Add Verified URLs

hushline/model.py

@@ -61,6 +61,10 @@ class User(Model):
     extra_field_value3: Mapped[Optional[str]]
     extra_field_label4: Mapped[Optional[str]]
     extra_field_value4: Mapped[Optional[str]]
+    extra_field_verified1 = db.Column(db.Boolean, default=False)
+    extra_field_verified2 = db.Column(db.Boolean, default=False)
+    extra_field_verified3 = db.Column(db.Boolean, default=False)
+    extra_field_verified4 = db.Column(db.Boolean, default=False)
 
     @property
     def password_hash(self) -> str:

hushline/routes.py

@@ -124,6 +124,30 @@ def profile(username: str) -> Response | str:
         math_problem = f"{num1} + {num2} ="
         session["math_answer"] = str(num1 + num2)  # Store the answer in session as a string
 
+        # Prepare extra fields and verification status
+        extra_fields = [
+            {
+                "label": user.extra_field_label1,
+                "value": user.extra_field_value1,
+                "verified": user.extra_field_verified1,
+            },
+            {
+                "label": user.extra_field_label2,
+                "value": user.extra_field_value2,
+                "verified": user.extra_field_verified2,
+            },
+            {
+                "label": user.extra_field_label3,
+                "value": user.extra_field_value3,
+                "verified": user.extra_field_verified3,
+            },
+            {
+                "label": user.extra_field_label4,
+                "value": user.extra_field_value4,
+                "verified": user.extra_field_verified4,
+            },
+        ]
+
         return render_template(
             "profile.html",
             form=form,
@@ -135,6 +159,7 @@ def profile(username: str) -> Response | str:
             is_personal_server=app.config["IS_PERSONAL_SERVER"],
             require_pgp=app.config["REQUIRE_PGP"],
             math_problem=math_problem,
+            extra_fields=extra_fields,  # Pass extra fields to template
         )
 
     @app.route("/to/<username>", methods=["POST"])

hushline/settings.py

@@ -3,6 +3,7 @@
 import re
 from datetime import UTC, datetime
 from typing import Optional
+from urllib.parse import urlparse
 
 import pyotp
 import qrcode
@@ -194,6 +195,26 @@
         unset_field_attribute(input_field, "disabled")
 
 
+def is_safe_url(url: str) -> bool:
+    """Validates if the provided URL is safe and within the expected domains."""
+    parsed_url = urlparse(url)
+
+    # Only allow http and https schemes
+    if parsed_url.scheme not in ["http", "https"]:
+        return False
+
+    # Allow only specific domains
+    allowed_domains = ["hushline.app"]
+    if parsed_url.netloc not in allowed_domains:
+        return False
+
+    # Optionally, restrict the URL path if necessary
+    if not re.match(r"^/user/[a-zA-Z0-9_-]+/?$", parsed_url.path):
+        return False
+
+    return True
+
+
 def create_blueprint() -> Blueprint:
     bp = Blueprint("settings", __file__, url_prefix="/settings")
 
@@ -224,57 +245,55 @@
         directory_visibility_form = DirectoryVisibilityForm()
         profile_form = ProfileForm()
 
-        # Check if the bio update form was submitted
-        if (
-            request.method == "POST"
-            and "update_bio" in request.form
-            and profile_form.validate_on_submit()
-        ):
-            user.bio = request.form["bio"]
-            user.extra_field_label1 = profile_form.extra_field_label1.data.strip()
-            user.extra_field_value1 = profile_form.extra_field_value1.data.strip()
-            user.extra_field_label2 = profile_form.extra_field_label2.data.strip()
-            user.extra_field_value2 = profile_form.extra_field_value2.data.strip()
-            user.extra_field_label3 = profile_form.extra_field_label3.data.strip()
-            user.extra_field_value3 = profile_form.extra_field_value3.data.strip()
-            user.extra_field_label4 = profile_form.extra_field_label4.data.strip()
-            user.extra_field_value4 = profile_form.extra_field_value4.data.strip()
-            db.session.commit()
-            flash("👍 Bio updated successfully.")
-            return redirect(url_for("settings.index"))
+        # Handle form submissions
+        if request.method == "POST":
+            # Update bio and custom fields
+            if "update_bio" in request.form and profile_form.validate_on_submit():
+                user.bio = request.form["bio"].strip()
+                user.extra_field_label1 = profile_form.extra_field_label1.data.strip()
+                user.extra_field_value1 = profile_form.extra_field_value1.data.strip()
+                user.extra_field_label2 = profile_form.extra_field_label2.data.strip()
+                user.extra_field_value2 = profile_form.extra_field_value2.data.strip()
+                user.extra_field_label3 = profile_form.extra_field_label3.data.strip()
+                user.extra_field_value3 = profile_form.extra_field_value3.data.strip()
+                user.extra_field_label4 = profile_form.extra_field_label4.data.strip()
+                user.extra_field_value4 = profile_form.extra_field_value4.data.strip()
+
+                # Trigger the rel=me verification for each URL field
+                for i in range(1, 5):
+                    url_to_verify = getattr(user, f"extra_field_value{i}", "").strip()
+                    if url_to_verify:
+                        try:
+                            response = requests.get(url_to_verify, timeout=5)
+                            response.raise_for_status()
+                            profile_url = f"https://tips.hushline.app/to/{user.primary_username}"
+                            if re.search(
+                                rf'<a[^>]+href="{re.escape(profile_url)}"[^>]*rel="me"[^>]*>',
+                                response.text,
+                            ):
+                                setattr(user, f"extra_field_verified{i}", True)
+                            else:
+                                setattr(user, f"extra_field_verified{i}", False)
+                        except requests.exceptions.RequestException as e:
+                            current_app.logger.error(f"Error fetching URL for field {i}: {e}")
+                            setattr(user, f"extra_field_verified{i}", False)
 
