1079687 - Lock sign in path/query/fragment shown

Status: RESOLVED DUPLICATE of bug 808234

(Firefox :: Address Bar, defect)

Description

[Simon Pieters [:zcorpan]]

http://example.org/

Comment 1

[Simon Pieters [:zcorpan]]

Hmm. Bugzilla ate my comment. :-( Trying again:

http://example.org/<U+1F512> shows a lock in the address bar without being secure.

Unicode has a "lock" character:
http://www.fileformat.info/info/unicode/char/1f512/index.htm U+1F512
(plus a few others: U+1F513 U+1F510 U+1F50F)
This can be used the in path or query or fragment of the URL and be shown in the address bar. This seems like it could confuse users into thinking the site is secure.

(Probably this happens on all platforms if there is a glyph for the character.)

Comment 2

[Benjamin Smedberg]

Example URI: http://www.fileformat.info/info/unicode/char/1f512/index.htm?%F0%9F%94%92

I really don't know that we try to protect the URL bar from site-generated content, as long as the eTLD+1 is visible and not spoofable. Gavin, who should make a decision about this?