From ce9712e87558fec8909f4021b4f95d218f76a792 Mon Sep 17 00:00:00 2001 From: Valentin Gosu Date: Tue, 12 Mar 2024 14:22:42 +0000 Subject: [PATCH] Bug 1800628 - Block U+02BB and U+02BC r=necko-reviewers,kershaw Differential Revision: https://phabricator.services.mozilla.com/D204105 --- netwerk/dns/nsIDNService.cpp | 5 +++++ netwerk/test/unit/test_idn_spoof.js | 4 ++-- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/netwerk/dns/nsIDNService.cpp b/netwerk/dns/nsIDNService.cpp index bd5690701055..c4ae41fbb203 100644 --- a/netwerk/dns/nsIDNService.cpp +++ b/netwerk/dns/nsIDNService.cpp @@ -758,6 +758,11 @@ bool nsIDNService::isLabelSafe(const nsAString& label, const nsAString& tld) { return false; } + // Block single/double-quote-like characters. + if (ch == 0x2BB || ch == 0x2BC) { + return false; + } + // Check for mixed numbering systems auto genCat = GetGeneralCategory(ch); if (genCat == HB_UNICODE_GENERAL_CATEGORY_DECIMAL_NUMBER) { diff --git a/netwerk/test/unit/test_idn_spoof.js b/netwerk/test/unit/test_idn_spoof.js index dd3415b525b4..5710b3b7781f 100644 --- a/netwerk/test/unit/test_idn_spoof.js +++ b/netwerk/test/unit/test_idn_spoof.js @@ -708,9 +708,9 @@ let testCases = [ // Block single/double-quote-like characters. // U+02BB (ʻ) - ["xn--ab-8nb.com", "a\u02bbb.com", kUnsafe, "DISABLED"], + ["xn--ab-8nb.com", "a\u02bbb.com", kUnsafe], // U+02BC (ʼ) - ["xn--ab-cob.com", "a\u02bcb.com", kUnsafe, "DISABLED"], + ["xn--ab-cob.com", "a\u02bcb.com", kUnsafe], // U+144A: Not allowed to mix with scripts other than Canadian Syllabics. ["xn--ab-jom.com", "a\u144ab.com", kUnsafe], ["xn--xcec9s.com", "\u1401\u144a\u1402.com", kUnsafe],