Submitted URLs validated and checked against spam domain blocklist

Accepting unvalidated URLs in a directory creates two distinct attack surfaces: phishing (a listing points visitors to a credential-harvesting domain) and open redirect abuse (your platform lends credibility to malicious links). CWE-601 (Open Redirect) and CWE-20 (Improper Input Validation) under OWASP A03 both cover this. A blocklist is not optional — URL format validation alone accepts https://known-phishing-domain.com without complaint.

Validate URL structure with the native URL constructor, then check the hostname against a blocklist. Reject client-submitted strings that fail either check:

const BLOCKED_DOMAINS = new Set(['bit.ly', 'tinyurl.com', 't.co'])
// Augment from a maintained feed (e.g., PhishTank, URLhaus)

function validateUrl(raw: string): { ok: boolean; error?: string } {
  let parsed: URL
  try { parsed = new URL(raw) } catch {
    return { ok: false, error: 'Invalid URL format' }
  }
  if (!['http:', 'https:'].includes(parsed.protocol)) {
    return { ok: false, error: 'Only HTTP/HTTPS URLs accepted' }
  }
  if (BLOCKED_DOMAINS.has(parsed.hostname)) {
    return { ok: false, error: 'This domain is not permitted' }
  }
  return { ok: true }
}

Run this in app/api/listings/submit/route.ts before persisting — never defer URL checks to the moderation queue.