1670725 - (urlbar-truncate-android) Truncate URL bar from the front, preserve the important parts of the domain

Status: NEW

(Firefox for Android :: Toolbar, defect, P3)

Description

[Kirtikumar Anandrao Ramchandani]

Assigned to:- Firefox
Assigned by:- Kirtikumar Anandrao Ramchandani
Assigned on:- 11/10/2020
Vulnerability Name:- Hostname not elided securely (URL Spoofing on Android browser).
Vulnerability Details:- The browser shown the first past instead of the hostname.
Platform:- Android
Application Version:-

1. Firefox Browser 81.1.4
2. Firefox Lite 2.5.2
3. Firefox Browser Beta 82.0.0-beta.4
4. Firefox Focus 8.8.1
5. Firefox Nightly 201010 17:10
   Device:- Xiaomi Redmi Note 5 Pro (Android 9) (Build/PKQ1.180904.001)
   Video Proof of concept:- https://drive.google.com/file/d/1QOSJyQWM6DIVFgPXHHn1Nd9ynJ6WoMjz/view?usp=sharing
   Original PoC uploaded on:- https://kirtikumarar.com/Firefox_PoC.html
   The result observed:- http://wwww.manage-myaccount.paypal.com....
   Result Expected:- http://....bntk.pl

Steps to reproduce:-

1. Load the Website or the attached testcase.
2. Click on "Click here to go to Google.com"
3. Go back to the parent tab and observe the URL in the address bar.

Comment 1

[Kevin Brosnan [Ex-Mozilla]]

I don't see what the popup does here. It does not seem particularly important to this. This seems like a variant of https://github.com/mozilla-mobile/fenix/issues/6762 and that the parts of the domain that Firefox chooses to display could be improved.

Comment 2

[Daniel Veditz [:dveditz]]

This is a regression from Fennec - I'm pretty sure there much be a dupe (in addition to Chris's github issue)

Comment 3

[Amedyne Moya [:amoya]]

Petru, Can you investigate this one, and check if the github issue mentioned by kevin is related to this. Thanks!

Comment 4

[Kevin Brosnan [Ex-Mozilla]]

The ideal solution here is for GV to fix bug 1685152 and then port the Fennec or Desktop URL parsing code to Fenix/AC.

Comment 5

[Petru-Mugurel Lingurar [:petru]]

Seems like the issue Kevin posted would indeed resolve this and was something that Sebastian & Kate wanted to tackle.
If they don't have cyles to work on this now I'll look into it.
Keeping a NI here to know to follow this.

Comment 6

[Petru-Mugurel Lingurar [:petru]]

Agi's newly opened ticket would probably help with this.
Thank you Kevin!
Adding him to this ticket also.

Comment 7

[Kirtikumar Anandrao Ramchandani]

Happy new year!
Opera has fixed the same issue in Opera Mini (Android). Here: https://twitter.com/Kirtikumar_A_R/status/1348569263548755971

Comment 8

[Daniel Veditz [:dveditz]]

Unfortunately this issue was already known to us (see the linked github issue) and is not eligible for a bug bounty.

Comment 9

[Kirtikumar Anandrao Ramchandani]

This issue will atleast receive CVE, yes? Issue where it shows LTR instead of RTL. Thanks!

Comment 10

[Daniel Veditz [:dveditz]]

I don't know how advisories and CVEs are handled for Firefox Lite.

Comment 11

[Kirtikumar Anandrao Ramchandani]

Can you add somebody in the CC who can assign a CVE?

Comment 12

[Petru-Mugurel Lingurar [:petru]]

Removing my NI while we wait for https://bugzilla.mozilla.org/show_bug.cgi?id=1685152

Comment 13

[Chris Peterson [:cpeterson]]

GV would expose Gecko's URI API (bug 1685152) to Fenix frontend.

Comment 15

[Daniel Veditz [:dveditz]]

(Sorry, duping was a mistake. Fenix has completely independent addressbar code from Desktop)

Comment 20

[Chris Peterson [:cpeterson]]

See also RTL bug 1427647

Comment 23

[Chris Peterson [:cpeterson]]

Group: mobile-core-security
Status: NEW → RESOLVED
Duplicate of bug: 1598175
Resolution: --- → DUPLICATE

Marking this bug as a private security bug again. Looks like the security flag was cleared when this bug was mistakenly resolved as a duplicate of a desktop address bar bug.

This bug will get fixed by Android's toolbar redesign project (phase 2).

Comment 27

[Daniel Veditz [:dveditz]]

Making public again because the Fenix GH issue is public and the https://long-extended-subdomain-name-containing-many-letters-and-dashes.badssl.com/ test site is a well-known demonstration of exactly this bug.

Comment 29

[Petru-Mugurel Lingurar [:petru]]

Adding a note that the behaviour for how URLs will be displayed on Android will change after bug 1812898, with the domain being bolded and the entire URL scrolled to focus on the domain.