1670725 - truncate URL bar from the front, preserve the important parts of the domain

Status: NEW

(Fenix :: Toolbar, defect, P2)

Description

[Kirtikumar Anandrao Ramchandani]

Assigned to:- Firefox
Assigned by:- Kirtikumar Anandrao Ramchandani
Assigned on:- 11/10/2020
Vulnerability Name:- Hostname not elided securely (URL Spoofing on Android browser).
Vulnerability Details:- The browser shown the first past instead of the hostname.
Platform:- Android
Application Version:-

1. Firefox Browser 81.1.4
2. Firefox Lite 2.5.2
3. Firefox Browser Beta 82.0.0-beta.4
4. Firefox Focus 8.8.1
5. Firefox Nightly 201010 17:10
   Device:- Xiaomi Redmi Note 5 Pro (Android 9) (Build/PKQ1.180904.001)
   Video Proof of concept:- https://drive.google.com/file/d/1QOSJyQWM6DIVFgPXHHn1Nd9ynJ6WoMjz/view?usp=sharing
   Original PoC uploaded on:- https://kirtikumarar.com/Firefox_PoC.html
   The result observed:- http://wwww.manage-myaccount.paypal.com....
   Result Expected:- http://....bntk.pl

Steps to reproduce:-

1. Load the Website or the attached testcase.
2. Click on "Click here to go to Google.com"
3. Go back to the parent tab and observe the URL in the address bar.

Comment 1

[Kevin Brosnan [Ex-Mozilla]]

I don't see what the popup does here. It does not seem particularly important to this. This seems like a variant of https://github.com/mozilla-mobile/fenix/issues/6762 and that the parts of the domain that Firefox chooses to display could be improved.

Comment 2

[Daniel Veditz [:dveditz]]

This is a regression from Fennec - I'm pretty sure there much be a dupe (in addition to Chris's github issue)

Comment 3

[Amedyne Moya [:amoya]]

Petru, Can you investigate this one, and check if the github issue mentioned by kevin is related to this. Thanks!

Comment 4

[Kevin Brosnan [Ex-Mozilla]]

The ideal solution here is for GV to fix bug 1685152 and then port the Fennec or Desktop URL parsing code to Fenix/AC.

Comment 5

[Petru-Mugurel Lingurar [:petru]]

Seems like the issue Kevin posted would indeed resolve this and was something that Sebastian & Kate wanted to tackle.
If they don't have cyles to work on this now I'll look into it.
Keeping a NI here to know to follow this.

Comment 6

[Petru-Mugurel Lingurar [:petru]]

Agi's newly opened ticket would probably help with this.
Thank you Kevin!
Adding him to this ticket also.

Comment 7

[Kirtikumar Anandrao Ramchandani]

Happy new year!
Opera has fixed the same issue in Opera Mini (Android). Here: https://twitter.com/Kirtikumar_A_R/status/1348569263548755971

Comment 8

[Daniel Veditz [:dveditz]]

Unfortunately this issue was already known to us (see the linked github issue) and is not eligible for a bug bounty.

Comment 9

[Kirtikumar Anandrao Ramchandani]

This issue will atleast receive CVE, yes? Issue where it shows LTR instead of RTL. Thanks!

Comment 10

[Daniel Veditz [:dveditz]]

I don't know how advisories and CVEs are handled for Firefox Lite.

Comment 11

[Kirtikumar Anandrao Ramchandani]

Can you add somebody in the CC who can assign a CVE?

Comment 12

[Petru-Mugurel Lingurar [:petru]]

Removing my NI while we wait for https://bugzilla.mozilla.org/show_bug.cgi?id=1685152

Comment 13

[Chris Peterson [:cpeterson]]

GV would expose Gecko's URI API (bug 1685152) to Fenix frontend.

Comment 15

[Daniel Veditz [:dveditz]]

(Sorry, duping was a mistake. Fenix has completely independent addressbar code from Desktop)

Comment 20

[Chris Peterson [:cpeterson]]

See also RTL bug 1427647