Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: sanitize urls before displaying warning dialog [WPB-4782] #2320

Merged
merged 5 commits into from
Oct 12, 2023

Conversation

gongracr
Copy link
Contributor

@gongracr gongracr commented Oct 12, 2023

BugWPB-4782 [Android] Punycode Links popup show the wrong URL


PR Submission Checklist for internal contributors

  • The PR Title

    • conforms to the style of semantic commits messages¹ supported in Wire's Github Workflow²
    • contains a reference JIRA issue number like SQPIT-764
    • answers the question: If merged, this PR will: ... ³
  • The PR Description

    • is free of optional paragraphs and you have filled the relevant parts to the best of your ability

What's new in this PR?

Issues

Some users might try to send links on chats with hidden punycodes camouflaged as normal links. Therefore, we need to sanitize all urls before displaying the warning dialog to users to make sure they are aware where they will be navigating to.

Solutions

Use the IDN.toASCII() method to transform to ASCII any malicious characters.

Attachments (Optional)

Captura de pantalla 2023-10-12 a las 14 05 05
References
  1. https://sparkbox.com/foundry/semantic_commit_messages
  2. https://github.com/wireapp/.github#usage
  3. E.g. feat(conversation-list): Sort conversations by most emojis in the title #SQPIT-764.

@gongracr gongracr requested review from a team, typfel, yamilmedina, alexandreferris, borichellow and ohassine and removed request for a team October 12, 2023 12:15
@github-actions
Copy link
Contributor

github-actions bot commented Oct 12, 2023

Test Results

644 tests  ±0   644 ✔️ ±0   7m 41s ⏱️ - 1m 31s
  93 suites ±0       0 💤 ±0 
  93 files   ±0       0 ±0 

Results for commit 505ac0d. ± Comparison against base commit 052384e.

♻️ This comment has been updated with latest results.

@AndroidBob
Copy link
Collaborator

Build 1260 failed.

Copy link
Contributor

@yamilmedina yamilmedina left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice extra layer of security here 👀

app/src/main/kotlin/com/wire/android/util/UriUtil.kt Outdated Show resolved Hide resolved
@AndroidBob
Copy link
Collaborator

Build 1267 failed.

@AndroidBob
Copy link
Collaborator

Build 1271 failed.

@gongracr gongracr added this pull request to the merge queue Oct 12, 2023
@github-actions
Copy link
Contributor

APKs built during tests are available here. Scroll down to Artifacts!

Merged via the queue into develop with commit 594aa8a Oct 12, 2023
13 of 14 checks passed
@gongracr gongracr deleted the fix/sanitize_punycode branch October 12, 2023 17:10
@AndroidBob
Copy link
Collaborator

Build 1276 succeeded.

The build produced the following APK's:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants