RESOLVED INVALID 15047
"%5C" is mysteriously stripped from hostnames without being rejected 
https://bugs.webkit.org/show_bug.cgi?id=15047
Summary "%5C" is mysteriously stripped from hostnames without being rejected
Brett Wilson (Google)
Reported 2007-08-22 10:53:44 PDT
Safari seems to strip "%5c" from host names, which could lead to possible phishing problems. This appears to happen in the network stack you use, as KURL seems to not touch it. The issue is that some applications might choose to display this URL as unescaped: http://www.wellsfargo.com\login.evil.ru But when sent through Safari as http://www.wellsfargo.com%5Clogin.evil.ru It will be sent over the network as http://www.wellsfargo.comlogin.evil.ru
Attachments
Add attachment proposed patch, testcase, etc.
David Kilzer (:ddkilzer)
Comment 1 2007-08-22 21:47:28 PDT
<rdar://problem/5431486>
Mark Rowe (bdash)
Comment 2 2007-08-22 22:35:25 PDT
This bug is in a framework below WebKit, so the bug will be tracked via <rdar://problem/5431486>. Thanks for the report. Closing as INVALID as this is not a WebKit-level bug.
Note You need to log in before you can comment on or make changes to this bug.