diff --git a/bskylink/package.json b/bskylink/package.json
index 21fe123aba..e254806657 100644
--- a/bskylink/package.json
+++ b/bskylink/package.json
@@ -18,6 +18,7 @@
"kysely": "^0.27.3",
"pg": "^8.12.0",
"pino": "^9.2.0",
+ "uhtml": "^4.7.1",
"uint8arrays": "^5.1.0"
},
"devDependencies": {
diff --git a/bskylink/src/html/linkRedirectContents.ts b/bskylink/src/html/linkRedirectContents.ts
new file mode 100644
index 0000000000..a3d31de50e
--- /dev/null
+++ b/bskylink/src/html/linkRedirectContents.ts
@@ -0,0 +1,21 @@
+import {type Hole, html} from 'uhtml'
+
+export function linkRedirectContents(link: string): Hole {
+ return html`
+
+
+ ⚠️
+
+ ${opts.type === 'warn' ? 'Potentially Dangerous Link' : 'Blocked Link'}
+
+
+ ${opts.type === 'warn'
+ ? 'This link may be malicious. You should proceed at your own risk.'
+ : 'This link has been identified as malicious and has blocked for your safety.'}
+
+
+
+ `
+}
diff --git a/bskylink/src/html/linkWarningLayout.ts b/bskylink/src/html/linkWarningLayout.ts
new file mode 100644
index 0000000000..cc5c4d4ac9
--- /dev/null
+++ b/bskylink/src/html/linkWarningLayout.ts
@@ -0,0 +1,133 @@
+import {type Hole, html} from 'uhtml'
+
+export function linkWarningLayout(
+ title: string,
+ containerContents: Hole,
+): Hole {
+ return html`
+
+
+
+ ${title}
+
+
+
+ ${containerContents}
+
+
+ `
+}
diff --git a/bskylink/src/routes/redirect.ts b/bskylink/src/routes/redirect.ts
index 436e87400a..b238e105d5 100644
--- a/bskylink/src/routes/redirect.ts
+++ b/bskylink/src/routes/redirect.ts
@@ -2,10 +2,13 @@ import assert from 'node:assert'
import {ToolsOzoneSafelinkDefs} from '@atproto/api'
import {DAY, SECOND} from '@atproto/common'
-import escapeHTML from 'escape-html'
import {type Express} from 'express'
+import {type Hole} from 'uhtml'
import {type AppContext} from '../context.js'
+import {linkRedirectContents} from '../html/linkRedirectContents.js'
+import {linkWarningContents} from '../html/linkWarningContents.js'
+import {linkWarningLayout} from '../html/linkWarningLayout.js'
import {redirectLogger} from '../logger.js'
import {handler} from './util.js'
@@ -41,247 +44,65 @@ export default function (ctx: AppContext, app: Express) {
return res.status(302).end()
}
+ // Default to a max age header
res.setHeader('Cache-Control', `max-age=${(7 * DAY) / SECOND}`)
- res.type('html')
res.status(200)
+ res.type('html')
+
+ let hole: Hole | undefined
if (ctx.cfg.service.safelinkEnabled) {
const rulePresent: ToolsOzoneSafelinkDefs.Event | undefined =
ctx.cfg.eventCache.smartGet(link)
- // begin link safety checks
- if (
- rulePresent &&
- rulePresent.eventType === ToolsOzoneSafelinkDefs.REMOVERULE
- ) {
- redirectLogger.info(
- `No rule or Remove rule matched for ${rulePresent.url}`,
- )
- const escaped = escapeHTML(url.href)
- const html = safe_redirect(escaped)
- res.writeHead(200, {
- 'Content-Type': 'text/html',
- 'Content-Length': Buffer.byteLength(html),
- })
- res.end(html) // Critical - must call end()
- return
- }
-
- if (
- rulePresent &&
- rulePresent.action === ToolsOzoneSafelinkDefs.WHITELIST
- ) {
- redirectLogger.info(`Whitelist rule matched for ${rulePresent.url}`)
