New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 792163 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Jan 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , iOS , Chrome , Mac
Pri: 1
Type: Bug-Security
Team-Security-UX



Sign in to add a comment

Review U+04CF confusable mapping and make it platform-dependent if necessary

Project Member Reported by js...@chromium.org, Dec 5 2017

Issue description

Spun off from https://chromium-review.googlesource.com/c/chromium/src/+/805214 . 

Depending on a font choice, U+04CF ( ӏ ) looks like Latin Capital Letter I or Latin Lowercase L. 

On macOS (in the omnibox), it looks identical to the latter. On Windows (perhaps with Segoe UI), it's more like the former. 

Currently, Chrome is mapping it to Latin Lowercase L before calculating the skeleton of a domain to display (that is, it's overriding ICU's skeleton for U+04CF). 

We may have to make the mapping platform-dependent. 


 
Labels: -Pri-3 M-65 Security_Impact-Stable Security_Severity-Medium OS-Android OS-Chrome OS-iOS OS-Linux OS-Mac OS-Windows Pri-1
Owner: mgiuca@chromium.org
Status: Assigned (was: Untriaged)
Assigning this one to mgiuca, since it's a URLFormatting bug, feel free to reassign if appropriate.
Cc: mgiuca@chromium.org
Owner: js...@chromium.org
Assigning to jshin who deals with the confusable script side of things.
Project Member

Comment 4 by sheriffbot@chromium.org, Dec 20 2017

jshin: Uh oh! This issue still open and hasn't been updated in the last 14 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 5 by sheriffbot@chromium.org, Jan 3 2018

jshin: Uh oh! This issue still open and hasn't been updated in the last 28 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 6 by js...@chromium.org, Jan 14 2018

Status: Started (was: Assigned)
https://chromium-review.googlesource.com/c/chromium/src/+/866154
Project Member

Comment 7 by bugdroid1@chromium.org, Jan 17 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/bf4b54adc460c34e4398e555f1337917c42bd48b

commit bf4b54adc460c34e4398e555f1337917c42bd48b
Author: Jungshik Shin <jshin@chromium.org>
Date: Wed Jan 17 05:43:21 2018

Map U+04CF (ӏ) to 'i' on Windows

U+04CF (ӏ) looks like 'I' (Latin Capital I) in Windows' UI font
(Segoe UI). So, map it to 'i' on Windows.

Bug:  792163 
TEST: components_unittests --gtest_filter=*IDN*
Change-Id: I7ee84adb522479a9c8f616d0fd71f010a242af45
Reviewed-on: https://chromium-review.googlesource.com/866154
Reviewed-by: Peter Kasting <pkasting@chromium.org>
Commit-Queue: Jungshik Shin <jshin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#529635}
[modify] https://crrev.com/bf4b54adc460c34e4398e555f1337917c42bd48b/components/url_formatter/idn_spoof_checker.cc
[modify] https://crrev.com/bf4b54adc460c34e4398e555f1337917c42bd48b/components/url_formatter/top_domains/test_domains.list
[modify] https://crrev.com/bf4b54adc460c34e4398e555f1337917c42bd48b/components/url_formatter/top_domains/test_skeletons.gperf

Comment 8 by js...@chromium.org, Jan 17 2018

Status: Fixed (was: Started)
Project Member

Comment 9 by sheriffbot@chromium.org, Feb 8 2018

Labels: Restrict-View-SecurityNotify
Labels: Release-0-M65
Project Member

Comment 11 by sheriffbot@chromium.org, Apr 26 2018

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment