Skip to content
This repository has been archived by the owner on Dec 11, 2019. It is now read-only.

Punycode bypass with @ #13215

Merged
merged 1 commit into from
Feb 21, 2018
Merged

Punycode bypass with @ #13215

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion js/lib/urlutil.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -387,7 +387,9 @@ const UrlUtil = {
parsed.hostname = punycode.toASCII(parsed.hostname)
return urlFormat(parsed)
} catch (e) {
return punycode.toASCII(url)
var splitUrl = url.split('@')
splitUrl = splitUrl.map(str => punycode.toASCII(str))
return splitUrl.join('@')
}
},

Expand Down
3 changes: 3 additions & 0 deletions test/unit/lib/urlutilTest.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -299,6 +299,9 @@ describe('urlutil', function () {
it('returns the punycode URL when given a valid URL', function () {
assert.equal(urlUtil.getPunycodeUrl('http://brave:brave@ebаy.com:1234/brave#brave'), 'http://brave:[email protected]:1234/brave#brave')
})
it('returns the punycode URL when given a URL contains @', function () {
assert.equal(urlUtil.getPunycodeUrl('ebаy.com/@ebаy.com'), 'xn--eby-7cd.com/@xn--eby-7cd.com')
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

technically only the host name should be shown in punycode. but since this code only applies to strings which are not valid URLs, i don't think this matters much.

})
})

describe('isPotentialPhishingUrl', function () {
Expand Down