This repository was archived by the owner on Feb 24, 2025. It is now read-only.
Address Bar Spoofing Tests + Remediation #2181
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…cument. When we receive a 302 redirect to a file download path, we inadvertently set the address bar to the origin of the download path while leaving a stale document in the renderer. This can lead to address bar spoofing, so instead we set the address bar to about:blank while the download is in progress.
not-a-rootkit
requested review from
a team and
jaceklyp
and removed request for
a team
samsymons
added a commit
that referenced
this pull request
Dec 5, 2023
* develop: (40 commits) Address Bar Spoofing Tests + Remediation (#2181) Update Sync e2e tests to fit the new UI (#2215) NetP waitlist final touches (#2209) NetP: Remove port from server address (#2214) NetP: Fix list row colours (#2213) Reset VPN waitlist T&C (#2212) Report macOS active/new user for netP (#2207) Sabrina/sync setup update (#2198) new pixels for toolbars and share sheet (#2208) Use design system fonts throughout NetP (#2211) moving the toggle to the top of the dashboard (#2166) Allow automated fetching of synced bookmarks' favicons (#2163) NetP Geoswitching Design Review feedback (#2206) update theme to use system colours (#2180) Release 7.99.0 (#2205) Update iOS privacy defaults (#2185) Remove disabled switches from VPN Settings screen (#2203) Update BSK for VPN settings (#2165) Fix migrating from Bookmarks V2 and older (#2196) Autofill pixel parameter removed (#2182) ...
samsymons
added a commit
that referenced
this pull request
Dec 11, 2023
* main: Enable NetP in production builds (#2232) Report macOS NetP connection attempts & tunnel failures (#2234) Always use black and white colors for the QR code (#2248) Update BSK with autofill 10.0.1 (#2245) Ensure that LinkPresentation framework is called on main thread (#2241) expose window.print handler to page world (#2243) Updates BSK (#2239) Add Geoswitching pixels (#2235) Fix spacing between buttons (#2237) Update all references to develop branch with main (#2231) Update TRK (#2200) Breakage report improvements (#2197) Update BSK reference to include the disable rekeying flag (#2219) Final NetP ship review feedback (#2221) Improve handling lists in Sync (#2192) remove address bar position pixels (#2220) Address Bar Spoofing Tests + Remediation (#2181) Update Sync e2e tests to fit the new UI (#2215) NetP waitlist final touches (#2209)
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Task/Issue URL: https://app.asana.com/0/414235014887631/1205886249660032/f
Description:
In an attempt to reduce our exposure to address bar spoofing issues I'd like to introduce these 8 new maestro tests that test against privacy-test-pages for specific known address bar spoofing vulnerabilities. The core issue in iOS involves download links that perform 301/302 HTTP redirects - the address bar is incorrectly updated to the download URL even though the target URL has no associated HTML document, therefore we're left with a stale HTML document and a spoofed address bar. See more information here: https://app.asana.com/0/0/1205809497861069/f
In my proposed fix, we update the omnibar text value to "about:blank" when a file download prompt is shown. This is consistent with most other browsers, and the address bar should be correctly updated when there is a HTML document in the renderer, so it shouldn't impact other file downloads.
Steps to test this PR:
(tested on iPhone 14 Pro with iOS 17.0.3 and the simulator, no UI changes so this should be sufficient)
maestro test .maestro/security_tests/0_all.yaml