PhishingPage Class Reference

#include <PhishingPage.hpp>

Inheritance diagram for PhishingPage:

Classes
struct	ParsedResult

Public Member Functions
	PhishingPage ()
virtual	~PhishingPage ()

Private Member Functions
void	on_analyze_requested (const Glib::ustring &url)

Static Private Member Functions
static std::string	url_encode (const std::string &s)
static std::string	fetch_url_body (const std::string &url)
static std::string	html_entity_decode (std::string s)
static std::string	strip_tags (const std::string &s)
static std::string	trim_copy (const std::string &s)
static std::optional< std::string >	extract_first (const std::string &text, const std::regex &re, int group=1)
static std::vector< std::string >	extract_all_li_after_label (const std::string &html, const std::string &label)
static ParsedResult	parse_result_html (const std::string &html)

Private Attributes
Gtk::Label	lbl_title_
PhishingCheckCard	phishing_card_
Gtk::ScrolledWindow	scroller_
Gtk::TextView	txt_output_
Gtk::Label	lbl_status_
std::atomic< bool >	destroyed_ {false}
BastionGuard::AliveFlag	alive_ = BastionGuard::make_alive_flag()

Detailed Description

Definition at line 29 of file PhishingPage.hpp.

Constructor & Destructor Documentation

PhishingPage()

PhishingPage::PhishingPage

(

)

Definition at line 33 of file PhishingPage.cpp.

    : Gtk::Box(Gtk::Orientation::VERTICAL, 14)
{
    add_css_class("phishing-page");
 
    set_margin_top(20);
    set_margin_bottom(20);
    set_margin_start(20);
    set_margin_end(20);
    set_vexpand(true);
    set_hexpand(true);
 
    lbl_title_.set_markup("<span weight='bold' size='x-large'>Phishing Scanner</span>");
    lbl_title_.set_halign(Gtk::Align::START);
    lbl_title_.set_xalign(0.0f);
    lbl_title_.add_css_class("page-title");
    lbl_title_.set_margin_bottom(8);
    append(lbl_title_);
 
    phishing_card_.set_margin_bottom(10);
    append(phishing_card_);
 
    phishing_card_.signal_analyze_requested().connect(
        sigc::mem_fun(*this, &PhishingPage::on_analyze_requested));
 
    scroller_.set_vexpand(true);
    scroller_.set_hexpand(true);
    scroller_.add_css_class("phishing-result-box");
 
    txt_output_.set_editable(false);
    txt_output_.set_cursor_visible(false);
    txt_output_.set_wrap_mode(Gtk::WrapMode::WORD_CHAR);
    txt_output_.set_monospace(false);
    txt_output_.add_css_class("phishing-result-text");
    txt_output_.get_buffer()->set_text(_("Ready."));
    scroller_.set_child(txt_output_);
    append(scroller_);
 
    lbl_status_.set_halign(Gtk::Align::START);
    lbl_status_.set_xalign(0.0f);
    lbl_status_.set_text(_("Ready."));
    lbl_status_.add_css_class("phishing-status");
    lbl_status_.set_margin_top(4);
    append(lbl_status_);
}

References _, lbl_status_, lbl_title_, on_analyze_requested(), phishing_card_, scroller_, PhishingCheckCard::signal_analyze_requested(), and txt_output_.

~PhishingPage()

PhishingPage::~PhishingPage ( )

virtual

Definition at line 79 of file PhishingPage.cpp.

                            {
    destroyed_ = true;
    if (alive_) alive_->store(false, std::memory_order_release);
}

References alive_, and destroyed_.

Member Function Documentation

extract_all_li_after_label()

std::vector< std::string > PhishingPage::extract_all_li_after_label ( const std::string & html, const std::string & label )

staticprivate

Definition at line 174 of file PhishingPage.cpp.

