YouTube Enforce Safety Mode Ruleset

[jebeling]

Attached are 2 rulesets for enforcing YouTube Safety mode. The zip files contain the ruleset, a custom blockpage and a README describing the installation steps. v4 is an advanced version of a simpler v2 ruleset that I originally developed based on a request from another SE. The nice thing about the v4 ruleset is that it gracefully handles situations where cookies are blocked. The ruleset would be much simpler without these features, but they do show off some of the cool features of MWG7 that newer users may not have been exposed to previously.

Rule Sets

YouTube Enforce Safety Mode v4 [Ruleset for enforcing YouTube Safety mode. Only applies to hostnames that match in the YouTube Hosts wildcard list. Note that cookies must be enabled for youtube.com, otherwiseattempted access to any video will be blocked.] Enabled Applies to Requests: True / Responses: True / Embedded Objects: True 1: URL.Host matches in list YouTube Hosts Enabled Rule Action Events Comments Enabled Allow Set Safety Mode Requests 1: URL.Path equals "/set_safety_mode" 2: AND URL.GetParameter("safety_mode") equals "true" Stop Rule Set Allow Set Safety Mode Enabled Block Disable Safety Mode 1: URL.Path equals "/set_safety_mode" 2: AND URL.GetParameter("safety_mode") does not equal "true" Block<YouTube Safety Mode Block> Statistics.Counter.Increment("BlockedByURLFilter",1)<Default> Block if attempt to disable safety mode Enabled Allow Any YouTube Requests with Safety Mode Cookie Set 1: Header.Request.Exists("Cookie") equals true 2: AND Header.Request.Get("Cookie") matches in list You Tube Safety Cookie Stop Rule Set Any requests that have a cookie for safety mode already set are allowed Handle YouTube Responses When No Safety Cookie [This ruleset handles the responses when SM cookie doesn't exist. Or we haven't yet detected Safety mode on. In these cases we need to enable HTML Opener to look at Embedded Objects. This ruleset provides additional guidance to the user if cookies are blocked and will support Safety Mode when YouTube finally figures out how to do it by session server side.] Enabled Applies to Requests: False / Responses: True / Embedded Objects: True 1: Header.Request.Get("Cookie") does not match in list You Tube Safety Cookie 2: AND User-Defined.YouTube-SafetyMode-On equals false Enabled Rule Action Events Comments Enabled Enable HTML Opener Always Continue Enable HTML Opener<YouTube Safety Mode Opener> Examine Safety Mode Hyperlink in Page Footer [If the footer says that Safety Mode is off, the page should be blocked. If we find that safety mode is on, set the UDP for the rest of the transaction] Enabled Applies to Requests: True / Responses: False / Embedded Objects: True 1: HTMLElement.HasAttribute("onclick") equals true 2: AND HTMLElement.Attribute("onclick") matches *safetymode-picker* 3: AND URL.Path does not match in list YouTube Path List No Safety Mode Enabled Rule Action Events Comments Enabled If Safety Mode is Off and Cookies are Enabled Redirect 1: Body.ToString(0,Body.Size) matches *Off* 2: AND Header.Request.Exists("Cookie") equals true Redirect<YouTube Safety Redirect> Statistics.Counter.Increment("BlockedByURLFilter",1)<Default> Redirect if text matches Off and there is a cookie. Enabled If Safety Mode is Off and There is No Cookie Block 1: Body.ToString(0,Body.Size) matches *Off* Block<YouTube Safety Mode Block> Statistics.Counter.Increment("BlockedByURLFilter",1)<Default> Block if text matches Off and there is no cookie Enabled Set Flag for Rest of Transaction if Safety Mode On 1: Body.ToString(0,Body.Size) matches *On* Continue Set User-Defined.YouTube-SafetyMode-On = true If safety mode is on we can allow all remaining cycles by setting the UDP Handle Unsuccessful Safety Mode Set [This ruleset detects the case where YouTube reports that Safety Mode was successfully set, but it really wasn't because cookies were blocked. ] Enabled Applies to Requests: True / Responses: False / Embedded Objects: True 1: HTMLElement.HasAttribute("class") equals true 2: AND HTMLElement.Attribute("class") matches yt-alert-content Enabled Rule Action Events Comments Enabled Change Safety Mode Successfully Set Message If Cookie Not Enabled 1: Body.ToString(0,Body.Size) matches *Successfully* Continue Set User-Defined.YouTube-SafetyMode-Notification = Body.ToString(0,Body.Size) Set User-Defined.YouTube-SafetyMode-Notification = String.ReplaceFirst(User-Defined.YouTube-SafetyMode-Notification,"Successfully enabled Safety Mode","Failed to enable Safety Mode - Cookies Blocked") Save Body of Object, and modify. Enabled Change Safety Mode Notification 1: Body.ToString(0,Body.Size) matches *Successfully* Remove Body.Insert(0,User-Defined.YouTube-SafetyMode-Notification) Remove original body and replace with modified.

