Address Bar Spoofing Test Cases + Remediation #3882
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
CDRussell
reviewed
Nov 22, 2023
app/src/main/java/com/duckduckgo/app/browser/BrowserTabViewModel.kt
Outdated
Show resolved
Hide resolved
Add test case for valid URL containing "@" character.
aitorvs
reviewed
Nov 22, 2023
app/src/main/java/com/duckduckgo/app/browser/BrowserTabViewModel.kt
Outdated
Show resolved
Hide resolved
|
Are the maestro test executed at all? If they are not part of any workflows they will never run. |
- Account for the port string as well.
|
Thanks for taking a look folks. @marcosholgado - I’ve added these to run at the same intervals as Privacy Tests. Do we think this is a reasonable choice? In addition to these I’ve added some fairly extensive unit tests for expected success and failure cases of basic auth extraction. Please let me know if you spot any cases that are missing. |
joshliebe
reviewed
Dec 5, 2023
joshliebe
reviewed
Dec 5, 2023
app/src/androidTest/java/com/duckduckgo/app/browser/BrowserTabViewModelTest.kt
Show resolved
Hide resolved
joshliebe
reviewed
Dec 5, 2023
joshliebe
reviewed
Dec 5, 2023
joshliebe
reviewed
Dec 5, 2023
joshliebe
requested changes
Dec 5, 2023
* Add error handling to stripBasicAuthFromUrl() and make private * Add tests for exception throwing cases * Remove 0_all.yaml and add onboarding step to each test individually
|
Thanks @joshliebe - I've made some changes as you requested and got the maestro tests passing: https://github.com/duckduckgo/Android/actions/runs/7126639716 |
joshliebe
reviewed
Dec 7, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Task/Issue URL: https://app.asana.com/0/0/1205916690837650/f
Description
The browser implementation of the address bar updating functionality is currently vulnerable to an Address Bar Spoofing vulnerability. In this PR I integrate all of our known address bar spoofing tests, including a fix for the basic auth address bar spoofing issues where someone can hide the domain portion of the address bar by prepending fake basic auth credentials to the domain.
In the fix, I simply strip the username/password fields from the address bar which forces the browser to prompt for username/password. This is consistent with our other browser implementations on macOS and iOS.
Steps to test this PR
Security Tests
maestro test .maestro/security_tests/0_all.yamlBasic Auth
Primary Questions: