365321 - does not display IDN on URL bar

Status: VERIFIED WONTFIX

(Core :: General, defect)

Description

[baffclan]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a2pre) Gecko/20061228 Minefield/3.0a2pre
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a2pre) Gecko/20061228 Minefield/3.0a2pre

dose not display IDN on URL bar.


Reproducible: Always

Steps to Reproduce:
1. open https://bugzilla.mozilla.org/attachment.cgi?id=113151
2. click test case (e.g., http://南极星.com/ )

Actual Results:  
URL bar is http://xn--6kry05bl4a.com/njstarc.php

IDN is encoded.


Expected Results:  
http://南极星.com/njstarc.php


reproduce with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a2pre) Gecko/20061220 SeaMonkey/1.5a, too.

Comment 1

[Jo Hermans]

That's because of bug 279099 : certain security attacks are possible if we display the real IDN character behind the puny-code.

Firefox implements a whitelist of top level domains that are safe to use (see bug 286534 and <http://www.mozilla.org/projects/security/tld-idn-policy-list.html>), but .com is not one of those.

Workaround: if you set the configuration-parameter network.IDN.whitelist.com to true (you have to create it in about:config, it doesn't exists yet), then it displays ok.