Feat: phishing detection #9610

hamza221 · 2024-04-29T12:35:32Z

lib/Service/PhishingDetectionService.php

ChristophWurst · 2024-05-22T15:09:05Z

lib/Service/PhishingDetectionService.php

+	}
+
+	private function isLink(string $text): bool {
+		$pattern = '/^(https?:\/\/|www\.|[a-zA-Z0-9-]+\.[a-zA-Z]{2,})/i';


https://www.php.net/manual/en/function.filter-var.php#refsect1-function.filter-var-examples

+1 for not using a custom Regexp.

But if I understand correctly this method isn't supposed to match only fully qualified URLs, but all text that looks roughly like a URL (as part of a link text).

If I'm correct then FILTER_VALIDATE_URL would be too strict because it doesn't accept e.g. cloud.nextcloud.com/p/something. Additionally it doesn't accept URLs containing non-ASCII characters.

I'd suggest to use a library to find URLs in text. The Horde lib "Text_Filter" contains a class that links all found URLs, maybe some methods of that can be used?

Also maybe the method could be renamed to something more telling (e.g. "textLooksLikeALink()"), and get a comment about its purpose?

https://gist.github.com/gruber/8891611 maybe this can be a more robust solution ?

Text_Filter is based on it

You could use the original source, yes. But a library might bring the benefit that possible changes (there's a list of TLDs in there, which may change) are tended for by multiple people/projects – I'm unsure about the Horde libs in this regard, though.

ChristophWurst · 2024-05-22T15:18:34Z

lib/Service/PhishingDetectionService.php

+use OCA\Mail\AddressList;
+use OCA\Mail\Contracts\ITrustedSenderService;
+
+class PhishingDetectionService {


this new class needs tests

lib/Service/PhishingDetectionService.php

pabzm · 2024-05-23T07:55:38Z

lib/Service/PhishingDetectionService.php

+		}
+		foreach ($zippedArray as $zipped) {
+			if($this->isLink($zipped['linkText'])) {
+				if (str_contains($zipped['linkText'], $zipped['href']) === false) {


I would suggest to use a library to normalize the href-content, because encodings and funny details (e.g. data-URLs) can easily break this comparison even if both parts actually reference the same resource.

Also currently this check would flag a link that e.g. doesn't contain its URL-scheme in its link text, which seems a bit harsh to me? (Example that would be flagged: <a href="https://cloud.nextcloud.com/">cloud.nextcloud.com</a>).

pabzm · 2024-05-23T08:01:43Z

lib/Service/PhishingDetectionService.php

+	}
+
+	private function isLink(string $text): bool {
+		$pattern = '/^(https?:\/\/|www\.|[a-zA-Z0-9-]+\.[a-zA-Z]{2,})/i';


+1 for not using a custom Regexp.

But if I understand correctly this method isn't supposed to match only fully qualified URLs, but all text that looks roughly like a URL (as part of a link text).

If I'm correct then FILTER_VALIDATE_URL would be too strict because it doesn't accept e.g. cloud.nextcloud.com/p/something. Additionally it doesn't accept URLs containing non-ASCII characters.

I'd suggest to use a library to find URLs in text. The Horde lib "Text_Filter" contains a class that links all found URLs, maybe some methods of that can be used?

Also maybe the method could be renamed to something more telling (e.g. "textLooksLikeALink()"), and get a comment about its purpose?

lib/Service/PhishingDetectionService.php

pabzm · 2024-05-23T08:27:45Z

lib/Service/PhishingDetectionService.php

+			];
+		}
+		foreach ($zippedArray as $zipped) {
+			if($this->isLink($zipped['linkText'])) {


This matches only if the link text only contains one URL-like "word". An anchor element with a link text like "login at cloud.nextcloud.com" would not be checked in this code.

kesselb · 2024-05-28T14:05:04Z

Great presentation today 👍

Sorry, I didn't have the opportunity to review the pr.

I'm uncertain about the reply-to warning. The purpose of reply-to is to send the response to a different email. I wonder if we want to use a less scary warning for such a case. For example, our calendar invitations are also using reply-to.
The PhishingDetectionService reminds me a bit about our CheckSetupController in server. I think we could move every check to an own class. Testing is also easier than. Wdyt @ChristophWurst?

st3iny

Did not test but left some comments on the code.

lib/IMAP/ImapMessageFetcher.php

lib/PhishingDetectionResult.php

lib/Service/PhishingDetection/ReplyToCheck.php

lib/PhishingDetectionList.php

lib/IMAP/ImapMessageFetcher.php

lib/PhishingDetectionList.php

lib/PhishingDetectionResult.php

lib/Service/PhishingDetection/DateCheck.php

lib/Address.php

lib/Service/PhishingDetection/PhishingDetectionService.php

ChristophWurst

Looks good

lib/Service/PhishingDetection/ContactCheck.php

lib/Service/PhishingDetection/DateCheck.php

tests/Integration/Service/Phishing/PhishingDetectionServiceIntegrationTest.php

lib/Service/PhishingDetection/DateCheck.php

ChristophWurst · 2024-06-13T12:56:26Z

codecov/project — 43.34% (-6.87%) compared to c6e28fd

could you check test coverage of new classes?

hamza221 · 2024-06-13T13:22:12Z

codecov/project — 43.34% (-6.87%) compared to c6e28fd

could you check test coverage of new classes?

