1403812 - Address bar spoofing with RTL hostname

Status: RESOLVED DUPLICATE of bug 1395508

(Firefox :: Address Bar, defect)

Description

[Khalil Zhani]

Attachment: Screen Shot 2017-09-28 at 04.28.55.png

Visit:

http://مركز-التسجيل.السعودية/https://www.google.com/search?q=khalil&biw=1360&bih=700&source=lnms&tbm=isch&sa=X&ved=0ahUKEwig9dC0rd7PAhUFshQKHU0JAngQ_AUIBigB=mobile

Comment 1

[Daniel Veditz [:dveditz]]

This does not spoof if the pref browser.urlbar.trimURLs is set to false. The LTR scheme seems to anchor the display to the right place. I can, however, reproduce the spoof with the default setting of true. The RTL domain is off to the left of the displayed portion, and the spoofy path is what users will see.

The above means you could not spoof a secure domain because we would always show the "https://" part.

Comment 2

[:Gijs (he/him)]

Isn't this a dupe of bug 1395854?

Comment 3

[:Gijs (he/him)]

(In reply to :Gijs from comment #2)
> Isn't this a dupe of bug 1395854?

Hm, maybe I meant bug 1395508. They're certainly all related. :-\

Comment 4

[Marco Bonardo [:mak] (Away Apr 25 - May 5)]

I can't reproduce the original STR anymore due to remote changes, but I'm assuming bug 1395508 improved the situation here, since we try to keep the host visible.