
#: lib/Lstu.pm:181
#: lib/Lstu.pm:211
msgid "%1 is not a valid URL."
msgstr ""
#: templates/layouts/default.html.ep:28
#: templates/layouts/default.html.ep:57
msgid "About"
msgstr ""
......@@ -32,7 +32,7 @@ msgstr ""
msgid "Admin password"
msgstr ""
#: lib/Lstu.pm:296
#: lib/Lstu.pm:326
msgid "Bad password"
msgstr ""
......@@ -60,6 +60,14 @@ msgstr ""
msgid "Go!"
msgstr ""
#: templates/layouts/default.html.ep:36
msgid "Henny Penny"
msgstr ""
#: templates/layouts/default.html.ep:36
msgid "HennyPenny-Regular"
msgstr ""
#: templates/index.html.ep:52
msgid "Hit Enter, then Ctrl+C to copy the short link"
msgstr ""
......@@ -76,7 +84,7 @@ msgstr ""
msgid "JSON: success"
msgstr ""
#: templates/layouts/default.html.ep:27
#: templates/layouts/default.html.ep:56
msgid "License:"
msgstr ""
......@@ -89,7 +97,7 @@ msgid "Next"
msgstr ""
#. ($c->config('contact')
#: lib/Lstu.pm:173
#: lib/Lstu.pm:203
msgid "No shortened URL available. Please retry or contact the administrator at %1. Your URL to shorten: %2"
msgstr ""
......@@ -113,27 +121,32 @@ msgstr ""
msgid "Shortened URL"
msgstr ""
#: templates/layouts/default.html.ep:30 templates/stats.html.ep:4
#: templates/layouts/default.html.ep:59 templates/stats.html.ep:4
msgid "Statistics"
msgstr ""
#. ($url->host)
#: lib/Lstu.pm:143
msgid "The URL host (%1) is blacklisted at Spamhaus. I refuse to shorten it."
#: lib/Lstu.pm:96
msgid "The URL host or one of its redirection(s) (%1) is blacklisted at Spamhaus. I refuse to shorten it."
msgstr ""
#. ($url->host)
#: lib/Lstu.pm:109
msgid "The URL redirects 10 times or most. It's most likely a dangerous URL (spam, phishing, etc.). I refuse to shorten it."
msgstr ""
#. ($c->url_for('/')
#: lib/Lstu.pm:322
#: lib/Lstu.pm:352
msgid "The shortened URL %1 doesn't exist."
msgstr ""
#. ($custom_url)
#: lib/Lstu.pm:139
#: lib/Lstu.pm:169
msgid "The shortened text (%1) is already used. Please choose another one."
msgstr ""
#. ($url)
#: lib/Lstu.pm:137
#: lib/Lstu.pm:167
msgid "The shortened text can contain only numbers, letters and the - and _ character, can't be \"a\", \"api\" or \"stats\" or end with \".json\". Your URL to shorten: %1"
msgstr ""
......
......@@ -25,20 +25,19 @@ msgstr ""
"X-Poedit-SourceCharset: UTF-8\n"
#. ($url)
#: lib/Lstu.pm:175
#: lib/Lstu.pm:211
msgid "%1 is not a valid URL."
msgstr "%1 n’est pas une URL valide."
#: templates/layouts/default.html.ep:28
#: templates/layouts/default.html.ep:57
msgid "About"
msgstr "À propos"
#: templates/stats.html.ep:12
#: templates/stats.html.ep:13
#: templates/stats.html.ep:12 templates/stats.html.ep:13
msgid "Admin password"
msgstr "Mot de passe administrateur"
#: lib/Lstu.pm:290
#: lib/Lstu.pm:326
msgid "Bad password"
msgstr "Mot de passe incorrect"
......@@ -54,44 +53,43 @@ msgstr "Compteur"
msgid "Created"
msgstr "Créé le"
#: templates/api.html.ep:15
#: templates/index.html.ep:10
#: templates/index.html.ep:9
#: templates/api.html.ep:15 templates/index.html.ep:10 templates/index.html.ep:9
msgid "Custom shortened text"
msgstr "Texte du raccourci personnalisé"
#: templates/api.html.ep:21
#: templates/api.html.ep:39
#: templates/api.html.ep:21 templates/api.html.ep:39
msgid "Failure reason"
msgstr "Raison de l’échec"
#: templates/index.html.ep:12
#: templates/stats.html.ep:16
#: templates/index.html.ep:12 templates/stats.html.ep:16
msgid "Go!"
msgstr "Allons-y !"
