Addressable display_uri can show misleading hosts containing bidi and invisible characters

Impact

Addressable::IDNA.to_unicode decodes Punycode labels (labels beginning with xn--) that contain characters which change how text is displayed without being visible themselves. These include bidirectional controls such as U+202E RIGHT-TO-LEFT OVERRIDE and U+2066–U+2069, zero-width characters, and other invisible format characters. Addressable::URI#display_uri uses to_unicode, so it can display a host whose characters appear reordered or which looks identical to a different host. For example, the host of http://xn--abcmoc-dm0c.com/ is displayed as abc, U+202E, moc.com, and the override makes everything after abc render right to left.

Parsing, host, normalized_host and any connection made from the URI are not affected. Only the displayed form is. Applications that show display_uri to users (link previews, chat and email clients, admin interfaces) can be used to make a malicious domain look like a trusted one.

• In the pure-Ruby IDNA implementation, all such characters are decoded, including those that IDNA's nameprep profile prohibits.
• In the native IDNA implementation, used when libidn and the idn-ruby gem are installed, libidn rejects most of them, but not characters added to Unicode after version 3.2, such as U+061C and U+2066–U+2069.

Affected Versions

The pure-Ruby IDNA implementation is affected in Addressable >= 2.0.0. The native IDNA implementation is affected in Addressable >= 2.5.2, when to_unicode began accepting characters unassigned in Unicode 3.2. It is fixed in 2.9.1 for both implementations, where such labels are returned unchanged.

Workarounds

• Install libidn and the idn-ruby gem, so that Addressable uses the native IDNA implementation. This reduces the affected characters to those added since Unicode 3.2.
• Check displayed hosts for bidirectional and invisible characters (e.g., /[\p{Cc}\p{Cf}\p{Default_Ignorable_Code_Point}]/) and fall back to normalized_host when one is present.

Credits

Reported by @andrewstellman.

For more information

If there are any questions or comments about this advisory:

• Open an issue