Safari tests for Domain Names and phishing

Safari tests for IDNs support

Safari 2.0.1
- Supports IDN.
- Uses a whitelist of scripts for domaine names to be displayed natively. By default, Latin lookalike scripts (Cherokee, Cyrillic, and Greek) are excluded from this list.
- Otherwise, domain names using characters from scripts not in the whitelist, are displayed in punycode. As an example, in pаypal.com if the first a is the Cyrillic letter "а", then it would be displayed as xn--pypal-4ve.com.
- The whitelist is initialized with (Arabic, Armenian, Bopomofo, Canadian_Aboriginal, Devanagari, Deseret, Gujarati, Gurmukhi, Hangul, Han, Hebrew, Hiragana, Katakana_Or_Hiragana, Katakana, Latin, Tamil, Thai, Yi )
- Adding Cherokee, Cyrillic, and Greek will enable Safari to display all scripts, and will expose you to known IDN vulnerabilities.
- If whitelist of scripts is empty, all non-ASCII characters will be displayed in their Punycode equivalents.
- This list is user editable at: /System/Library/Frameworks/WebKit.framework/Versions/A/Resources/IDNScriptWhiteList.txt
- @@...
- see http://docs.info.apple.com/article.html?artnum=301116

Note: In Safari to type (or copy/paste) a URI in the address zone is not like to click on a link. For example, clicking on a cyrillic link cause it to display fine, while entering the link directly cause it to display in punycode. So it's important to enforce the rule of using native text for link, but punycode for href attribute.

Examples:

URL	Notes	Safari 2.0.x	IE 7	Firefox 2.x	Opera 9.1
www.þorn.is	'þ' is Latin	www.þorn.is Displays fine, Latin is in whitelist. www.xn--orn-ooa.is if whitelist is empty.	www.þorn.is Displays fine if any of your browser language preferences use the letter 'þ'.	www.þorn.is Firefox supports .is IDNs with these characters.	www.þorn.is Opera trusts IDNs in the .is TLD
bäcker.com	'ä' is Latin	bäcker.com Displays fine, Latin is in whitelist. http://xn--bcker-gra.com/ if whitelist empty.	bäcker.com Displays fine if any of your browser language preferences use the letter 'ä'.	xn--bcker-gra.com Firefox does not support .com IDNs.	bäcker.com Opera trusts IDNs in the .com domain
путин.museum	Cyrillic	xn--h1akeme.museum Ciryllic is originally excluded from whitelist, or white list empty. путин.museum if added to whitelist	путин.museum Displays properly if language preferences include Russian	путин.museum Firefox has supports .museum top level domain	путин.museum Opera trusts the .museum top level domain
I♥NY.museum		I♥NY.museum Display fine. '♥' is not part of any (excluded) language/script xn--h1akeme.museum if whitelist empty.	xn--iny-zx5a.museum '♥' is not part of any language	i♥ny.museum Firefox supports .museum IDNs with these characters.	i♥ny.museum Opera trusts the .museum top level domain
ibm.com⁄foo.museum	URL uses the 'fraction-slash' (U+2044)	ibm.com⁄foo.museum Display fine. Fraction slash is not part of any (excluded) language/script ibm.xn--comfoo-rq0c.museum if whitelist empty	ibm.xn--comfoo-rq0c.museum Fraction slash is not part of any language	ibm.xn--comfoo-rq0c.museum Fraction-slash is treated suspiciously by Firefox.	opera:illegal-url-1 Opera does not allow the fraction-slash character in URLs at all.
pаypal.museum	The first 'a' in the IDN is Cyrillic	xn--pypal-4ve.museum The first 'a' is Cyrillic, excluded by default from whitelist, or whitelist empty. pаypal.museum if Cyrillic is added to whitelist.	xn--pypal-4ve.museum IE7 does not permit the mixing of ASCII and Cyrillic characters	pаypal.museum Firefox supports .museum top IDNs with these characters.	pаypal.museum Opera trusts the .museum top level domain
ップã.jp	Mixes two non ASCII scripts	ップã.jp Display fine, both scripts in whitelist. xn--3ca526vzba.jp if whitelist empty.	xn--3ca526vzba.jp Mixed scripts viewed as suspicious.	ップã.jp Firefox supports .jp IDNs with these characters.	ップã.jp Opera trusts the .jp top level domain
ップã.co.uk	Mixes two non ASCII scripts	ップã.co.uk& amp; nbsp; Display fine, both scripts in whitelist. xn--3ca526vzba.co.uk if whitelist empty.	xn--3ca526vzba.co.uk Mixed scripts viewed as suspicious.	xn--3ca526vzba.co.uk Firefox does not support .uk IDNs.	ップã.co.uk Opera trusts the .uk top level domain
ップãп.jp	Mixes three non ASCII scripts	xn--3ca43o0y0dkca.jp One script is Cyrillic, excluded by default from whitelis, or whitelist empty. ップãп.jp if Cyrillic is added to whitelist.	xn--3ca43o0y0dkca.jp Mixed scripts viewed as suspicious.	ップãп.jp Firefox supports .jp IDNs with these characters.	ップãп.jp Opera trusts the .jp top level domain
ップãп.co.uk	Mixes three non ASCII scripts	xn--3ca43o0y0dkca.co.uk One script is Cyrillic, excluded by default from whitelis, or whitelist empty. ップãп.co.uk if Cyrillic is added to whitelist.	xn--3ca43o0y0dkca.co.uk Mixed scripts viewed as suspicious.	xn--3ca43o0y0dkca.co.uk Firefox does not support .uk IDNs.	xn--3ca43o0y0dkca.co.uk Opera does not trust mixing Kana, Latin and Cyrillic characters in the .uk TLD