#: templates/layouts/default.html.ep:36
msgid "Henny Penny"
msgstr ""
#: templates/layouts/default.html.ep:36
msgid "HennyPenny-Regular"
msgstr ""
#: templates/index.html.ep:52
msgid "Hit Enter, then Ctrl+C to copy the short link"
msgstr "Appuyez sur Entrée puis faites Ctrl+C pour copier le lien"
#: templates/api.html.ep:16
msgid ""
"If equal to \"json\", response will be in JSON format, HTML format otherwise"
msgstr ""
"Si égal à \"json\", la réponse sera au format JSON, sinon ce sera une "
"réponse en HTML"
msgid "If equal to \"json\", response will be in JSON format, HTML format otherwise"
msgstr "Si égal à \"json\", la réponse sera au format JSON, sinon ce sera une réponse en HTML"
#: templates/api.html.ep:21
#: templates/api.html.ep:39
#: templates/api.html.ep:21 templates/api.html.ep:39
msgid "JSON: failure"
msgstr "JSON : échec"
#: templates/api.html.ep:20
#: templates/api.html.ep:38
#: templates/api.html.ep:20 templates/api.html.ep:38
msgid "JSON: success"
msgstr "JSON : succès"
#: templates/layouts/default.html.ep:27
#: templates/layouts/default.html.ep:56
msgid "License:"
msgstr "Licence :"
......@@ -104,13 +102,9 @@ msgid "Next"
msgstr "Suivant"
#. ($c->config('contact')
#: lib/Lstu.pm:168
msgid ""
"No shortened URL available. Please retry or contact the administrator at %1. "
"Your URL to shorten: %2"
msgstr ""
"Il n’y a plus d’URL raccourcie disponible. Veuillez réessayer ou contactez l’"
"administrateur sur %1. Rappel de l’URL à raccourcir : %2"
#: lib/Lstu.pm:203
msgid "No shortened URL available. Please retry or contact the administrator at %1. Your URL to shorten: %2"
msgstr "Il n’y a plus d’URL raccourcie disponible. Veuillez réessayer ou contactez l’administrateur sur %1. Rappel de l’URL à raccourcir : %2"
#: templates/api.html.ep:12
msgid "Parameters:"
......@@ -124,9 +118,7 @@ msgstr "Précédent"
msgid "Response for HTML format"
msgstr "Réponse pour le format HTML"
#: templates/api.html.ep:18
#: templates/api.html.ep:27
#: templates/api.html.ep:36
#: templates/api.html.ep:18 templates/api.html.ep:27 templates/api.html.ep:36
msgid "Response:"
msgstr "Réponse :"
......@@ -134,76 +126,59 @@ msgstr "Réponse :"
msgid "Shortened URL"
msgstr "URL raccourcie"
#: templates/layouts/default.html.ep:30
#: templates/stats.html.ep:4
#: templates/layouts/default.html.ep:59 templates/stats.html.ep:4
msgid "Statistics"
msgstr "Statistiques"
#. ($url->host)
#: lib/Lstu.pm:96
msgid "The URL host or one of its redirection(s) (%1) is blacklisted at Spamhaus. I refuse to shorten it."
msgstr "L'hôte de l'URL ou d'une de ses redirections (%1) est considéré comme nocif par Spamhaus. Je refuse de la raccourcir."
