中繼資料
透過集合功能整理內容
你可以依據偏好儲存及分類內容。
本文件適用於下列方法：
中繼資料是有助於區分威脅類型的資訊，並可提供更具有參考價值的警告 (請參閱建議的警告語言一節)。中繼資料是 fullHashes.find 回應中傳回的 ThreatMatch 物件，包括：
- 威脅清單描述元 (threat/platform/threatEntry 類型組合)：找出安全瀏覽 (threat) 清單。
- 威脅：
threatMatches 是指網址。如為 fullHashes，則是完整的雜湊值。
- 中繼資料：關於威脅的其他資訊。
中繼資料會以鍵/值組合的形式提供 (請參閱 ThreatEntryMetadata 欄位)。如果是 JSON 要求，鍵和值皆採用 Base64 編碼。根據特定的安全瀏覽清單 (威脅/平台/threatEntry 類型組合)，傳回的中繼資料類型會有所不同。
惡意軟體網站
中繼資料目前可供「MALWARE」threatType 和「threatEntryType」網址的所有可用清單使用。這裡說明鍵/值組合。
| 金鑰 |
值 |
說明 |
| malware_threat_type |
landing |
惡意軟體到達網頁。這些網站是惡意軟體的入口。這類網站通常屬於遭入侵的網站，內含 iframe、指令碼或重新導向，會載入其他網站的內容，進而產生實際攻擊。 |
| malware_threat_type |
發布 |
惡意軟體發布網站。這些網站可以發動惡意軟體攻擊。 |
除非另有註明，否則本頁面中的內容是採用創用 CC 姓名標示 4.0 授權，程式碼範例則為阿帕契 2.0 授權。詳情請參閱《Google Developers 網站政策》。Java 是 Oracle 和/或其關聯企業的註冊商標。
上次更新時間：2025-07-25 (世界標準時間)。
[null,null,["上次更新時間：2025-07-25 (世界標準時間)。"],[[["\u003cp\u003eThis documentation focuses on metadata within the Safe Browsing Lookup and Update APIs (v4), aiding in threat distinction and providing informative warnings.\u003c/p\u003e\n"],["\u003cp\u003eMetadata, found within ThreatMatch objects, includes the threat list descriptor, the threat itself (URL or hash), and additional information about the threat.\u003c/p\u003e\n"],["\u003cp\u003eMetadata is presented as key/value string pairs (base64-encoded for JSON) and varies based on the specific Safe Browsing list.\u003c/p\u003e\n"],["\u003cp\u003eCurrently, metadata is available for all lists with \u003ccode\u003eMALWARE\u003c/code\u003e threatType and \u003ccode\u003eURL\u003c/code\u003e threatEntryType, and distinguishes between malware landing and distribution sites.\u003c/p\u003e\n"]]],["The document details metadata within the Lookup and Update APIs (v4), specifically related to `threatListUpdates.fetch` and `fullHashes.find`. Metadata, provided as key/value string pairs, enhances threat differentiation. This is part of the `ThreatMatch` object, that includes threat list descriptor, the threat itself and the associated metadata. For malware, metadata keys like `malware_threat_type` are used, with values such as \"landing\" (gateway sites) or \"distribution\" (attack launching sites). The key and values are base64-encoded in JSON.\n"],null,["# Metadata\n\nThis document applies to the following methods:\n\n- [Lookup API (v4)](/safe-browsing/v4/lookup-api): [threatListUpdates.fetch](/safe-browsing/v4/update-api#example-threatListUpdatesfetch)\n- [Update API (v4)](/safe-browsing/v4/update-api): [fullHashes.find](/safe-browsing/v4/update-api#example-fullHashesfind)\n\nAbout metadata\n--------------\n\nMetadata is information that helps distinguish between threat types and allows for more informative warnings\n(see [Suggested Warning Language](/safe-browsing/v4/usage-limits#UserWarnings)).\nMetadata is part of the\n[ThreatMatch](/safe-browsing/reference/rest/v4/ThreatMatch)\nobject returned in the\n[fullHashes.find response](/safe-browsing/v4/update-api#http-post-response_2)\nand includes:\n\n- The threat list descriptor (threat/platform/threatEntry type combination): Identifies the Safe Browsing (threat) list.\n- The threat: For `threatMatches`, a URL. For `fullHashes`, a full-length hash.\n- The metadata: Additional information about the threat.\n\nMetadata is provided in the form of key/value string pairs (see the\n[ThreatEntryMetadata](/safe-browsing/reference/rest/v4/ThreatMatch#ThreatEntryMetadata)\nfield). For JSON requests, the key and value are both base64-encoded. The *type* of metadata\nreturned will vary depending on the specific Safe Browsing list (the threat/platform/threatEntry\ntype combination).\n\nMalware sites\n-------------\n\nMetadata is currently available for all available lists with the MALWARE `threatType`\nand the URL `threatEntryType`. The key/value pairs are described here.\n\n| key | value | Description |\n|---------------------|--------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| malware_threat_type | landing | Malware landing site. These sites are gateways to malware. They are often hacked sites that include iframes, scripts, or redirects that load content from other sites that launch the actual attacks. |\n| malware_threat_type | distribution | Malware distribution site. These sites launch the malware attacks. |"]]