The simpler version (v2) looks like this:

Rule Sets

YouTube Enforce Safety Mode v2 [Ruleset for enforcing YouTube Safety mode. Only applies to hostnames that match in the YouTube Hosts wildcard list. Note that cookies must be enabled for youtube.com, otherwise attempted access to any video will be blocked.] Enabled Applies to Requests: True / Responses: False / Embedded Objects: False 1: URL.Host matches in list YouTube Hosts Enabled Rule Action Events Comments Enabled Allow URL Paths in Path List No Cookie 1: URL.Path is in list Path List No Cookie 2: AND Header.Request.Get("Cookie") does not match in list You Tube Safety Cookie Stop Rule Set Optional rule to allow base path when no cookie is set. Handles first user visit without blocking, if cookies are not enabled. Enabled Allow Set Safety Mode 1: URL.Path equals "/set_safety_mode" 2: AND URL.GetParameter("safety_mode") equals "true" Stop Rule Set Allow any requests that set safety mode to true Enabled Block Disable Safety Mode for YouTube Hosts 1: (URL.Path equals "/set_safety_mode" 2: AND URL.GetParameter("safety_mode") does not equal "true") 3: OR Header.Request.Exists("Cookie") equals false Block<YouTube Safety Mode Block> Block if no cookie or if attempt to disable safety mode Enabled Enforce Safety Mode for YouTube Hosts - Using Redirect 1: Header.Request.Get("Cookie") does not match in list You Tube Safety Cookie Redirect<YouTube Safety Redirect> Any requests that don't have a cookie for safety mode are explicitly redirected. This is the preferred method to use for the redirect as it is more likely to be compatibile with most browsers. A URL rewrite using a Set URL event would also work but results in the browser receiving a redirect to the same URL that was originally requested and some browsers won't accept that.

Message was edited by: jebeling on 6/28/11 5:55:09 PM CDT

[Troja]

Hi,

the youtube safety mode is not working any more with my mwg 7.1.6 or there has something changed with youtube.

Will there be a new version of the ruleset available?

Best,

Thorsten

[asabban]

Hi Thorsten,

did you try the one here:

https://community.mcafee.com/message/217850#217850

(second post)

It is a 2 minute rule set but it worked pretty well. I am not sure if it is still working. I also don´t know if it is the same as above. Maybe you can have a look.

We want to have Youtube as a SafeSearchEnforcer supported search engine in the future. But for the meantime we could probably create a new rule set to enforce safe search.

Best,

Andre

[Troja]

Hi Andre,

i tested every ruleset available from the community but no one is functioning.

Best,

Thorsten

[asabban]

Hi Thorsten,

can you ensure you tried the one attached? I have imported it and it works fine for me. If it does not work for you, can you probably eMail me some dumps so that I can check what looks different in your requests?

Best,

Andre

Nachricht geändert durch asabban on 13.02.12 06:29:27 CST

[Troja]

Hi Andre,

why is the ruleset working for you?? I installed a fresh mwg, instaled the the default policy and imported your ruleset. It´s not working.... looks strange.

If you need any information if you want to debug this please let me know.

Best,

Thorsten

[jebeling]

Youtube changed their site. The ruleset could probably be modified to account for the change. But unfortunately I do not have the time to modify and test. Sorry.

[jebeling]

There are two issues with v4 that I know of. The first is that the set safety mode page link doesn't work, it's probably because the parameter is now expected in a POST rather than a GET. The second issue is that Google changed the page and The HTML element at the bottom that indicates the status of safety mode has drastically changed. I looked at this briefly over the weekend but did not have time to fix. Don't know when I can get to it.

[NetTas]

I have created a Product Feature Request  (SN#10829) to create a YouTube SafetyMode Enforcer rule.

We have been using the Rule Set (V4) as described above for some time now, but has stopped around XMas. The command http://youtube.com/set_safety_mode?safety_mode=true@nexturl=http://youtube.com that was incorporated in the YouTube Block page no longer works and from what I can gather now requires the current associated sessionID.

[ianl]

Hi Guys,

Perhaps the below articles from Google/YouTube may help in modifying the rulesets. Do let me know.

Google SafeSearch and SSL Search for Schools

http://support.google.com/websearch/bin/answer.py?hl=en&answer=186669

Lock Safesearch

http://support.google.com/images/bin/answer.py?hl=en&answer=144686

Google SSL Search

http://support.google.com/websearch/bin/answer.py?hl=en&answer=173733

Best regards,

Ian