Firefox doesn't open Emoji domain that chrome does
Categories
(Core :: Networking, defect, P1)
Tracking
()
| Tracking | Status | |
|---|---|---|
| firefox-esr78 | --- | unaffected |
| firefox-esr91 | --- | wontfix |
| firefox92 | --- | unaffected |
| firefox93 | --- | unaffected |
| firefox94 | --- | wontfix |
| firefox95 | --- | wontfix |
| firefox96 | --- | wontfix |
People
(Reporter: dveditz, Unassigned)
References
(Regression, )
Details
(Keywords: regression, sec-other)
+++ This bug was initially created as a clone of Bug #1724233 +++
See the testcases at https://www.xn--1ugz855p6kd.tk -- originally we opened a different site than Chrome for the final link, but after the fix in bug 1724233 we treat it as a malformed URL and won't open it at all. (we did fix the first part of the bug with non-ASCII in an ACE-prefixed label).
| Reporter | ||
Updated•4 years ago
|
| Reporter | ||
Comment 1•4 years ago
|
||
Did we break emoji-domains entirely? That could annoy a bunch of people who like these as clever toys. Probably no important site though.
Updated•4 years ago
|
Comment 2•4 years ago
•
|
||
I think it's just that one site:
It shows up as invalid in the reference URL parser:
https://jsdom.github.io/whatwg-url/#url=aHR0cDovL3d3dy7wn5Go4oCN8J+msC50aw==&base=YWJvdXQ6Ymxhbms=
(In reply to Anne (:annevk) from bug 1724233 comment #2)
I think the emoji difference is a result of Chrome not using Nontransitional_Processing: https://bugs.chromium.org/p/chromium/issues/detail?id=694157.
Other emoji URLs pass with no issues. For example http://🙂.example.com or http://😆.com
Comment 3•4 years ago
|
||
Note that http://www.👨🦰.tk also fails to parse/load in safari.
Comment 4•4 years ago
|
||
Indeed, this is a question of which variety of IDNA you follow and for some reason Firefox and Safari diverged from the status quo (went from 2003 to 2008, roughly) and Chrome upheld the status quo (stuck with 2003). In my opinion we should all have stuck with 2003, even though that is not great for German users as the Eszett becomes ss (and also not great for a couple other code points but those users have been less vocal about it).
Updated•4 years ago
|
Updated•4 years ago
|
Updated•4 years ago
|
Comment 6•4 years ago
|
||
I'm inclined to close this as WONTFIX.
We currently parse both www.xn--qq8hq8f.tk and http://www.👨🦰.tk exactly as the jsdom reference implementation.
Comment 7•4 years ago
|
||
I agree. It's also not a security bug.
Comment 8•4 years ago
|
||
Thanks Anne!
Updated•4 years ago
|
Description
•