1390980 - Domain spoofing thanks to U+0F8C rendered as 'space' on Mac OS 10.11

Status: RESOLVED FIXED

(Firefox :: Address Bar, defect)

Description

[Jack Will]

http://important-domain.google.xn--com-lumaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.xn--cfdaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.bntk.pl/

Comment 1

[Matt Wobensmith [:mwobensmith][:matt:]]

What exact version of MacOS are you on?

Comment 2

[Daniel Veditz [:dveditz]]

Gerv: there was another bug about Mac rendering a few Tibetan characters as blank spaces, but I can't find it. Do you recall?

Comment 3

[Daniel Veditz [:dveditz]]

Never mind, found it.

Comment 4

[Daniel Veditz [:dveditz]]

Reopening since bug 1360309 is RESOLVED FIXED. It does appear fixed on macOS 10.12, but still shows up as blank spaces in 10.11

On 10.11 it looks like we'd also have to disable STKaiti, Kaiti SC, and Kaiti TC.

Kailasa and Kokonor claim to support Tibetan but I still get boxes when I leave those enabled; they seem fine.

Comment 5

[Jonathan Kew [:jfkthame]]

(In reply to Daniel Veditz [:dveditz] from comment #4)
> Kailasa and Kokonor claim to support Tibetan but I still get boxes when I
> leave those enabled; they seem fine.

U+08FC (and a few following characters, I think) was not part of the Tibetan block when originally encoded in Unicode (v2.0); it was added much later. As such, it's not surprising if some Tibetan fonts don't include these newer characters.

Comment 6

[Khalil Zhani]

(In reply to Matt Wobensmith [:mwobensmith][:matt:] from comment #1)
> What exact version of MacOS are you on?

OS X El Capitan 10.11.6 (15G31). Sorry for the delayed response :)

Comment 7

[Jonathan Kew [:jfkthame]]

Attachment: Work around more bad fonts on older macOS

I don't have a 10.11 system any longer to verify this, but according to comment 4 this is what we need to do. (Although the problem may be specific to 10.11, the patch is harmless for other macOS versions, as there are no versions of the Kaiti fonts where those codepoints are actually useful.)

Comment 8

[Jonathan Kew [:jfkthame]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ee2f48b5ea07b963d5917e7e606a76abed0f9743
Bug 1390980 - Work around more bad fonts on older macOS. r=jrmuizel

Comment 9

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/ee2f48b5ea07

Comment 10

[Khalil Zhani]

Is this report qualified for a bounty?

Comment 11

[Jack Will]

(I'm on vacation, that's why I Cc'd Khalil Zhani)

Comment 12

[Ryan VanderMeulen [:RyanVM]]

Looks like this could use Beta & ESR52 approval requests.

(In reply to Khalil Zhani from comment #10)
> Is this report qualified for a bounty?

https://www.mozilla.org/en-US/security/client-bug-bounty/ contains information on how to request a bounty for a submitted issue.

Comment 13

[Jonathan Kew [:jfkthame]]

Comment on attachment 8898706 [details] [diff] [review]
Work around more bad fonts on older macOS

[Approval Request Comment]
If this is not a sec:{high,crit} bug, please state case for ESR consideration:
Not really a Gecko bug, this is a workaround for a buggy Apple font with spurious blank characters that might be used to obscure a spoofed URL. Although this does not affect the most recent macOS version (the font appears to have been fixed: the issue is present on 10.11 but not 10.12), it seems likely that a higher proportion of ESR users might also be on older OS releases and hence more likely to be affected than the general release population.

User impact if declined: Potential for URL spoofing due to invalid characters in a Chinese font shipped on older macOS releases

Fix Landed on Version: 57

Risk to taking this patch (and alternatives if risky): minimal

String or UUID changes made by this patch: none

Comment 14

[Daniel Veditz [:dveditz]]

(In reply to Jonathan Kew (:jfkthame) from comment #5)
> U+08FC ... was not part of the Tibetan block when originally encoded in Unicode (v2.0);
> ... [I]t's not surprising if some Tibetan fonts don't include these newer characters.

Would have been nice if they'd encoded them as reserved boxes rather than spooftastic blanks :-(

Comment 15

[Gerry Chang [:gchang]]

Comment on attachment 8898706 [details] [diff] [review]
Work around more bad fonts on older macOS

Avoid a potential URL spoofing. Beta56+ & ESR52+.

Comment 16

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/ce166fe03511

Comment 17

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr52/rev/e45e21461784