PhishingPage.cpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * BastionGuard™ is a trademark of Calogero Scarnà.
 * The BastionGuard™ name and branding are not licensed under the GPL.
 */
 
#include "PhishingPage.hpp"
 
#include <glibmm/i18n.h>
#include <glibmm/main.h>
#include <giomm.h>
 
#include <regex>
#include <sstream>
#include <iomanip>
#include <thread>
#include <chrono>
 
PhishingPage::PhishingPage()
    : Gtk::Box(Gtk::Orientation::VERTICAL, 14)
{
    add_css_class("phishing-page");
 
    set_margin_top(20);
    set_margin_bottom(20);
    set_margin_start(20);
    set_margin_end(20);
    set_vexpand(true);
    set_hexpand(true);
 
    lbl_title_.set_markup("<span weight='bold' size='x-large'>Phishing Scanner</span>");
    lbl_title_.set_halign(Gtk::Align::START);
    lbl_title_.set_xalign(0.0f);
    lbl_title_.add_css_class("page-title");
    lbl_title_.set_margin_bottom(8);
    append(lbl_title_);
 
    phishing_card_.set_margin_bottom(10);
    append(phishing_card_);
 
    phishing_card_.signal_analyze_requested().connect(
        sigc::mem_fun(*this, &PhishingPage::on_analyze_requested));
 
    scroller_.set_vexpand(true);
    scroller_.set_hexpand(true);
    scroller_.add_css_class("phishing-result-box");
 
    txt_output_.set_editable(false);
    txt_output_.set_cursor_visible(false);
    txt_output_.set_wrap_mode(Gtk::WrapMode::WORD_CHAR);
    txt_output_.set_monospace(false);
    txt_output_.add_css_class("phishing-result-text");
    txt_output_.get_buffer()->set_text(_("Ready."));
    scroller_.set_child(txt_output_);
    append(scroller_);
 
    lbl_status_.set_halign(Gtk::Align::START);
    lbl_status_.set_xalign(0.0f);
    lbl_status_.set_text(_("Ready."));
    lbl_status_.add_css_class("phishing-status");
    lbl_status_.set_margin_top(4);
    append(lbl_status_);
}
 
PhishingPage::~PhishingPage() {
    destroyed_ = true;
    if (alive_) alive_->store(false, std::memory_order_release);
}
 
std::string PhishingPage::trim_copy(const std::string& s) {
    const auto begin = s.find_first_not_of(" \t\r\n");
    if (begin == std::string::npos)
        return {};
 
    const auto end = s.find_last_not_of(" \t\r\n");
    return s.substr(begin, end - begin + 1);
}
 
std::string PhishingPage::url_encode(const std::string& s) {
    std::ostringstream oss;
    oss << std::hex << std::uppercase;
 
    for (unsigned char c : s) {
        if ((c >= 'A' && c <= 'Z') ||
            (c >= 'a' && c <= 'z') ||
            (c >= '0' && c <= '9') ||
            c == '-' || c == '_' || c == '.' || c == '~') {
            oss << c;
        } else {
            oss << '%' << std::setw(2) << std::setfill('0') << static_cast<int>(c);
        }
    }
 
    return oss.str();
}
 
std::string PhishingPage::fetch_url_body(const std::string& url) {
    try {
        auto proc = Gio::Subprocess::create(
            {
                "/usr/bin/curl",
                "-L",
                "--silent",
                "--show-error",
                "--fail",
                "--max-time", "20",
                url
            },
            Gio::Subprocess::Flags::STDOUT_PIPE | Gio::Subprocess::Flags::STDERR_PIPE
        );
 
        auto result = proc->communicate_utf8("");
 
        if (proc->get_successful())
            return result.first.raw();
    } catch (...) {
    }
 
    return {};
}
 
std::string PhishingPage::html_entity_decode(std::string s) {
    auto repl = [&](const std::string& from, const std::string& to) {
        std::size_t pos = 0;
        while ((pos = s.find(from, pos)) != std::string::npos) {
            s.replace(pos, from.size(), to);
            pos += to.size();
        }
    };
 
    repl("&amp;", "&");
    repl("&lt;", "<");
    repl("&gt;", ">");
    repl("&quot;", "\"");
    repl("&#039;", "'");
    repl("&nbsp;", " ");
 
    return s;
}
 
std::string PhishingPage::strip_tags(const std::string& s) {
    std::string out = std::regex_replace(s, std::regex("<[^>]*>"), " ");
    out = html_entity_decode(out);
    out = std::regex_replace(out, std::regex(R"(\s+)"), " ");
    return trim_copy(out);
}
 
std::optional<std::string> PhishingPage::extract_first(
    const std::string& text,
    const std::regex& re,
    int group)
{
    std::smatch m;
    if (std::regex_search(text, m, re) && m.size() > static_cast<size_t>(group))
        return m[group].str();
 
    return std::nullopt;
}
 
std::vector<std::string> PhishingPage::extract_all_li_after_label(
    const std::string& html,
    const std::string& label)
{
    std::vector<std::string> out;
 
    const std::string pattern =
        "<strong>\\s*" + label + R"(\s*:</strong>\s*<ul>([\s\S]*?)</ul>)";
 
    std::smatch m;
    if (!std::regex_search(html, m, std::regex(pattern, std::regex::icase)))
        return out;
 
    const std::string ul = m[1].str();
 
    std::regex li_re(R"(<li>([\s\S]*?)</li>)", std::regex::icase);
    auto begin = std::sregex_iterator(ul.begin(), ul.end(), li_re);
    auto end   = std::sregex_iterator();
 
    for (auto it = begin; it != end; ++it) {
        out.push_back(strip_tags((*it)[1].str()));
    }
 