{
    std::vector<std::string> out;
 
    const std::string pattern =
        "<strong>\\s*" + label + R"(\s*:</strong>\s*<ul>([\s\S]*?)</ul>)";
 
    std::smatch m;
    if (!std::regex_search(html, m, std::regex(pattern, std::regex::icase)))
        return out;
 
    const std::string ul = m[1].str();
 
    std::regex li_re(R"(<li>([\s\S]*?)</li>)", std::regex::icase);
    auto begin = std::sregex_iterator(ul.begin(), ul.end(), li_re);
    auto end   = std::sregex_iterator();
 
    for (auto it = begin; it != end; ++it) {
        out.push_back(strip_tags((*it)[1].str()));
    }
 
    return out;
}

References strip_tags().

Referenced by parse_result_html().

extract_first()

std::optional< std::string > PhishingPage::extract_first ( const std::string & text, const std::regex & re, int group = 1 )

staticprivate

Definition at line 162 of file PhishingPage.cpp.

{
    std::smatch m;
    if (std::regex_search(text, m, re) && m.size() > static_cast<size_t>(group))
        return m[group].str();
 
    return std::nullopt;
}

Referenced by parse_result_html().

fetch_url_body()

std::string PhishingPage::fetch_url_body ( const std::string & url )

staticprivate

Definition at line 111 of file PhishingPage.cpp.

                                                           {
    try {
        auto proc = Gio::Subprocess::create(
            {
                "/usr/bin/curl",
                "-L",
                "--silent",
                "--show-error",
                "--fail",
                "--max-time", "20",
                url
            },
            Gio::Subprocess::Flags::STDOUT_PIPE | Gio::Subprocess::Flags::STDERR_PIPE
        );
 
        auto result = proc->communicate_utf8("");
 
        if (proc->get_successful())
            return result.first.raw();
    } catch (...) {
    }
 
    return {};
}

Referenced by on_analyze_requested().

html_entity_decode()

std::string PhishingPage::html_entity_decode ( std::string s )

staticprivate

Definition at line 136 of file PhishingPage.cpp.

                                                      {
    auto repl = [&](const std::string& from, const std::string& to) {
        std::size_t pos = 0;
        while ((pos = s.find(from, pos)) != std::string::npos) {
            s.replace(pos, from.size(), to);
            pos += to.size();
        }
    };
 
    repl("&", "&");
    repl("&lt;", "<");
    repl("&gt;", ">");
    repl("&quot;", "\"");
    repl("&#039;", "'");
    repl("&nbsp;", " ");
 
    return s;
}

Referenced by strip_tags().

on_analyze_requested()

void PhishingPage::on_analyze_requested ( const Glib::ustring & url )

private

Definition at line 293 of file PhishingPage.cpp.

                                                              {
    phishing_card_.set_feedback(_("Analysis started..."), false);
    lbl_status_.set_text(_("Analyzing URL..."));
    txt_output_.get_buffer()->set_text(_("Starting analysis for: ") + url + "\n");
 
    auto alive = alive_;
    std::thread([this, alive, url]() {
        const std::string endpoint =
            "https://bastionguard.eu/bastionguard-security-intelligence/?q=" +
            url_encode(url.raw());
 
        const std::string html = fetch_url_body(endpoint);
 
        if (!alive || !alive->load(std::memory_order_acquire))
            return;
 
        if (html.empty()) {
            Glib::signal_idle().connect_once([this, alive]() {
                BastionGuard::if_alive(alive, [this]() {
                    phishing_card_.set_feedback(
                        _("Unable to contact BastionGuard Security Intelligence."), true);
                    lbl_status_.set_text(_("Remote analysis failed."));
                    txt_output_.get_buffer()->set_text(
                        _("The remote BastionGuard Security Intelligence page did not return valid HTML."));
                });
            });
            return;
        }
 
        ParsedResult result = parse_result_html(html);
 
