Implementing Google Safe Browsing server-side to sanitize untrusted input

http://codeascraft.etsy.com/2012/03/04/google-safe-browsing/

by kellanem • 14 years ago

46 10 14 years ago

codeascraft.etsy.com

nodata• 14 years ago

Privacy implications?

jusob• 14 years ago

With GSBv2, no URL is sent to Google. They recently introduced the Lookup API where users need to send the URL, but this is not what Etsy is using.

indec4• 14 years ago

The privacy risk for GSB in general is that you are sharing URLs with a (trusted) third party. That's most acute with the REST API, but most implementations (including gsb4ugc) cache a local copy of the lookup tables and so don't actually send URLs to Google. There is still a very occasional need to send a link to Google for validation, but in the server-side case the only context Google has for the request is the IP address of the server, which minimizes privacy risks as much as possible.

obtu2• 14 years ago

Interesting idea. There are some extra challenges when the scanning is not done live.

Does Etsy accept url shorteners? Including some that allow editing? Is it feasible to rewrite the content to have the redirected URLs?

indec4• 14 years ago

We "unroll" redirects as much as possible so that we can check the URL at the end.

obtu2• 14 years ago

In the sense of following them, or rewriting them as well?

Implementing Google Safe Browsing server-side to sanitize untrusted input

Related Stories