1602362 - top sites should not hide TLD

Status: NEW

(Firefox for Android :: Homepage, defect, P2)

Description

[Frederik Braun [:freddy]]

I did a security test of Firefox Preview on android and noticed some peculiarities when it comes to odd domain names and how we shorten them, which could leak to bugs and also misleading security UI.

As it just turned out in the latest comment (https://bugzilla.mozilla.org/show_bug.cgi?id=1554984#c18), some of these things are actually borrowed from Top Sites in our New Tab Page.

We should make sure that all of our URL rendering code aligns with the WHATWG URL Standard, which has a section on what to show, what to hide.
The relevant section is at https://url.spec.whatwg.org/#url-rendering

Comment 1

[Jessilyn Davis]

Hey Freddy! Thanks for this. I think we need a sec-review mtg with our team to understand the security implications and workshop ideas of how we'd fix it.

Can you inform us the urgency around this?

Comment 2

[Frederik Braun [:freddy]]

This seems to be in Top Sites for a while now. Would be nice if we could get it into this or next cycle (taking the holidays and the all hands into account)..

Comment 3

[Jessilyn Davis]

Thanks, Freddy! We've got it on our radar and will kick off the conversations when we're ready to dive in. Likely after the new year.

Marking as a P2 for consideration for next release.

Comment 4

[u759320]

If this is still under consideration, please change the title to "Shortcuts should not hide TLDs".