Verify a url is where it is going Swift - arrays

Question

In my app I am trying to have people be able to input links to facebook and youtube. My objective is to make sure that the links they are inputting are actually to facebook & youtube. I'm coming across the issue of figuring out a way to go effectively go about this. Facebook has multiple subdomains, such as "www.facebook.com" & "www.fb.com". Youtube has multiple domains such as "www.youtube.com & "https://youtu.be/". How would I go about verifying that the links they have are actually to either of these subdomains?
what I have so far is this:
let possibleLinks = ["www.facebook.com", "www.fb.com", "www.youtube.com", "https://youtu.be/"]
func verifyLinks(LinkType:String, linkURL:String) {
for url in possibleLinks {
if url != linkURL {
print("This link doesn't match our records of urls - (\(url))")
break
}
}
}
I am struggling to figuring out how to effectively go about this. My biggest issue is due to the fact that lengths of each of the strings are different "fb" is 2 characters, & "facebook" is 6. Is there a way to eliminate "www" ".com" "https"? & if so would there be an issue with the "youtu.be"? B/C there is no .com? Any help would be much appreciated it!

Answer 1

So you have an explicit list of hosts you trust:
let validHosts = ["www.facebook.com", "www.fb.com", "www.youtube.com", "youtu.be"]
And you have an URL you want to check:
let url = URL(string: "https://www.facebook.com/mycontent/is/here")!
Using an URL here is how you avoid all the problems about "https" and the like. Don't use String when you mean URL.
So you just need to make sure the URL's host is in your valid list:
func isValid(url: URL) -> Bool {
guard let host = url.host else { return false }
return validHosts.contains(host)
}
This is the most explicit approach, but it means if someone uses "facebook.com" it's not going to work. You could just include the alternatives you support in your list, and that's by far the most secure approach and what I recommend. It's possible there's some service in facebook.com that could be exploited if you allowed people to link to it (a redirector for example).
That said, it's a useful thing to answer. How would you accept any "fb.com" address like "fb.com", "www.fb.com", and "messenger.fb.com" but not "bobfb.com"? We can do this by breaking up the host into its reverse DNS components and make sure the heads match up to the length of the trusted one.
First, we'd make a helper to return the reverseDNSComponents:
extension String {
var reverseDNSComponents: [String] {
return components(separatedBy: ".").reversed()
}
}
And we'll store our valid list in that format:
let validDomainComponents = ["facebook.com", "fb.com", "youtube.com", "youtu.be"]
.map { $0.reverseDNSComponents }
And now we can test something we're handed:
func isValid(url: URL) -> Bool {
guard let host = url.host else { return false }
let urlDomainComponents = host.reverseDNSComponents
// Make sure that the suffix of the host is in the list of valid domains
return validDomainComponents
.contains { Array(urlDomainComponents.prefix($0.count)) == $0 }
}
(But unless you really need this flexibility, I'd use the explicit approach.)