Phishing/Malware site blocking on Brave iOS can be bypassed with trailing dot in hostname
Medium
B
Brave Software
Submitted None
Actions:
Reported by
nishimunea
Vulnerability Details
Technical details and impact analysis
## Summary:
Phishing/Malware site blocking feature on Brave iOS blocks navigation to the domains in [simple_malware.txt](https://github.com/brave/brave-ios/blob/821785db8fc71fd084a8a0b2600ff43ea7165ce9/Client/WebFilters/SafeBrowsing/Lists/simple_malware.txt).
But that logic doesn't care existence of a trailing dot in the hostname, so http://3e1.cn/ in the list is correctly blocked but [http://3e1.cn./](http://3e1.cn./) is not blocked.
Safe browsing in Brave for PC/Mac (Chromium based) can blocks both URLs, so Brave iOS should align with it.
## Products affected:
* Brave iOS nightly build
## Steps To Reproduce:
* Enable "Blocking Phishing and Malware" feature on Setting
* Open [http://3e1.cn./](http://3e1.cn./)
## Supporting Material/References:
* See attached demonstration movie file
## Impact
User is taken to the prohibited malware/phishing site with bypassing Brave Shield protection.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Bounty
$250.00
Submitted
Weakness
Violation of Secure Design Principles