Skip to content
This repository has been archived by the owner on Dec 11, 2019. It is now read-only.

[hackerone] homepage homograph attack #11001

Closed
diracdeltas opened this issue Sep 18, 2017 · 2 comments · Fixed by #11006
Closed

[hackerone] homepage homograph attack #11001

diracdeltas opened this issue Sep 18, 2017 · 2 comments · Fixed by #11006
Assignees
@diracdeltas
Labels
bug QA/checked-Linux QA/checked-macOS QA/checked-Win64 QA/test-plan-specified release-notes/include sec-low security
Milestone
0.19.x (Beta Chan...

Comments

@diracdeltas
Copy link
Member

diracdeltas commented Sep 18, 2017 •
edited by luixxiul
Loading

Test plan

#11006 (comment)

from https://hackerone.com/bugs?report_id=268984&subject=brave:

Steps To Reproduce:

In browser add homepage with IDN @ebаy.com/ or just ebаy.com/
now close and open browser again
click the homepage button. you can see it's redirect to http://xn--eby-7cd.com/

expected result: in the 'home button' field in about:preferences, it should show '@xn--eby-7cd.com/' instead of '@ebаy.com/'

video https://www.youtube.com/watch?v=UgN-XJew9Es&feature=youtu.be
@diracdeltas diracdeltas added this to the 0.21.x (Nightly Channel) milestone Sep 18, 2017
@diracdeltas
Copy link
Member Author

Actually this works even if you don't prefix the URL with '@'. Updating issue accordingly.

@diracdeltas diracdeltas changed the title [hackerone] homepage homograph attack with '@' prefix [hackerone] homepage homograph attack Sep 18, 2017
@diracdeltas diracdeltas modified the milestones: 0.21.x (Nightly Channel), 0.19.x (Beta Channel) Sep 18, 2017
@diracdeltas diracdeltas self-assigned this Sep 18, 2017
diracdeltas added a commit that referenced this issue Sep 19, 2017
@diracdeltas
fix homepage punycode display bypass
9c27818 
fix #11001

Test Plan:
1. automated tests for homepage should pass
2. try setting your homepage to `ebаy.com/`
3. it should display the punycode
@diracdeltas diracdeltas mentioned this issue Sep 19, 2017
Merged
8 tasks
diracdeltas added a commit that referenced this issue Sep 19, 2017
@diracdeltas
fix homepage punycode display bypass
c87fb24 
fix #11001

Test Plan:
1. automated tests for homepage should pass
2. try setting your homepage to `ebаy.com/`
3. it should display the punycode
@bbondy
Copy link
Member

bbondy commented Sep 20, 2017

master: f2e438d
0.20.x: 905d6c9
0.19.x: a7060a1

This was referenced Sep 20, 2017
Closed
Closed
Closed
Closed
This was referenced Sep 21, 2017
Closed
Closed
Closed
Closed
@srirambv srirambv mentioned this issue Sep 25, 2017
Closed
@srirambv srirambv mentioned this issue Sep 26, 2017
Closed
@kjozwiak kjozwiak mentioned this issue Sep 27, 2017
Closed
@srirambv srirambv mentioned this issue Sep 28, 2017
Closed
@srirambv srirambv mentioned this issue Oct 9, 2017
Closed
@kjozwiak kjozwiak mentioned this issue Oct 12, 2017
Closed
syuan100 pushed a commit to syuan100/browser-laptop that referenced this issue Nov 9, 2017
@diracdeltas @syuan100
fix homepage punycode display bypass
b99d81e 
fix brave#11001

Test Plan:
1. automated tests for homepage should pass
2. try setting your homepage to `ebаy.com/`
3. it should display the punycode
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@diracdeltas diracdeltas

Labels
bug QA/checked-Linux QA/checked-macOS QA/checked-Win64 QA/test-plan-specified release-notes/include sec-low security
Projects
None yet
Milestone
0.19.x (Beta Channel)
Development

Successfully merging a pull request may close this issue.

fix homepage punycode display bypass brave/browser-laptop
5 participants
@diracdeltas @bbondy @luixxiul @srirambv @LaurenWags