some JavaScript for detecting dangerous links

[ixfd64]

As we know, certain files with extensions like .swf and [Caution: Executable File] are considered dangerous. To protect users, the extensions are "censored" such that users must manually type in the URL.

 

 

 

True, many [Caution: Executable File] files and such are dangerous, but there are also many legitimate files (such as software updates). Because the URLs are censored, many users may not be smart enough to determine what the censored URLs are.

 

 

 

I think that the best solution would not be to censor the links, but to add some sort of warning. I wrote some JavaScript to do just that:

 

 

 

/*

Script: File Extension Guardian v1.1

Author: Danny Chia (dannychia [at] berkeley.edu)

Description: There are some malicious users that will post dangerous

 links on forums in hopes that someone will click them. This script is

 designed to remind users that clicking certain links can be dangerous,

 although it does not actually prevent them from accessing the links.

Usage: This script should be placed at the bottom of the page. Since

 HTML is parsed from top to bottom, some elements of the script (such

 as document.links.length) may not work properly if the script is

 placed anywhere else.

License: This script is available under the terms of the GNU Free

 Documentation License (GFDL) and may be freely modified or distributed.

*/



// counts links on page

var c = document.links.length;



// creates array for storing URLs

var ar = new Array(c);



// potentially dangerous extensions

var badExt = new Array("ade", "adp", "bas", "bat", "cmd", "com", "exe",

 "lnk", "mdb", "mde", "pif", "scr", "shs", "swf", "vbs", "vb", "vbe",

 "ws", "wsc", "wsf", "wsh", "zip");



// activates confirmation system if there are links

function init() {

 if (c > 0) {

   checkLinks();

 }

}



// checks for potentially dangerous links

function checkLinks() {

 for (var i = 0; i < c; i++) {

   ar[i] = document.links[i].href;

   for (var j = 0; j < badExt.length; j++) {

     if (ar[i].substring(ar[i].length - 3, ar[i].length) == badExt[j] ||

  ar[i].substring(ar[i].length - 2, ar[i].length) == badExt[j]) {

document.links[i].href = "javascript:confirmLink(" + i + ", '" +

  badExt[j] + "')";

     }

   }

 }

}



// generates confirmation dialog

function confirmLink(linkID, ext) {

 var msg = new Array("Caution: You are attempting to access a file with ",

 "the '." + ext + "' extension. Files with this extension may contain ",

 "content that is harmful to your computer. The URL of the page is ",

 "provided below:\n\n" + ar[linkID],

 "\n\nAre you sure you want to access this file?");

 var confirmed = confirm(msg[0] + msg[1] + msg[2] + msg[3] + msg[4]);

 if (confirmed) {

   window.location = ar[linkID];

 }

}



//starts script

document.onLoad = init();

 

 

 

The source code is here: http://geocities.com/dchia1010/checkLinks.txt

 

 

 

To see the script in action, go here: http://geocities.com/dchia1010/js-test.html

 

 

 

What do you guys think?

[mrmyk]

I'm suprised. The last time i tried to upload a signature with geocities it said exactly what you are trying implement but it seems to be working fine for you at the bottom.

[ixfd64]

Hmm, that's very odd.

 

 

 

Also, if your GeoCities signature doesn't work, it's because GeoCities does not allow hotlinking.

[____]

Nice idea ixfd; and a rather solid warning, more than just the censored text.

[mchainmail]

I don't know if this is possible, but could you add a delay before you can hit okay? Like the warning has to be on screen for 5 seconds or something.

[ixfd64]

It might be possible, but I'm not that experienced with JavaScript. :lol:

 

 

 

If it's possible, it will probably have to use a new function instead of JavaScript's built-in confirm() function.

[Adam007]

Nice work. Especially useful for the occasion where someone puts up a legitimate link, lets the thread grow a few pages, then replaces it with a bad one.

[Errdoth]

It might be possible, but I'm not that experienced with JavaScript. :lol:

 

 

 

If it's possible, it will probably have to use a new function instead of JavaScript's built-in confirm() function.

 

 

 

it'd be easily done with a window.setTimeout