diff options
Diffstat (limited to 'docs/BACKLOG.md')
| -rw-r--r-- | docs/BACKLOG.md | 29 |
1 files changed, 29 insertions, 0 deletions
diff --git a/docs/BACKLOG.md b/docs/BACKLOG.md index 25793e1..79c0ab1 100644 --- a/docs/BACKLOG.md +++ b/docs/BACKLOG.md @@ -6,6 +6,7 @@ number and gains a status rather than being renumbered. | # | Item | Size | Status | |---|------|------|--------| | 1 | Skip boilerplate namespace URLs | XS | open | +| 2 | An IDN indicator resolves to no contact | S | open | ## 1. Skip boilerplate namespace URLs @@ -38,3 +39,31 @@ skip-list is a thing an attacker knows will not be reported. If it is built, the skipped URLs should still be visible somewhere during review rather than silently dropped, on the same reasoning that makes `suspect_path_segments` flag rather than redact. + +## 2. An IDN indicator resolves to no contact + +**Observed.** `contacts.is_queryable()` refuses any non-ASCII value, so a +phishing domain in an internationalised name is recorded as `unusable` with the +reason "not ASCII, and we do not guess at an IDN encoding", and no registry is +asked. The `ponytail:` comment on that function names this as the ceiling it +accepted. + +**Cause.** Deliberate, not a defect. Converting a name to punycode means +choosing an encoding for attacker-supplied text, and a wrong choice sends a +different name than the one in the message to a registry, which is a disclosure +made about the wrong party. Refusing keeps the value in front of the user +instead. + +**Approach.** `value.encode("idna")` is the obvious move and is not enough on +its own: it normalises, so the name queried may differ from the name written in +the message, and the manifest must record BOTH, the way `query_domain` already +records `queried` separately when the label walk shortens a host. The refusal +reason already distinguishes non-ASCII from illegal, so the user-facing half +exists. + +**Constraints.** Not a leak: the failure direction is asking nobody, which is +safe. Weigh against a real argument for leaving it: a homograph name is exactly +where the attacker wants the tool to normalise on their behalf, and a +consultant chasing one indicator by hand is a smaller cost than a query made +about a name the user never saw. Wait for a real IDN indicator in a sweep before +building it. |