        Glib::signal_idle().connect_once([this, alive, result]() {
            BastionGuard::if_alive(alive, [this, &result]() {
                if (result.classification.empty()) {
                    phishing_card_.set_feedback(
                        _("Unexpected response format from remote analyzer."), true);
                    lbl_status_.set_text(_("Parsing failed."));
                    txt_output_.get_buffer()->set_text(
                        _("The remote page responded, but no classification block was found."));
                    return;
                }
 
                txt_output_.get_buffer()->set_text(result.report_text);
 
                if (result.classification.find("MALICIOUS") != Glib::ustring::npos) {
                    lbl_status_.set_text(_("Malicious result detected."));
                    phishing_card_.set_feedback(_("Malicious result detected."), true);
                } else if (result.classification.find("SUSPICIOUS") != Glib::ustring::npos) {
                    lbl_status_.set_text(_("Suspicious result detected."));
                    phishing_card_.set_feedback(_("Suspicious result detected."), true);
                } else {
                    lbl_status_.set_text(_("Analysis complete."));
                    phishing_card_.set_feedback(_("Analysis complete."), false);
                }
            });
        });
    }).detach();
}

References _, alive_, PhishingPage::ParsedResult::classification, fetch_url_body(), BastionGuard::if_alive(), lbl_status_, parse_result_html(), phishing_card_, PhishingPage::ParsedResult::report_text, PhishingCheckCard::set_feedback(), txt_output_, and url_encode().

Referenced by PhishingPage().

parse_result_html()

PhishingPage::ParsedResult PhishingPage::parse_result_html ( const std::string & html )

staticprivate

Definition at line 200 of file PhishingPage.cpp.

                                                                              {
    ParsedResult r;
 
    if (auto v = extract_first(
            html,
            std::regex(
                R"(<span class="phishing-badge [^"]*">CLASSIFICATION</span>\s*([^<]+))",
                std::regex::icase)); v) {
        r.classification = trim_copy(strip_tags(*v));
    }
 
    if (auto v = extract_first(
            html,
            std::regex(
                R"(<div class="phishing-sev-level">([^<]+)</div>)",
                std::regex::icase)); v) {
        r.severity = trim_copy(strip_tags(*v));
    }
 
    if (auto v = extract_first(
            html,
            std::regex(
                R"(<strong>\s*Normalized Host:\s*</strong>\s*<code class="phishing-code">([^<]+)</code>)",
                std::regex::icase)); v) {
        r.normalized_host = trim_copy(strip_tags(*v));
    }
 
    if (auto v = extract_first(
            html,
            std::regex(
                R"(<strong>\s*Evaluation Chain:\s*</strong>\s*<code class="phishing-code">([^<]+)</code>)",
                std::regex::icase)); v) {
        r.evaluation_chain = trim_copy(strip_tags(*v));
    }
 
    if (auto v = extract_first(
            html,
            std::regex(
                R"(<strong>\s*Matched Indicator:\s*</strong>\s*<code class="phishing-code">([^<]+)</code>)",
                std::regex::icase)); v) {
        r.matched_indicator = trim_copy(strip_tags(*v));
    }
 
    if (auto v = extract_first(
            html,
            std::regex(
                R"(<strong>\s*Link Status \‍(Live Probe\):\s*</strong>\s*<span class="phishing-badge [^"]*">\s*([^<]+)\s*</span>)",
                std::regex::icase)); v) {
        r.live_probe_status = trim_copy(strip_tags(*v));
    }
 
    if (auto v = extract_first(
            html,
            std::regex(
                R"(<div style="margin-top:\.4rem; color:#475569;">\s*([\s\S]*?)\s*</div>)",
                std::regex::icase)); v) {
        r.live_probe_text = trim_copy(strip_tags(*v));
    }
 
    const auto details = extract_all_li_after_label(html, "Analysis Details");
    std::ostringstream oss;
 
    oss << "Classification: "
        << (r.classification.empty() ? "N/A" : r.classification.raw()) << "\n";
 
    if (!r.severity.empty())
        oss << "Severity: " << r.severity << "\n";
 
    if (!r.normalized_host.empty())
        oss << "Normalized Host: " << r.normalized_host << "\n";
 
