Issue metadata
Sign in to add a comment
|
URL Spoofing via latin dotless i with dot above
Reported by
rayyan...@gmail.com,
Jun 9 2017
|
||||||||||||||||||||||||||
Issue descriptionhttps://www.xn--gmal-nza43z.com/ (does not show in punnycode) What went wrong? By adding "ı̇" we can actually spoof the URL More info: (latin small letter dotless i with dot above) <U+0131, U+0307>
,
Jun 9 2017
Indeed, this was addressed in https://chromium.googlesource.com/chromium/src/+/a586e96794b89bef4729b33369b8c2035564d376
,
Jun 9 2017
I think the bug doesn't reproduce in 61 because the dotless i ( Issue 703750 ) is fixed. However, we can still spoof the URL with i and a dot. Can you check if this reproduces in Chrome 61? http://xn--gmail-bgd.com/ (latin small letter i with dot above)
,
Jun 12 2017
The URL mentioned in #4 renders in Punycode.
,
Sep 16 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Oct 19
|
|||||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||||
Comment 1 by elawrence@chromium.org
, Jun 9 2017Components: UI>Security>UrlFormatting UI>Internationalization
Summary: URL Spoofing via latin dotless i with dot above (was: URL Spoofing )