New issue
Advanced search Search tips

Issue 721756 link

Starred by 1 user
Status: Duplicate
Owner: ----
Closed: May 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug-Security



Sign in to add a comment

URL spoofing via RTL and IP address

Reported by rayyan...@gmail.com, May 12 2017 
UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Steps to reproduce the problem:
https://כ.ד.شبكة/216.58.218.142 

>>>https://xn--geb.xn--7db.xn--ngbc5azd/216.58.218.142

What is the expected behavior?
Logical order should be shown i.e: Ip-address followed by כ.ד.شبكة 

What went wrong?
Vice Versa of expected behavior, hence It allows you to spoof the URL when combined with ip address.

Did this work before? N/A 

Chrome version: 58.0.3029.81  Channel: n/a
OS Version: 10.0
Flash Version:

Comment 1 by rayyan...@gmail.com, May 12 2017

PoC.png
16.8 KB View Download

Comment 2 by elawrence@chromium.org, May 12 2017

Components: UI>Browser>Omnibox UI>Internationalization>RTL
Status: Untriaged (was: Unconfirmed)
Summary: URL spoofing via RTL and IP address (was: URL spoofing)
This appears to be a dupe of Issue 638818.

Comment 3 by rayyan...@gmail.com, May 12 2017 

@elawre... Can you cc me there if possible?

Comment 4 by aarya@google.com, May 15 2017

Mergedinto: 638818
Status: Duplicate (was: Untriaged)
Done, cced you.
Project Member

Comment 5 by sheriffbot@chromium.org, Feb 15 2018

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment