Closed Bug 1376242 Opened 5 years ago Closed 5 years ago
URL Spoofing via ETHIOPIC COMBINING VOWEL LENGTH MARK
User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0 Build ID: 20170608105825 Steps to reproduce: http://xn--facebook-br9a.com/ (does not show in punnycode) What went wrong? By adding this *፞* (notice the dot above asterisk) we can actually spoof the URL. More info: U+135E: ETHIOPIC COMBINING VOWEL LENGTH MARK Actual results: - Expected results: -
Gerv: I assume this is a duplicate of the more generic bug about combining marks, bug 1370497? Or possibly the script-mixing one bug 1373860. On MacOS (10.11.6) this fails as a spoof because that character appears to be unsupported in the fonts we use -- I just get a box and it's not even close to what it's trying to spoof.
Component: Untriaged → Location Bar
Rayyan: you can stop filing new bugs about every character you think is spoofable. I promise you, it won't increase your chances of getting a bounty :-) If you have new characters which are covered by the two generic bugs (bug 1370497 for combining marks, and bug 1373860 for single-script-plus-Latin), please add them there. Please only file new bugs for new classes of spoofing. Thanks, Gerv
Status: UNCONFIRMED → RESOLVED
Closed: 5 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: CVE-2017-7833
Gerv, could you cc me on bug 1373860, please? Thanks.
You need to log in before you can comment on or make changes to this bug.