    return out;
}
 
PhishingPage::ParsedResult PhishingPage::parse_result_html(const std::string& html) {
    ParsedResult r;
 
    if (auto v = extract_first(
            html,
            std::regex(
                R"(<span class="phishing-badge [^"]*">CLASSIFICATION</span>\s*([^<]+))",
                std::regex::icase)); v) {
        r.classification = trim_copy(strip_tags(*v));
    }
 
    if (auto v = extract_first(
            html,
            std::regex(
                R"(<div class="phishing-sev-level">([^<]+)</div>)",
                std::regex::icase)); v) {
        r.severity = trim_copy(strip_tags(*v));
    }
 
    if (auto v = extract_first(
            html,
            std::regex(
                R"(<strong>\s*Normalized Host:\s*</strong>\s*<code class="phishing-code">([^<]+)</code>)",
                std::regex::icase)); v) {
        r.normalized_host = trim_copy(strip_tags(*v));
    }
 
    if (auto v = extract_first(
            html,
            std::regex(
                R"(<strong>\s*Evaluation Chain:\s*</strong>\s*<code class="phishing-code">([^<]+)</code>)",
                std::regex::icase)); v) {
        r.evaluation_chain = trim_copy(strip_tags(*v));
    }
 
    if (auto v = extract_first(
            html,
            std::regex(
                R"(<strong>\s*Matched Indicator:\s*</strong>\s*<code class="phishing-code">([^<]+)</code>)",
                std::regex::icase)); v) {
        r.matched_indicator = trim_copy(strip_tags(*v));
    }
 
    if (auto v = extract_first(
            html,
            std::regex(
                R"(<strong>\s*Link Status \‍(Live Probe\):\s*</strong>\s*<span class="phishing-badge [^"]*">\s*([^<]+)\s*</span>)",
                std::regex::icase)); v) {
        r.live_probe_status = trim_copy(strip_tags(*v));
    }
 
    if (auto v = extract_first(
            html,
            std::regex(
                R"(<div style="margin-top:\.4rem; color:#475569;">\s*([\s\S]*?)\s*</div>)",
                std::regex::icase)); v) {
        r.live_probe_text = trim_copy(strip_tags(*v));
    }
 
    const auto details = extract_all_li_after_label(html, "Analysis Details");
    std::ostringstream oss;
 
    oss << "Classification: "
        << (r.classification.empty() ? "N/A" : r.classification.raw()) << "\n";
 
    if (!r.severity.empty())
        oss << "Severity: " << r.severity << "\n";
 
    if (!r.normalized_host.empty())
        oss << "Normalized Host: " << r.normalized_host << "\n";
 
    if (!r.evaluation_chain.empty())
        oss << "Evaluation Chain: " << r.evaluation_chain << "\n";
 
    if (!r.matched_indicator.empty())
        oss << "Matched Indicator: " << r.matched_indicator << "\n";
 
    if (!r.live_probe_status.empty())
        oss << "Live Probe: " << r.live_probe_status << "\n";
 
    if (!r.live_probe_text.empty())
        oss << "Live Probe Details: " << r.live_probe_text << "\n";
 
    if (!details.empty()) {
        oss << "\nAnalysis Details:\n";
        for (const auto& d : details)
            oss << " - " << d << "\n";
    }
 
    r.report_text = oss.str();
    return r;
}
 
void PhishingPage::on_analyze_requested(const Glib::ustring& url) {
    phishing_card_.set_feedback(_("Analysis started..."), false);
    lbl_status_.set_text(_("Analyzing URL..."));
    txt_output_.get_buffer()->set_text(_("Starting analysis for: ") + url + "\n");
 
    auto alive = alive_;
    std::thread([this, alive, url]() {
        const std::string endpoint =
            "https://bastionguard.eu/bastionguard-security-intelligence/?q=" +
            url_encode(url.raw());
 
        const std::string html = fetch_url_body(endpoint);
 
        if (!alive || !alive->load(std::memory_order_acquire))
            return;
 
        if (html.empty()) {
            Glib::signal_idle().connect_once([this, alive]() {
                BastionGuard::if_alive(alive, [this]() {
                    phishing_card_.set_feedback(
                        _("Unable to contact BastionGuard Security Intelligence."), true);
                    lbl_status_.set_text(_("Remote analysis failed."));
                    txt_output_.get_buffer()->set_text(
                        _("The remote BastionGuard Security Intelligence page did not return valid HTML."));
                });
            });
            return;
        }
 
        ParsedResult result = parse_result_html(html);
 
        Glib::signal_idle().connect_once([this, alive, result]() {
            BastionGuard::if_alive(alive, [this, &result]() {
                if (result.classification.empty()) {
                    phishing_card_.set_feedback(
                        _("Unexpected response format from remote analyzer."), true);
                    lbl_status_.set_text(_("Parsing failed."));
                    txt_output_.get_buffer()->set_text(
                        _("The remote page responded, but no classification block was found."));
                    return;
                }
 
                txt_output_.get_buffer()->set_text(result.report_text);
 
                if (result.classification.find("MALICIOUS") != Glib::ustring::npos) {
                    lbl_status_.set_text(_("Malicious result detected."));
                    phishing_card_.set_feedback(_("Malicious result detected."), true);
                } else if (result.classification.find("SUSPICIOUS") != Glib::ustring::npos) {
                    lbl_status_.set_text(_("Suspicious result detected."));
                    phishing_card_.set_feedback(_("Suspicious result detected."), true);
                } else {
                    lbl_status_.set_text(_("Analysis complete."));
                    phishing_card_.set_feedback(_("Analysis complete."), false);
                }
            });
        });
    }).detach();
}