URL spoofing is trivial using javascript: URLs. See attached test case. If you click on the link in fennec, it will show "google.com" in the URL bar and whatever content you please as the page.

Simpler version, the window.open/close thing was unnecessary and left over from the thing I was initially trying to do.

Ouch! Good you found this.

This patch limits the new behavior to http/https URLs.

Comment on attachment 8748588 [details] [diff] [review] 1269832-ToolbarDisplayLayout-http.patch Review of attachment 8748588 [details] [diff] [review]: ----------------------------------------------------------------- URL schemes are case insensitive, so you probably need to use startsWithIgnoreCase or manually do some case folding, unless the URL is already normalized at that point. But otherwise the patch looks ok to me, but I don't know the code well enough to know if you missed any spots.

(In reply to Kartikaya Gupta (email:kats@mozilla.com) from comment #4) > URL schemes are case insensitive, so you probably need to use > startsWithIgnoreCase or manually do some case folding, unless the URL is > already normalized at that point. Yeah, at this point we get the "clean" URL from Gecko. StringUtils as a more general purpose helper could ignore the case but I saw that other methods (stripScheme) don't do it, so I just followed.

Comment on attachment 8748588 [details] [diff] [review] 1269832-ToolbarDisplayLayout-http.patch Review of attachment 8748588 [details] [diff] [review]: ----------------------------------------------------------------- Good catch, this looks reasonable to me.

Let's make sure to uplift this to 47. I don't think we need to wait for security approval, since this isn't on release yet.

[Tracking Requested - why for this release]: bug related to feature in 47

https://hg.mozilla.org/integration/fx-team/rev/8fe0095972a5f19d2c078e218d44631c75a4fd7e Bug 1269832 - Only show base domain for http/https URLs. r=margaret,kats

Comment on attachment 8748588 [details] [diff] [review] 1269832-ToolbarDisplayLayout-http.patch Approval Request Comment [Feature/regressing bug #]: Shortened URL introduced in bug 1236431. [User impact if declined]: See comment 0: Arbitrary domain can be shown in URL bar using JavaScript. [Describe test coverage new/current, TreeHerder]: Local testing. [Risks and why]: Low - Showing full URL for non-http/https URLs. We already show the full URL on tablets. [String/UUID change made/needed]: -

Comment on attachment 8748588 [details] [diff] [review] 1269832-ToolbarDisplayLayout-http.patch Recent regression, Aurora48+, Beta47+

Verified as fixed on Firefox 47 Beta 6, latest Aurora and latest Nightly using the "spoof.html" test case