-        if request.method == "POST" and (
-            directory_visibility_form.validate_on_submit()
-            and "update_directory_visibility" in request.form
-        ):
-            user.show_in_directory = directory_visibility_form.show_in_directory.data
-            db.session.commit()
-            flash("👍 Directory visibility updated successfully.")
-            return redirect(url_for("settings.index"))
+                db.session.commit()
 
-        # Additional admin-specific data initialization
-        user_count = two_fa_count = pgp_key_count = two_fa_percentage = pgp_key_percentage = None
-        all_users = []
+                # Display flash message after successful update
+                flash("👍 Bio and fields updated successfully.")
+                return redirect(url_for("settings.index"))
 
-        # Check if user is admin and add admin-specific data
-        if user.is_admin:
-            user_count = db.session.scalar(db.func.count(User.id))
-            two_fa_count = db.session.scalar(
-                db.select(db.func.count(User.id).filter(User._totp_secret.isnot(None)))
-            )
-            pgp_key_count = db.session.scalar(
-                db.select(
-                    db.func.count(User.id)
-                    .filter(User._pgp_key.isnot(None))
-                    .filter(User._pgp_key != "")
-                )
-            )
-            two_fa_percentage = (two_fa_count / user_count * 100) if user_count else 0
-            pgp_key_percentage = (pgp_key_count / user_count * 100) if user_count else 0
-            all_users = list(db.session.scalars(db.select(User)).all())  # Fetch all users for admin
+            # Update directory visibility
+            if (
+                "update_directory_visibility" in request.form
+                and directory_visibility_form.validate_on_submit()
+            ):
+                user.show_in_directory = directory_visibility_form.show_in_directory.data
+                db.session.commit()
+                flash("👍 Directory visibility updated successfully.")
+                return redirect(url_for("settings.index"))
 
-        # Handle form submissions
-        if request.method == "POST":
             # Handle Display Name Form Submission
             if "update_display_name" in request.form and display_name_form.validate_on_submit():
                 user.update_display_name(display_name_form.display_name.data.strip())
@@ -305,26 +324,26 @@
                     )
                 return redirect(url_for(".index"))
 
-            # Check if user is admin and add admin-specific data
-            is_admin = user.is_admin
-            if is_admin:
-                user_count = db.session.scalar(db.func.count(User.id))
-                two_fa_count = db.session.scalar(
-                    db.select(db.func.count(User.id).filter(User._totp_secret.isnot(None)))
-                )
-                pgp_key_count = db.session.scalar(
-                    db.select(
-                        db.func.count(User.id)
-                        .filter(User._pgp_key.isnot(None))
-                        .filter(User._pgp_key != "")
-                    )
+        # Additional admin-specific data initialization
+        user_count = two_fa_count = pgp_key_count = two_fa_percentage = pgp_key_percentage = None
+        all_users = []
+
+        # Check if user is admin and add admin-specific data
+        if user.is_admin:
+            user_count = db.session.scalar(db.func.count(User.id))
+            two_fa_count = db.session.scalar(
+                db.select(db.func.count(User.id).filter(User._totp_secret.isnot(None)))
+            )
+            pgp_key_count = db.session.scalar(
+                db.select(
+                    db.func.count(User.id)
+                    .filter(User._pgp_key.isnot(None))
+                    .filter(User._pgp_key != "")
                 )
-                two_fa_percentage = (two_fa_count / user_count * 100) if user_count else 0
-                pgp_key_percentage = (pgp_key_count / user_count * 100) if user_count else 0
-            else:
-                user_count = two_fa_count = pgp_key_count = two_fa_percentage = (
-                    pgp_key_percentage
-                ) = None
+            )
+            two_fa_percentage = (two_fa_count / user_count * 100) if user_count else 0
+            pgp_key_percentage = (pgp_key_count / user_count * 100) if user_count else 0
+            all_users = list(db.session.scalars(db.select(User)).all())  # Fetch all users for admin
 
