1

Let's say I have a site like stack overflow. People post comments with - possibly - links to external sites. Is there some "standard" set of rules to make it reasonably safe for users and website?

I have noticed the following features on other websites:

  • All links have nofollow attribute, that helps to reduce site penalization by search engines.
  • The sites usually made some screening of the target link. Because it usually offers the target page's title for link description at the time of writing the comment.

So, should I always screen the link target's content somehow? And perhaps allow only some mime-types, even then I am not able to guarantee it won't change after some time anyway? Should I disallow link shorteners (like bit.ly), to make it harder to hide actual target link? Should I check the links regularly?

Do You have any experience with this domain?

Improve this question
5
  • 1
    Personally, I filter out all HTML. Users can post URLs, but people have to copy/paste them. However, what you could do is take any URL and place it in a queue for an admin to OK. Only when OK'd would your site add the <a href... tag and your code would write the whole thing. So effectively a growing white-list... and maybe black-list which would remove not approved URLs from content.
    – pcalkins
    Nov 25, 2020 at 20:30
  • Why do you assume that links are harmful?
    – vidarlo
    Nov 25, 2020 at 20:39
  • @vidarlo - XSS, CSRF, something like <a href='example.com/malware.exe'>wikipedia.com</a> and so on. I am not security expert for the full list
    – ooouuiii
    Nov 25, 2020 at 20:46
  • @ooouuiii the fix for that is to educate users to not run software in unexpected situations, not remove links. You can scan it all you want, but it may change at any point in time, even depending on factors such as user agent, IP addresses etc. So you may get wikipedia, your website users will get a malicious .exe... And XSS, CSRF and so forth is not a problem with links, but how you handle input in general.
    – vidarlo
    Nov 25, 2020 at 20:49
  • @vidarlo I see the point, I should probably remove XSS / CSRF from the scope of the question. But about the redirects to unwanted content, You just cannot leave n% of the comments to be malicious or spam (more about the usability and value of the website then security here). So there may be e.g. triggers. When comment is edited after validation and link is added, perhaps it needs another validation. "Flag button" - to mark spam. Etc.
    – ooouuiii
    Nov 25, 2020 at 21:02

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .