1731181 - Address bar, security windows show origin elided insecurely, allows URL spoofing

Status: RESOLVED FIXED

(Focus :: General, defect, P3)

Description

[Alesandro Ortiz]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36

Steps to reproduce:

This report is for Firefox Desktop, Firefox for Android, and Firefox Focus for Android.

In all of the above, the address bar shows the beginning of the origin in the address bar. When a long origin is used, this can lead to origin spoofing.

In Firefox Focus, this is particularly bad since tapping the security indicator still does not show the full origin or the end of the origin.
In Firefox for Desktop and Firefox for Android, tapping the security indicator will show the full origin correctly.

In Firefox for Desktop, focusing the address bar keeps showing the beginning of the origin (unsafe).

In Firefox for Android and Firefox Focus for Android, focusing the address bar will show the end of the URL (unsafe). This is unsafe since a long path can also obscure the end of the origin.

This may be a partial duplicate of https://bugzilla.mozilla.org/show_bug.cgi?id=1598175 (Firefox for Desktop) and https://github.com/mozilla-mobile/fenix/issues/6762 (Firefox for Android). I wasn't able to find a public report for Firefox Focus.

This was discovered/discussed publicly on Twitter: https://twitter.com/AlesandroOrtizR/status/1438675521555025922

1. Go to https://badssl.com
2. Navigate to any of their long origin examples
3. Observe address bar and tap security indicator

Actual results:

Address bar in...
Firefox Desktop, Firefox for Android, and Firefox Focus for Android: Shows beginning of origin (https://subdomain...) (unsafe)

When tapping security indicator in...
Firefox Desktop and Firefox for Android: Full origin is shown (safe)
Firefox Focus for Android: Beginning of origin is shown (unsafe)

When focusing address bar in...
Firefox Desktop: Beginning of origin is shown (unsafe)
Firefox for Android and Firefox Focus for Android: End of URL is shown (unsafe because long path can also hide origin)

Expected results:

Address bar in...
All identified products: Shows end of origin (https://...badssl.com)

When tapping security indicator in...
All identified products: Full origin is shown; if elision is needed, show end of origin

When focusing address bar in...
All identified products: End of origin is shown (note: not end of URL)

Comment 1

[Alesandro Ortiz]

Attachment: Firefox-Desktop-Windows

Comment 2

[Alesandro Ortiz]

Attachment: Firefox-Desktop-Windows-AddrBarFocused

Comment 3

[Alesandro Ortiz]

Attachment: Firefox-Android.jpg

Comment 4

[Alesandro Ortiz]

Attachment: Firefox-Android-AddrBarFocused.jpg

Comment 5

[Alesandro Ortiz]

Attachment: Firefox-Android-SecurityInfo.jpg

Comment 6

[Alesandro Ortiz]

Attachment: Firefox-Focus-Android.jpg

Comment 7

[Alesandro Ortiz]

Attachment: Firefox-Focus-Android-AddrBarFocused.jpg

Comment 8

[Alesandro Ortiz]

Attachment: Firefox-Focus-Android-SecurityInfo.jpg

Comment 9

[Alesandro Ortiz]

Repro and attached screenshots from Firefox 92 on Windows 10, Firefox 92.1.1 on Android 11, and Firefox Focus 92.1.1 on Android 11.

Comment 10

[Alesandro Ortiz]

For reference, Chromium has URL guidelines on how to elide URLs safely: https://chromium.googlesource.com/chromium/src/+/refs/heads/main/docs/security/url_display_guidelines/url_display_guidelines.md#Eliding-URLs

This is also part of the URL Standard: https://url.spec.whatwg.org/#url-rendering-elision

Comment 11

[Kevin Brosnan [Ex-Mozilla]]

This should be split into at least a desktop issue and a mobile issue. We may want to further break this into Fenix and Focus issues as they have separate address bars.

Comment 12

[:Gijs (he/him)]

(In reply to Kevin Brosnan [:kbrosnan] from comment #11)

This should be split into at least a desktop issue and a mobile issue. We may want to further break this into Fenix and Focus issues as they have separate address bars.

We already have a desktop issue (bug 1598175) and a fenix issue ( https://github.com/mozilla-mobile/fenix/issues/6762 ). I don't know about Focus.

Comment 13

[Daniel Veditz [:dveditz]]

Since we already have those other issues let's make this the "Focus" one.

These are known UI issues (e.g. we have ourselves contributed to badssl.com) so we don't need to hide this bug.

Comment 14

[Chris Peterson [:cpeterson]]

This bug will require guidance from UX design.

Comment 16

[Daniel Veditz [:dveditz]]

Michel: I know Focus and Firefox for Android share a lot of components, but I don't know if the addressbar widget is one of them. Do you think your fix for bug 1812898 might have fixed Focus also, or is this one place where the code isn't shared?

Comment 17

[Mihai Adrian Carare [:mcarare]]

I think it only solves it partially for Focus, a custom config for the url highlighting must be added to the Focus toolbar integration.

Comment 18

[Michel Le Bihan]

The feature needs to be enabled in mobile/android/focus-android/app/src/main/java/org/mozilla/focus/browser/integration/BrowserToolbarIntegration.kt. I will add it.