- const escaped = escapeHTML(url.href)
- const html = safe_redirect(escaped)
- res.writeHead(200, {
- 'Content-Type': 'text/html',
- 'Content-Length': Buffer.byteLength(html),
- })
- res.end(html) // Critical - must call end()
- return
- }
-
- if (
- rulePresent &&
- rulePresent.action === ToolsOzoneSafelinkDefs.BLOCK
- ) {
- redirectLogger.info(`Block rule matched for ${rulePresent.url}`)
- res.setHeader('Cache-Control', 'no-store')
- const html = warnRedirect(
- 'Blocked Link',
- 'This link has been identified as malicious, it has been blocked to protect your account and data',
- 'Go Back To BlueSky',
- 'DANGER',
- escapeHTML(url.toString()),
- `https://${ctx.cfg.service.appHostname}`,
- )
- res.writeHead(200, {
- 'Content-Type': 'text/html',
- 'Content-Length': Buffer.byteLength(html),
- })
- res.end(html) // Critical - must call end()
- return
- }
-
- if (rulePresent && rulePresent.action === ToolsOzoneSafelinkDefs.WARN) {
- redirectLogger.info(`Warn rule matched for ${rulePresent.url}`)
- res.setHeader('Cache-Control', 'no-store')
- const html = warnRedirect(
- 'Warning: Malicious Link',
- 'This link has been identified as malicious, continue at your own risk',
- 'continue at your own risk',
- 'DANGER',
- escapeHTML(url.toString()),
- `https://${ctx.cfg.service.appHostname}`,
- )
- res.writeHead(200, {
- 'Content-Type': 'text/html',
- 'Content-Length': Buffer.byteLength(html),
- })
- res.end(html) // Critical - must call end()
- return
+ if (rulePresent) {
+ switch (rulePresent.action) {
+ case ToolsOzoneSafelinkDefs.BLOCK:
+ hole = linkWarningLayout(
+ 'Blocked Link Warning',
+ linkWarningContents({
+ type: 'block',
+ link: url.href,
+ }),
+ )
+ res.setHeader('Cache-Control', 'no-store')
+ redirectLogger.info(`Block rule matched for ${rulePresent.url}`)
+ break
+ case ToolsOzoneSafelinkDefs.WARN:
+ hole = linkWarningLayout(
+ 'Malicious Link Warning',
+ linkWarningContents({
+ type: 'warn',
+ link: url.href,
+ }),
+ )
+ res.setHeader('Cache-Control', 'no-store')
+ redirectLogger.info(`Warn rule matched for ${rulePresent.url}`)
+ break
+ case ToolsOzoneSafelinkDefs.WHITELIST:
+ redirectLogger.info(
+ `Whitelist rule matched for ${rulePresent.url}`,
+ )
+ break
+ case ToolsOzoneSafelinkDefs.REMOVERULE:
+ redirectLogger.info(`Remove rule matched for ${rulePresent.url}`)
+ break
+ default:
+ redirectLogger.warn(
+ `${rulePresent.action} rule (an unknown rule) matched for ${rulePresent.url}`,
+ )
+ }
+ } else {
+ redirectLogger.info(`No rule present for ${rulePresent.url}`)
}
}
- const escaped = escapeHTML(url.href)
- const html = safe_redirect(escaped)
- res.writeHead(200, {
- 'Content-Type': 'text/html',
- 'Content-Length': Buffer.byteLength(html),
- })
- res.end(html) // Critical - must call end()
- return
+ // If there is no hole defined yet, we will create a redirect hole
+ if (!hole) {
+ hole = linkRedirectContents(url.href)
+ }
+
+ return res.end(String(hole))
}),
)
}
-
-const safe_redirect = (escaped: string) =>
- `
- ${mainText}
-
-
-
-
-
⚠️
-
${mainText}
-
${escapeHTML(warningText)}
-
- ${escapeHTML(reason)}
- ${escapeHTML(siteUrl)}
-
-
${escapeHTML(
- buttonText,
- )}
-