1518161 - [fenix beta] Security Testing address bar spoofing bugs for android components/fenix beta

Status: RESOLVED FIXED

(Firefox Graveyard :: Security: Review Requests, task, P3)

Description

[Frederik Braun [:freddy]]

Address bar spoofing has stood out as a common source of problems in our mobile borwsers. With the android components work and the reference browser <https://github.com/mozilla-mobile/reference-browser>, we should ensure that the components are resilient against spoofing, which would hopefully harden our products all across android.

Comment 1

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Lol whoops wrong bug

Comment 2

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Maybe we should try the new tool google released for our mobile apps, and perhaps also upcoming android components. I haven't looked at it yet, but this is a reminder to do so.

https://github.com/chromium/trickuri

Comment 4

[Frederik Braun [:freddy]]

Useful to look test cases from previous bugs https://mzl.la/2VdWhV3

Comment 5

[Frederik Braun [:freddy]]

We have identified that there is much more "glue code" in Fenix than what we had originally anticipated. For example, we had previously
though that the awesoembar-component includes all security indicators (TLS, permissions, tracking protection, showing the current websites's URL).

Hence, we will much rather conduct a test of the components and how
they are used in Fenix specifically.