ChristophWurst · 2024-06-13T13:47:57Z

Can we go to 100? :)

lib/PhishingDetectionList.php

hamza221 · 2024-06-27T01:23:27Z

ChristophWurst

👏

lib/IMAP/ImapMessageFetcher.php

ChristophWurst

Signed-off-by: Hamza Mahjoubi <[email protected]>

outdated

ChristophWurst added enhancement 2. developing labels Apr 30, 2024

hamza221 added 3. to review and removed 2. developing labels May 22, 2024

hamza221 marked this pull request as ready for review May 22, 2024 14:58

hamza221 requested a review from ChristophWurst as a code owner May 22, 2024 14:58

hamza221 requested review from kesselb, pabzm, SebastianKrupinski, ChristophWurst and st3iny and removed request for ChristophWurst May 22, 2024 14:58

ChristophWurst reviewed May 22, 2024

View reviewed changes

lib/Service/PhishingDetectionService.php Outdated Show resolved Hide resolved

ChristophWurst reviewed May 22, 2024

View reviewed changes

pabzm reviewed May 23, 2024

View reviewed changes

hamza221 added 2. developing and removed 3. to review labels May 24, 2024

hamza221 force-pushed the feat/phishing-detection branch from 71db744 to 88e87cd Compare May 29, 2024 16:21

hamza221 mentioned this pull request May 29, 2024

Phishing detection #9453

Closed

17 tasks

st3iny requested changes Jun 3, 2024

View reviewed changes

st3iny previously requested changes Jun 3, 2024

View reviewed changes

lib/Service/PhishingDetection/PhishingDetectionService.php Show resolved Hide resolved

lib/Service/PhishingDetection/PhishingDetectionService.php Outdated Show resolved Hide resolved

hamza221 force-pushed the feat/phishing-detection branch 2 times, most recently from 815468d to 450ceaf Compare June 3, 2024 17:32

ChristophWurst reviewed Jun 4, 2024

View reviewed changes

lib/Service/PhishingDetection/PhishingDetectionService.php Outdated Show resolved Hide resolved

hamza221 added 3. to review and removed 2. developing labels Jun 6, 2024

ChristophWurst requested a review from st3iny June 13, 2024 12:50

ChristophWurst reviewed Jun 13, 2024

View reviewed changes

kesselb reviewed Jun 13, 2024

View reviewed changes

lib/PhishingDetectionList.php Outdated Show resolved Hide resolved

ChristophWurst approved these changes Jun 27, 2024

View reviewed changes

lib/IMAP/ImapMessageFetcher.php Outdated Show resolved Hide resolved

hamza221 force-pushed the feat/phishing-detection branch from 5756d51 to a12538d Compare June 27, 2024 09:16

ChristophWurst approved these changes Jun 27, 2024

View reviewed changes

hamza221 force-pushed the feat/phishing-detection branch from 648cf22 to 3690030 Compare June 27, 2024 15:39

Feat: phishing detection

9b87b23

Signed-off-by: Hamza Mahjoubi <[email protected]>

hamza221 force-pushed the feat/phishing-detection branch from 3690030 to 9b87b23 Compare June 27, 2024 18:46

hamza221 merged commit 5c86fe4 into main Jun 27, 2024
36 checks passed

hamza221 deleted the feat/phishing-detection branch June 27, 2024 19:10

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feat: phishing detection #9610

Feat: phishing detection #9610

hamza221 commented Apr 29, 2024 •

edited by ChristophWurst

Loading

ChristophWurst May 22, 2024

pabzm May 23, 2024

hamza221 May 24, 2024

hamza221 May 24, 2024

pabzm May 28, 2024

ChristophWurst May 22, 2024

pabzm May 23, 2024

pabzm May 23, 2024

pabzm May 23, 2024

kesselb commented May 28, 2024 •

edited

Loading

st3iny left a comment

ChristophWurst left a comment

ChristophWurst commented Jun 13, 2024

hamza221 commented Jun 13, 2024

ChristophWurst commented Jun 13, 2024

hamza221 commented Jun 27, 2024

ChristophWurst left a comment

ChristophWurst left a comment

Feat: phishing detection #9610

Feat: phishing detection #9610

Conversation

hamza221 commented Apr 29, 2024 • edited by ChristophWurst Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kesselb commented May 28, 2024 • edited Loading

st3iny left a comment

Choose a reason for hiding this comment

ChristophWurst left a comment

Choose a reason for hiding this comment

ChristophWurst commented Jun 13, 2024

hamza221 commented Jun 13, 2024

ChristophWurst commented Jun 13, 2024

hamza221 commented Jun 27, 2024

ChristophWurst left a comment

Choose a reason for hiding this comment

ChristophWurst left a comment

Choose a reason for hiding this comment

hamza221 commented Apr 29, 2024 •

edited by ChristophWurst

Loading

kesselb commented May 28, 2024 •

edited

Loading