    if (!r.evaluation_chain.empty())
        oss << "Evaluation Chain: " << r.evaluation_chain << "\n";
 
    if (!r.matched_indicator.empty())
        oss << "Matched Indicator: " << r.matched_indicator << "\n";
 
    if (!r.live_probe_status.empty())
        oss << "Live Probe: " << r.live_probe_status << "\n";
 
    if (!r.live_probe_text.empty())
        oss << "Live Probe Details: " << r.live_probe_text << "\n";
 
    if (!details.empty()) {
        oss << "\nAnalysis Details:\n";
        for (const auto& d : details)
            oss << " - " << d << "\n";
    }
 
    r.report_text = oss.str();
    return r;
}

References extract_all_li_after_label(), extract_first(), strip_tags(), and trim_copy().

Referenced by on_analyze_requested().

strip_tags()

std::string PhishingPage::strip_tags ( const std::string & s )

staticprivate

Definition at line 155 of file PhishingPage.cpp.

                                                     {
    std::string out = std::regex_replace(s, std::regex("<[^>]*>"), " ");
    out = html_entity_decode(out);
    out = std::regex_replace(out, std::regex(R"(\s+)"), " ");
    return trim_copy(out);
}

References html_entity_decode(), and trim_copy().

Referenced by extract_all_li_after_label(), and parse_result_html().

trim_copy()

std::string PhishingPage::trim_copy ( const std::string & s )

staticprivate

Definition at line 84 of file PhishingPage.cpp.

                                                    {
    const auto begin = s.find_first_not_of(" \t\r\n");
    if (begin == std::string::npos)
        return {};
 
    const auto end = s.find_last_not_of(" \t\r\n");
    return s.substr(begin, end - begin + 1);
}

Referenced by parse_result_html(), and strip_tags().

url_encode()

std::string PhishingPage::url_encode ( const std::string & s )

staticprivate

Definition at line 93 of file PhishingPage.cpp.

                                                     {
    std::ostringstream oss;
    oss << std::hex << std::uppercase;
 
    for (unsigned char c : s) {
        if ((c >= 'A' && c <= 'Z') ||
            (c >= 'a' && c <= 'z') ||
            (c >= '0' && c <= '9') ||
            c == '-' || c == '_' || c == '.' || c == '~') {
            oss << c;
        } else {
            oss << '%' << std::setw(2) << std::setfill('0') << static_cast<int>(c);
        }
    }
 
    return oss.str();
}

Referenced by on_analyze_requested().

Member Data Documentation

alive_

BastionGuard::AliveFlag PhishingPage::alive_ = BastionGuard::make_alive_flag()

private

Definition at line 75 of file PhishingPage.hpp.

Referenced by on_analyze_requested(), and ~PhishingPage().

destroyed_

std::atomic<bool> PhishingPage::destroyed_ {false}

private

Definition at line 68 of file PhishingPage.hpp.

Referenced by ~PhishingPage().

lbl_status_

Gtk::Label PhishingPage::lbl_status_

private

Definition at line 66 of file PhishingPage.hpp.

Referenced by on_analyze_requested(), and PhishingPage().

lbl_title_

Gtk::Label PhishingPage::lbl_title_

private

Definition at line 62 of file PhishingPage.hpp.

Referenced by PhishingPage().

phishing_card_

PhishingCheckCard PhishingPage::phishing_card_

private

Definition at line 63 of file PhishingPage.hpp.

Referenced by on_analyze_requested(), and PhishingPage().

scroller_

Gtk::ScrolledWindow PhishingPage::scroller_

private

Definition at line 64 of file PhishingPage.hpp.

Referenced by PhishingPage().

txt_output_

Gtk::TextView PhishingPage::txt_output_

private

Definition at line 65 of file PhishingPage.hpp.

Referenced by on_analyze_requested(), and PhishingPage().

---

The documentation for this class was generated from the following files:

• BastionGuard/src/phishing_search/PhishingPage.hpp
• BastionGuard/src/phishing_search/PhishingPage.cpp