rouslan, could you please take a look, or help with assigning this to the right person? thanks!

Given that the attacker controls the string immediately above the "spoofed" string, this feels more like a Low severity issue. 

elawrence: Do you think disabling the API on data URLs would help?

+lgarron@, expert on URL display.

(FWIW, the repro here is a blob: URL; top-level navigation to data: URLs will be blocked in Chrome 60 ( Issue 684011 ). Do we allow the API in subframes?)

Having said that, is there a reason that we're showing a full URL here instead of the security origin?

Drive-by: IMO we should disable this API on anything other than https URLs. There is all sorts of weirdness with pseudo URLs that make their display a nightmare (e.g. blob URLs can have null origins if they are opened by data URL iframes).

We allow API in subframes that have "allowpaymentrequest" attribute.

We're showing the output of FormatURLForSecurityDisplay(webContents.getLastCommittedURL()). Let me check the code to see what's happening exactly.

meacer, localhost and file:// scheme origins should also be enabled for testing.

OK, so https, localhost and file only then? 

SGTM. I can make the change.

FYI. I believe this has been fixed in Canary (https://play.google.com/store/apps/details?id=com.chrome.canary) via http://crrev.com/6e3cf7c.

xisigr: Can you verify?

meacer: Would it be OK to allow the API on all cryptographic schemes? (Along with localhost and file:// scheme origins.)

#14: That would add only WSS. That seems unlikely to happen in the real world, but also harmless?

Are we sure this bug is present only on Android?

Any reason we can't use IsOriginSecure()?

> Any reason we can't use IsOriginSecure()?

We use IsOriginSecure() since http://crrev.com/6e3cf7c.

> Are we sure this bug is present only on Android?

Desktop UI does not show the origin. I'll work with iOS folks on getting this fixed as well. +mahmadi

> That would add only WSS. That seems unlikely to happen in the real world, but also harmless?

Also HTTPS-SO. I'm not sure what WSS and HTTPS-SO are, but they are all considered "cryptographic" in Chrome.

mahmadi, can we get something similar to https://cs.chromium.org/chromium/src/components/payments/content/payment_request.cc?l=48-69 on iOS?

http://crrev.com/2859613002

> Also HTTPS-SO. I'm not sure what WSS and HTTPS-SO are

Those are schemes to designate suborigins (https://w3c.github.io/webappsec-suborigins/). That whole suborigin-encoded-in-the-scheme thing might be going away soon anyway, but for now that seems fine; I don't see any reason to restrict payment requests on suborigins.

> Any reason we can't use IsOriginSecure()?

IsOriginSecure incorrectly considers a bunch of unrelated schemes as secure (file, filesystem, about:blank (bug 696810) and data (bug 684231).

The bug that allows an attacker tamper with trusted origin of Payment UI.Is this SecSeverity-Low? 

rouslan: This bug is not valid in Canary, I think it has been fixed.

elawrence^^

Re #24: URL Spoofing in contexts outside of the address box does not have a defined severity (https://www.chromium.org/developers/severity-guidelines). 

Given that the UI here isn't a surface with which most users will be familiar, and because the spoofable string is immediately adjacent to a string which is deliberately attacker controlled, Low severity seems appropriate to me. 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b28f4539b767b634d9257964f04e72b8987910b5

commit b28f4539b767b634d9257964f04e72b8987910b5
Author: rouslan <rouslan@chromium.org>
Date: Mon May 08 15:41:47 2017

Disable web payments API on blob: and data: schemes.

This patch makes PaymentRequest.show() always reject with
NotSupportedError and PaymentRequest.canMakePayments() always return
false on origins that are not either localhost, file://, or
cryptographic scheme.

BUG= 717476 

Review-Url: https://codereview.chromium.org/2859613002
Cr-Commit-Position: refs/heads/master@{#469991}

[modify] https://crrev.com/b28f4539b767b634d9257964f04e72b8987910b5/chrome/android/java/src/org/chromium/chrome/browser/payments/PaymentRequestImpl.java
[modify] https://crrev.com/b28f4539b767b634d9257964f04e72b8987910b5/chrome/android/java_sources.gni
[add] https://crrev.com/b28f4539b767b634d9257964f04e72b8987910b5/chrome/android/javatests/src/org/chromium/chrome/browser/payments/PaymentRequestBlobUrlTest.java
[add] https://crrev.com/b28f4539b767b634d9257964f04e72b8987910b5/chrome/android/javatests/src/org/chromium/chrome/browser/payments/PaymentRequestDataUrlTest.java
[modify] https://crrev.com/b28f4539b767b634d9257964f04e72b8987910b5/chrome/android/javatests/src/org/chromium/chrome/browser/payments/PaymentRequestTestBase.java
[add] https://crrev.com/b28f4539b767b634d9257964f04e72b8987910b5/chrome/browser/ui/views/payments/payment_request_blob_url_browsertest.cc
[modify] https://crrev.com/b28f4539b767b634d9257964f04e72b8987910b5/chrome/browser/ui/views/payments/payment_request_browsertest_base.cc
[modify] https://crrev.com/b28f4539b767b634d9257964f04e72b8987910b5/chrome/browser/ui/views/payments/payment_request_browsertest_base.h
[add] https://crrev.com/b28f4539b767b634d9257964f04e72b8987910b5/chrome/browser/ui/views/payments/payment_request_data_url_browsertest.cc
[modify] https://crrev.com/b28f4539b767b634d9257964f04e72b8987910b5/chrome/browser/ui/views/payments/test_chrome_payment_request_delegate.cc
[modify] https://crrev.com/b28f4539b767b634d9257964f04e72b8987910b5/chrome/browser/ui/views/payments/test_chrome_payment_request_delegate.h
[modify] https://crrev.com/b28f4539b767b634d9257964f04e72b8987910b5/chrome/test/BUILD.gn
[add] https://crrev.com/b28f4539b767b634d9257964f04e72b8987910b5/chrome/test/data/payments/blob_url.js
[add] https://crrev.com/b28f4539b767b634d9257964f04e72b8987910b5/chrome/test/data/payments/payment_request_blob_url_test.html
[modify] https://crrev.com/b28f4539b767b634d9257964f04e72b8987910b5/components/payments/content/payment_request.cc
[modify] https://crrev.com/b28f4539b767b634d9257964f04e72b8987910b5/components/payments/content/payment_request.h

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot