diff options
| author | Michael Brüning <michael.bruning@qt.io> | 2019-12-03 19:13:48 +0100 |
|---|---|---|
| committer | Michael Brüning <michael.bruning@qt.io> | 2019-12-05 13:24:00 +0000 |
| commit | 4f7d6ea2e7961a0b688202f65194915d4d1af12f (patch) | |
| tree | 6d2d1af4baa4c835c1ea8ac3b9c937f372ec2d0c | |
| parent | a18a01d6531a06879e81f2be50b5090bb0b96c38 (diff) | |
| download | qtwebengine-chromium-4f7d6ea2e7961a0b688202f65194915d4d1af12f.tar.gz | |
[Backport] CVE-2019-13659
Manual backport
Disallow combining Kana voiced sound marks (U+3099 and U+309A) in IDN
This CL disallows U+3099 and U+309A characters from domain names. Any IDN
containing these characters will be displayed as punycode.
As of July 2019, these characters are not used in any popular domains.
Bug: 868846
Commit-Queue: Mustafa Emre Acer <meacer@chromium.org>
Reviewed-by: Jüri Valdmann <juri.valdmann@qt.io>
Change-Id: I0d10343ad9b4a0cafa6f4739162a5095a8a80e16
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
| -rw-r--r-- | chromium/components/url_formatter/url_formatter.cc | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/chromium/components/url_formatter/url_formatter.cc b/chromium/components/url_formatter/url_formatter.cc index ca252040a30..8a9c2b95310 100644 --- a/chromium/components/url_formatter/url_formatter.cc +++ b/chromium/components/url_formatter/url_formatter.cc @@ -415,6 +415,7 @@ bool IDNSpoofChecker::Check(base::StringPiece16 label, bool is_tld_ascii) { // - Disallow combining diacritical mark (U+0300-U+0339) after a non-LGC // character. Other combining diacritical marks are not in the allowed // character set. + // - Disallow combining Kana voiced sound marks. // - Disallow U+0307 (dot above) after 'i', 'j', 'l' or dotless i (U+0131). // Dotless j (U+0237) is not in the allowed set to begin with. dangerous_pattern = new icu::RegexMatcher( @@ -428,6 +429,7 @@ bool IDNSpoofChecker::Check(base::StringPiece16 label, bool is_tld_ascii) { "^[\\p{scx=hira}]+[\\u30d8-\\u30da][\\p{scx=hira}]+$|" "[a-z]\\u30fb|\\u30fb[a-z]|" "[^\\p{scx=latn}\\p{scx=grek}\\p{scx=cyrl}][\\u0300-\\u0339]|" + "\\u3099|\\u309A|" "[ijl\\u0131]\\u0307", -1, US_INV), 0, status); |