#. ($url->host)
#: lib/Lstu.pm:109
msgid "The URL redirects 10 times or most. It's most likely a dangerous URL (spam, phishing, etc.). I refuse to shorten it."
msgstr "L'URL redirige 10 fois ou plus vers un autre site. Il est probable qu'il s'agisse d'une URL dangereuse (pourriel, hameçonnage, etc.). Je refuse de la raccourcir."
#. ($c->url_for('/')
#: lib/Lstu.pm:316
#: lib/Lstu.pm:352
msgid "The shortened URL %1 doesn't exist."
msgstr "L’URL raccourcie %1 n’existe pas"
#. ($custom_url)
#: lib/Lstu.pm:138
#: lib/Lstu.pm:169
msgid "The shortened text (%1) is already used. Please choose another one."
msgstr ""
"Le texte du raccourci (%1) est déjà utilisé. Veuillez en choisir un autre"
msgstr "Le texte du raccourci (%1) est déjà utilisé. Veuillez en choisir un autre"
#. ($url)
#: lib/Lstu.pm:136
msgid ""
"The shortened text can contain only numbers, letters and the - and _ "
"character, can't be \"a\", \"api\" or \"stats\" or end with \".json\". Your "
"URL to shorten: %1"
msgstr ""
"Le texte du raccourci ne doit contenir que des chiffres, des lettres et les "
"caractères - et _, ne peut être \"a\", \"api\" ou \"stats\" ou se terminer "
"par \".json\". Rappel de l’URL à raccourcir : %1"
#: lib/Lstu.pm:167
msgid "The shortened text can contain only numbers, letters and the - and _ character, can't be \"a\", \"api\" or \"stats\" or end with \".json\". Your URL to shorten: %1"
msgstr "Le texte du raccourci ne doit contenir que des chiffres, des lettres et les caractères - et _, ne peut être \"a\", \"api\" ou \"stats\" ou se terminer par \".json\". Rappel de l’URL à raccourcir : %1"
#: templates/stats.html.ep:27
msgid "URL"
msgstr "URL"
#: templates/api.html.ep:14
#: templates/index.html.ep:5
#: templates/index.html.ep:6
#: templates/api.html.ep:14 templates/index.html.ep:5 templates/index.html.ep:6
msgid "URL to shorten"
msgstr "URL à raccourcir"
#: templates/api.html.ep:22
msgid ""
"You will be redirected to the Lstu interface with a message giving the "
"shortened URL"
msgstr ""
"Vous aurez l’interface normale de Lstu avec un message indiquant l’URL "
"raccourcie"
msgid "You will be redirected to the Lstu interface with a message giving the shortened URL"
msgstr "Vous aurez l’interface normale de Lstu avec un message indiquant l’URL raccourcie"
#: templates/api.html.ep:30
msgid ""
"You will be redirected to the targeted URL or to the Lstu interface with a "
"message giving the failure reason"
msgstr ""
"Vous serez redirigé vers l’URL cible ou vers la page d’accueil de Lstu avec "
"un message indiquant la raison de l’échec"
msgid "You will be redirected to the targeted URL or to the Lstu interface with a message giving the failure reason"
msgstr "Vous serez redirigé vers l’URL cible ou vers la page d’accueil de Lstu avec un message indiquant la raison de l’échec"
#: templates/api.html.ep:14
msgid "mandatory"
msgstr "obligatoire"
#: templates/api.html.ep:15
#: templates/api.html.ep:16
#: templates/api.html.ep:15 templates/api.html.ep:16
msgid "optional"
msgstr "facultatif"
#: templates/api.html.ep:25
#: templates/api.html.ep:34
#: templates/api.html.ep:25 templates/api.html.ep:34
msgid "shortened_url"
msgstr "url_raccourcie"
#. ($url->host)
#: lib/Lstu.pm:143
msgid "The URL host (%1) is blacklisted at Spamhaus. I refuse to shorten it."
msgstr ""
"L'hôte de l'URL (%1) est considéré comme nocif par Spamhaus. Je refuse de la "
"raccourcir."
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment