commit 9b292a093a025d41b429bc8254744834f2eee029
author Mustafa Emre Acer <meacer@chromium.org> Thu Apr 21 22:17:22 2022
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> Thu Apr 21 22:17:22 2022
tree bfc196b2aad2699d8153f9fc02d3d4feb82a192f
parent 40356715bb1f9cdcb8390228c9c5ebb42e969224

Lookalikes: Compute hostname variants with and without diacritics

Presently, we generate supplemental hostnames from an input hostname
after removing the hostname's diacritics. This allows us to normalize
a hostname so that attackers can't evade lookalike protections by adding
diacritics.

However, some characters in a hostname can become confusable with other
characters when they are added diacritics. For example,  LATIN SMALL
LETTER L normally not confusable with "t", but LATIN SMALL LETTER L WITH
STROKE (ł) is on some fonts and platforms.

The solution for this would be to add a multiple skeleton mapping for ł
so that the generated supplemental hostnames would have both "l" and "t"
variants in them. This currently doesn't work though, because of the
diacritic removal mentioned above, and a hostname like łest[.]com is
passed as lest[.]com to supplemental hostname generation.

This CL runs the supplemental hostname generation over both the
diacritic and non-diacritic versions of the hostname. This allows us to
generate both lest[.]com and test[.]com as supplemental hostnames.

As a result of this change, we'll be able to prevent additional spoofs
that use characters with diacritics that are confusable with other
characters.

Bug: 1250993
Change-Id: I592602281bffd7f75fc97f32280a46ffcf8fd3ed
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3598360
Reviewed-by: Joe DeBlasio <jdeblasio@chromium.org>
Commit-Queue: Mustafa Emre Acer <meacer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#994949}