-
Notifications
You must be signed in to change notification settings - Fork 3.5k
Description
Chromium maintains a tool called Trickuri (pronounced "trickery") for testing how web browsers display URLs (https://github.com/chromium/trickuri) and I'm wondering if there would be interest in having this tool be part of web-platform-tests.
Trickuri is a proxy that serves various unusual URLs (e.g., URLs with super long domains, domains with RTL labels, etc.). The intended usage of Truckuri is to load each unusual URL in a web browser and check how it is displayed in the address bar, and then, on each unusual URL, load a test case for each web platform feature that triggers a browser UI that displays a URL. For example, there's a test case that displays an alert() dialog (to see how the page origin is displayed in the alert), a test case that displays a Credential Manager dialog, etc. The Trickuri user is intended to walk through these test cases and check that each of these web platform features handles each unusual URL properly. Common bugs include eliding URLs improperly (displaying https://victim.com.evil.com as https://victim.com...), not decoding IDNs properly, displaying URLs in a font that lends itself to spoofing (examp1e.com looks very similar to example.com), etc. Unfortunately, the testing is fully manual as we can't really automatically verify that URLs are displayed correctly, but we still find it useful for systematically reviewing how various browser UIs handle unusual URLs.
Would there be interest in having Trickuri be part of web-platform-tests? I'm thinking that this could be beneficial in two ways: 1.) It would be beneficial for browsers to collaborate on the set of unusual URLs that their UIs should be tested against (I'm sure our current set of unusual URLs is not comprehensive), 2.) It would help ensure that new web platform features which display URLs in browser UI get thoroughly tested for common URL display bugs. We could try to make sure that every relevant web platform feature has a test case in Trickuri, but it would be far preferable to integrate into the spec development process as part of web-platform-tests.