315666 - the escaped IDN is not working

Status: RESOLVED DUPLICATE of bug 309671

(Core :: Networking, defect, P1)

Description

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

In HTML or XHTML specs, if the value of URI contains non-ASCII character, it should be escaped by UTF-8 encoding. But if we write so, Mozilla don't treat as IDN the URI.

Comment 1

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: testcase

Comment 2

[Darin Fisher]

This is something we plan to support for Gecko 1.9.  It's not something that will make the Gecko 1.8 (Firefox 1.5) release.

Comment 3

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: Patch rv1.0

Comment 4

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

This patch works only escaped by UTF-8.
I think that if we use mOriginCharset, it is not secure.
See the comment that is in the patch.

Comment 5

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

(In reply to comment #2)
> This is something we plan to support for Gecko 1.9.  It's not something that
> will make the Gecko 1.8 (Firefox 1.5) release.
> 

Darin, Cannot this go to 1.8.1? This is HTML/XHTML bug too.

Comment 6

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: Patch rv1.1

comments are rewritten.

Comment 7

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

NOTE for Web Developers:

If you want to write valid IDN URI values in HTML/XHTML documents, please use punycode for host name. This is only way for valid HTML/XHTML documents. Of course, for IDN-less UA, this way is recommended.

Comment 8

[Darin Fisher]

Isn't this bug a duplicate of bug 309671?

Comment 9

[Christian :Biesinger (don't email me, ping me on IRC)]

this does look like a duplicate

Comment 10

[Andreas Otte]

Yes, it is a dup. The patch on bug 309671 does this too but also catches phishing attempts hidden in the escaped host ... only allowing escaped hosts is pretty dangerous. 

How about a superreview for the patches on bug 309671 darin?

Comment 11

[Andreas Otte]

Btw: The first two URLs from the testcase work well with the patches from bug 309671.

Comment 12

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

*** This bug has been marked as a duplicate of 309671 ***