520123 - encoded URL can hide contents and change application fonts

Status: RESOLVED INVALID

(Core :: XPCOM, defect)

Description

[Jason Jackson]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)

In the example, the path portion of the URL is actually an unintelligible string of characters, but when parsed becomes "second-life-the-infomerc" displayed in a different font.  This can be seen in the navigation and status bars.

Reproducible: Always

Steps to Reproduce:
1. Go to the address given.
2. Look at the address in various locations.
Actual Results:  
displayed a different url

Expected Results:  
display the actual url

I reproduced this in Firefox 3.5.3 and Thunderbird 2.0.0.23 on Vista x86, as well as 7 x86, and Linux x64.  It does *not* reproduce in Internet Explorer 8.0.

The title appears to be encoded in a similar manner, effecting the title bar, the tab bar, the bookmark menus, and most incredibly, the page source!

Comment 1

[John Daggett (:jtd)]

The URL contains an escaped series of UTF8 encoded full-width Latin characters, these have different Unicode codepoints from normal Latin characters, that's why the font mapping is different.

http://www.unicode.org/charts/PDF/UFF00.pdf

Displays as expected.

Comment 2

[Jason Jackson]

Thanks for the explanation John.  This is more of a design question, but why choose to display these decoded characters in the UI?  I could understand for something aesthetic, but for something functional like a URL or page source, it seems confusing at best.

Comment 3

[John Daggett (:jtd)]

These are IDN URL's:

http://en.wikipedia.org/wiki/Internationalized_domain_name

Comment 4

[Jason Jackson]

Changing status back to "resolved" and "invalid".

Also, there appears to be settings for this in about:config, but I could not get them to have any effect.

network.standard-url.encode-query-utf8
network.standard-url.encode-utf8
network.standard-url.escape-utf8