29Eyl
User friendly yet secure policy for using imported URLs
Real case: I am writing dictionary program and part of the data are URLs. When I set them myself, life is simple, because it is me, so I know what I do. But when I import dictionary data from somebody else those URLs put in the data are risk factor (URLs are part of the data, and in this case serve as references in sense "cat in English = kot in Polish, to learn more see this website").
So I am looking for a policy which balances security on one hand, and user friendliness on the other hand (consider importing 100,100 URLs and going one after another manually and tick whether they are trusted/verified or not).
Currently I came to such approach:
- at start, at my computer, I can define trusted domains, like wikipedia, wiktionary, Cambridge Dictionary, etc.
- then I import the dictionary my uncle Joe prepared (and imported from other sources),
- all URLs in the imported dictionary are compared to trusted domains I defined at start -- if the domain matches, I set entire URL as trusted, if not -- it is not trusted,
- for all not trusted URLs I will scan them through URL scanner, if the URL is legit, I set it as trusted, if not mark them as threat,
- then when presenting web page using given URL -- if the URL is trusted I display regular (clickable) link, if not not trusted, the URL can be viewed, copied and pasted, but it would be not possible to click on it (it would be inactive/disabled link), for the known threat -- I am thinking (it has to be in some kind viewable to search for it and report this),
- and if at some point later I check manually the URL is fine, I can tick it or I can add entire domain to trusted ones, so this would set trusted for a bunch of URLs as described above.
Do I miss some vector attack here, or this policy is sound for both sides?
