337721 - [1.8.0]Escaped hostnames defeat possible-phishing detection

Status: RESOLVED WORKSFORME

(Core :: Networking: HTTP, defect)

Description

[Daniel Veditz [:dveditz]]

"Hackena" (h4ck-3n4) reports that we correctly bring up the "possible spoofing" confirm dialog for
   http://[e-mail]/
but if the host name is escaped we load yahoo.fr with nary a peep
   http://www.google.com@%77%77%77%2E%79%61%68%6F%6F%2E%66%72/

Comment 1

[Darin Fisher]

Hrm... this doesn't make any sense.  We don't unescape hex in the hostname, and we have checks to prevent sending hex escaped hostnames to the DNS resolver _and_ to proxy servers.  What version of Firefox is being tested?

Perhaps we do not bring up the "possible spoofing" confirm dialog because we did not get past the "looks like a bad hostname" checks.

Comment 2

[Christian :Biesinger (don't email me, ping me on IRC)]

yeah, we just show an error page for that URL, don't we?

Comment 3

[Daniel Veditz [:dveditz]]

(In reply to comment #2)
> yeah, we just show an error page for that URL, don't we?

Interesting, indeed we do in ff2, but not in the current released ff1.5.0.x. Would it be worth figuring out what fixes got added on the 1.8 branch and putting them in the next 1.5.0.x?

Comment 4

[Daniel Veditz [:dveditz]]

IE, Opera, and our old versions (ff1.0 and 1.5, Moz Suite forever) are perfectly happy loading the escaped URL http://%77%77%77%2e%79%61%68%6f%6f%2e%66%72/

Isn't Firefox 2 likely to break things by rejecting it?

Comment 5

[Darin Fisher]

Dan, I'm confused because I thought we failed to unescape %-encoded hostnames in all versions of Mozilla since... well... for a long time.

On the 1.8.0 branch (and elsewhere):
http://lxr.mozilla.org/mozilla1.8.0/source/netwerk/base/src/nsURLHelper.cpp#896

I'm curious who is performing the unescaping.

Comment 6

[Darin Fisher]

See also bug 304904 !

Comment 7

[Daniel Veditz [:dveditz]]

(In reply to comment #6)
> See also bug 304904 !

especially bug 304904 comment 9 which explains we're violating rfc 3986 by rejecting these (bug 309671). (%-escaped hosts are implied by the earlier rfc 2396 but left out of the explicit syntax for hosts. rfc 3986 corrects this)

So this will come back as a problem when bug 309671 is fixed.

Comment 8

[Daniel Veditz [:dveditz]]

*** Bug 339816 has been marked as a duplicate of this bug. ***

Comment 9

[Jay Patel [:jay]]

Minusing for 1.8.0.5, but we can reconsider for the next release once we figure out what we're going to do with bug 309671.

Comment 10

[Darin Fisher]

-> reassign to default owner

Comment 11

[Daniel Veditz [:dveditz]]

This is fixed in later versions so we're closing it "WFM", but it still exists on the named branch. The future bugzilla "sightings" feature would help here.