Skip to content
This repository was archived by the owner on Dec 11, 2019. It is now read-only.

Commit f2e438d

Browse files
authored
Merge pull request #11006 from brave/fix/homepage-homograph
fix homepage punycode display bypass
2 parents e1066fd + c87fb24 commit f2e438d

File tree

3 files changed

+16
-2
lines changed

3 files changed

+16
-2
lines changed

js/lib/urlutil.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -354,7 +354,7 @@ const UrlUtil = {
354354
parsed.hostname = punycode.toASCII(parsed.hostname)
355355
return urlFormat(parsed)
356356
} catch (e) {
357-
return url
357+
return punycode.toASCII(url)
358358
}
359359
},
360360

test/about/preferencesTest.js

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,17 @@ describe('General Panel', function () {
3535
.waitForInputText(homepageInput, 'https://www.brave.xn--com-8cd/')
3636
})
3737

38+
it('homepage displays punycode without HTTP prefix', function * () {
39+
yield this.app.client
40+
.tabByIndex(0)
41+
.loadUrl(prefsUrl)
42+
.waitForVisible(homepageInput)
43+
.click(homepageInput)
44+
.keys(Array.apply(null, Array(50)).map(() => Brave.keys.BACKSPACE))
45+
.keys('а')
46+
.waitForInputText(homepageInput, 'xn--80a')
47+
})
48+
3849
it('homepage can be backspaced', function * () {
3950
yield this.app.client
4051
.tabByIndex(0)

test/unit/lib/urlutilTest.js

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -280,9 +280,12 @@ describe('urlutil', function () {
280280
})
281281

282282
describe('getPunycodeUrl', function () {
283-
it('returns empty string if input is not a URL', function () {
283+
it('returns original string if input is ASCII', function () {
284284
assert.equal(urlUtil.getPunycodeUrl('invalid-url-goes-here'), 'invalid-url-goes-here')
285285
})
286+
it('returns punycode ASCII string if input is non-ASCII', function () {
287+
assert.equal(urlUtil.getPunycodeUrl('ebаy.com'), 'xn--eby-7cd.com')
288+
})
286289
it('returns the punycode URL when given a valid URL', function () {
287290
assert.equal(urlUtil.getPunycodeUrl('http://brave:brave@ebаy.com:1234/brave#brave'), 'http://brave:brave@xn--eby-7cd.com:1234/brave#brave')
288291
})

0 commit comments

Comments
 (0)