         # Prepopulate form fields
         email_forwarding_form.forwarding_enabled.data = user.email is not None
@@ -683,4 +702,58 @@
         flash("User not found. Please log in again.")
         return redirect(url_for("login"))
 
+    @bp.route("/verify-rel-me/<int:field_index>", methods=["POST"])
+    @authentication_required
+    def verify_rel_me(field_index: int) -> Response:
+        user_id = session.get("user_id")
+        if not user_id:
+            return redirect(url_for("login"))
+
+        user = db.session.get(User, user_id)
+        if not user:
+            flash("User not found.")
+            return redirect(url_for("login"))
+
+        url_to_verify = request.form.get(f"extra_field_value{field_index}", "").strip()
+        if not url_to_verify:
+            flash(f"No URL provided for field {field_index}.")
+            return redirect(url_for(".index"))
+
+        # Check if the URL is safe
+        if not is_safe_url(url_to_verify):
+            flash("The URL provided is not safe or is not within the allowed domains.")
+            return redirect(url_for(".index"))
+
+        try:
+            # Instead of making a HEAD or GET request, we can verify the structure here.
+            parsed_url = urlparse(url_to_verify)
+            if not parsed_url.netloc.endswith("hushline.app"):
+                flash("The URL provided is not within the allowed domain.")
+                return redirect(url_for(".index"))
+
+            # Prevent SSRF via redirect (e.g., avoiding open redirects)
+            response = requests.get(url_to_verify, timeout=5, allow_redirects=False)
+            response.raise_for_status()
+
+            # Ensure the response is HTML
+            if "text/html" not in response.headers.get("Content-Type", ""):
+                flash("The URL provided does not return an HTML page.")
+                return redirect(url_for(".index"))
+
+        except requests.exceptions.RequestException as e:
+            current_app.logger.error(f"Error fetching URL: {e}")
+            flash(f"Failed to fetch the URL for field {field_index}.")
+            return redirect(url_for(".index"))
+
+        profile_url = f"https://hushline.app/user/{user.primary_username}"
+        if re.search(rf'<a[^>]+href="{re.escape(profile_url)}"[^>]*rel="me"[^>]*>', response.text):
+            flash(f"✅ Field {field_index} URL is verified.")
+            setattr(user, f"extra_field_verified{field_index}", True)
+        else:
+            flash(f"❌ Field {field_index} URL verification failed.")
+            setattr(user, f"extra_field_verified{field_index}", False)
+
+        db.session.commit()
+        return redirect(url_for(".index"))
+
     return bp

hushline/static/css/style.css

@@ -339,6 +339,10 @@
   #messageForm {
     border-top: var(--border);
   }
+
+  .icon.verifiedURL {
+    background-image: url("../img/app/icon-verified-lm.png");
+  }
 }
 
 /* Dark Mode */
@@ -637,6 +641,10 @@
   #messageForm {
     border-top: var(--border-dark);
   }
+
+  .icon.verifiedURL {
+    background-image: url("../img/app/icon-verified-dm.png");
+  }
 }
 
 body {
@@ -1763,6 +1771,21 @@ input#captcha_answer {
   margin-bottom: 1rem;
 }
 
+.icon.verifiedURL {
+  width: 20px;
+  height: 20px;
+  display: flex;
+  background-size: contain;
+  position: absolute;
+  left: 0;
+  top: 0;
+}
+
+.extra-field-value .icon.verifiedURL + a,
+.extra-field-value .icon.verifiedURL + span {
+  padding-left: 1.5rem;
+}
+
 @media only screen and (max-width: 768px) {
   .container {
     min-width: initial;
@@ -1934,12 +1957,25 @@ button[name="update_directory_visibility"] {
   display: flex;
   justify-content: space-between;
   gap: 1rem;
+  position: relative;
 }
 
 .input-pair input {
   margin-bottom: 0;
 }
 
+.input-pair div:last-child {
+  position: relative;
+}
+
+.input-pair input + .icon.verifiedURL {
+  position: absolute;
+  right: 0%;
+  top: 55%;
+  transform: translateY(0%);
+  left: calc(100% - 20px - 8px);
+}
+
 .form-group-pairs + button {
   margin-top: 1.25rem;
 }
@@ -1994,6 +2030,7 @@ p.bio + .extra-fields {
   white-space: nowrap;
   overflow: hidden;
   text-overflow: ellipsis;
+  position: relative;
 }
 
 .pgp-disabled-overlay {