# Google Safe Browsing

> Check whether Google considers a link dangerous before your workflow acts on it. Check one link, a whole list, or every link inside an email or a message, and get back whether Google flags it for malware, phishing, unwanted software or a harmful Android app. The links are never sent to Google: only a few bytes of each one's fingerprint leave the workflow, which is the same protection Chrome itself uses.

App · Compliance & Security · 3 actions. Web page: https://docs.lodol.com/docs/integrations/google-safe-browsing

## Actions

### Check a link

Ask Google whether a link is dangerous, and get back what it holds against it: malware, phishing, unwanted software or a harmful Android app. The link itself is never sent to Google.

**Inputs**

- Link (`url`, text, required): The web address to check, for example https://example.com/page. It does not have to be reachable: Google answers from its lists rather than by loading the page.
- Treat as dangerous (`threat_types`, text): Which kinds of threat should make a link come back as unsafe. Leave all four chosen unless you only want to act on some of them. One or more of: `MALWARE`, `SOCIAL_ENGINEERING` (Phishing and deceptive sites), `UNWANTED_SOFTWARE` (Unwanted software), `POTENTIALLY_HARMFUL_APPLICATION` (Harmful Android apps). Default: `["MALWARE", "SOCIAL_ENGINEERING", "UNWANTED_SOFTWARE", "POTENTIALLY_HARMFUL_APPLICATION"]`.

**Outputs**

- `is_safe` (true/false): True when Google holds nothing against this link. This is the field to branch on.
- `report_url` (text): A link that opens Google's own site status page for this address, so a person can read the verdict first-hand.
- `summary` (text): The verdict in one sentence, ready to put in a message.
- `threats` (list): What Google has against the link, one entry per kind of threat. Empty when the link is safe.
- `url` (text): The link that was checked, exactly as it was given.

**Example output**

```json
{
  "is_safe": false,
  "report_url": "https://transparencyreport.google.com/safe-browsing/search?url=http%3A%2F%2Fmalware.testing.google.test%2Ftesting%2Fmalware%2F",
  "summary": "Google Safe Browsing flags this link for malware.",
  "threats": [
    {
      "label": "Malware",
      "matched_url": "malware.testing.google.test/testing/malware/",
      "threat_type": "MALWARE"
    }
  ],
  "url": "http://malware.testing.google.test/testing/malware/"
}
```

### Check several links

Check a whole list of links in one step and get a verdict for each, plus the flagged ones on their own so a workflow can act without looping. Up to 100 links. None of them are sent to Google.

**Inputs**

- Links (`urls`, list, required): The web addresses to check. Add them one at a time, or pass a list from an earlier step. Pasted text separated by spaces or new lines works too.
- Treat as dangerous (`threat_types`, text): Which kinds of threat should make a link come back as unsafe. Leave all four chosen unless you only want to act on some of them. One or more of: `MALWARE`, `SOCIAL_ENGINEERING` (Phishing and deceptive sites), `UNWANTED_SOFTWARE` (Unwanted software), `POTENTIALLY_HARMFUL_APPLICATION` (Harmful Android apps). Default: `["MALWARE", "SOCIAL_ENGINEERING", "UNWANTED_SOFTWARE", "POTENTIALLY_HARMFUL_APPLICATION"]`.

**Outputs**

- `all_safe` (true/false): True when Google flagged none of the links it checked. This is the field to branch on.
- `checked_count` (number): How many of them were actually checked. Lower than link_count when some were not web addresses, or when there were more than 100 of them.
- `dangerous_count` (number): How many of the checked links Google flagged.
- `dangerous_urls` (list): Just the flagged links, ready to drop into a message without looping over the results.
- `invalid_urls` (list): Anything that was not a web address and so could not be checked either way. Usually empty.
- `link_count` (number): How many separate links there were in total, after duplicates were removed.
- `results` (list): One verdict per checked link, in the order given.

**Example output**

```json
{
  "all_safe": false,
  "checked_count": 2,
  "dangerous_count": 1,
  "dangerous_urls": [
    "http://malware.testing.google.test/testing/malware/"
  ],
  "invalid_urls": [],
  "link_count": 2,
  "results": [
    {
      "is_safe": true,
      "report_url": "https://transparencyreport.google.com/safe-browsing/search?url=https%3A%2F%2Fwww.google.com%2F",
      "summary": "Google Safe Browsing has nothing on file against this link.",
      "threats": [],
      "url": "https://www.google.com/"
    },
    {
      "is_safe": false,
      "report_url": "https://transparencyreport.google.com/safe-browsing/search?url=http%3A%2F%2Fmalware.testing.google.test%2Ftesting%2Fmalware%2F",
      "summary": "Google Safe Browsing flags this link for malware.",
      "threats": [
        {
          "label": "Malware",
          "matched_url": "malware.testing.google.test/testing/malware/",
          "threat_type": "MALWARE"
        }
      ],
      "url": "http://malware.testing.google.test/testing/malware/"
    }
  ]
}
```

### Check the links in text

Read every link out of a block of text, such as an email body, a support ticket or a form answer, and check them all at once. Use it to hold back a message whose links Google has flagged. None of the links are sent to Google.

**Inputs**

- Text (`text`, text, required): The text to read the links out of. Anything starting with http://, https:// or www. counts as a link; a bare 'example.com' is left alone, because so are 'README.md' and 'config.py'.
- Treat as dangerous (`threat_types`, text): Which kinds of threat should make a link come back as unsafe. Leave all four chosen unless you only want to act on some of them. One or more of: `MALWARE`, `SOCIAL_ENGINEERING` (Phishing and deceptive sites), `UNWANTED_SOFTWARE` (Unwanted software), `POTENTIALLY_HARMFUL_APPLICATION` (Harmful Android apps). Default: `["MALWARE", "SOCIAL_ENGINEERING", "UNWANTED_SOFTWARE", "POTENTIALLY_HARMFUL_APPLICATION"]`.

**Outputs**

- `all_safe` (true/false): True when Google flagged none of the links it checked. This is the field to branch on.
- `checked_count` (number): How many of them were actually checked. Lower than link_count when some were not web addresses, or when there were more than 100 of them.
- `dangerous_count` (number): How many of the checked links Google flagged.
- `dangerous_urls` (list): Just the flagged links, ready to drop into a message without looping over the results.
- `invalid_urls` (list): Anything that was not a web address and so could not be checked either way. Usually empty.
- `link_count` (number): How many separate links there were in total, after duplicates were removed.
- `results` (list): One verdict per checked link, in the order given.

**Example output**

```json
{
  "all_safe": false,
  "checked_count": 2,
  "dangerous_count": 1,
  "dangerous_urls": [
    "http://malware.testing.google.test/testing/malware/"
  ],
  "invalid_urls": [],
  "link_count": 2,
  "results": [
    {
      "is_safe": true,
      "report_url": "https://transparencyreport.google.com/safe-browsing/search?url=https%3A%2F%2Fwww.google.com%2F",
      "summary": "Google Safe Browsing has nothing on file against this link.",
      "threats": [],
      "url": "https://www.google.com/"
    },
    {
      "is_safe": false,
      "report_url": "https://transparencyreport.google.com/safe-browsing/search?url=http%3A%2F%2Fmalware.testing.google.test%2Ftesting%2Fmalware%2F",
      "summary": "Google Safe Browsing flags this link for malware.",
      "threats": [
        {
          "label": "Malware",
          "matched_url": "malware.testing.google.test/testing/malware/",
          "threat_type": "MALWARE"
        }
      ],
      "url": "http://malware.testing.google.test/testing/malware/"
    }
  ]
}
```