Homograph fix Bypass

How it was found

Hello Hackerone! I have possibly found a way to bypass your current Homograph Attack Fix.

Lets look at two HACKERONE Redirect URL: CASE 1: https://hackerone.com/redirect?signature=829727b4188c43dcf394fd841fd19a8b7f391bd1&url=https%3A%2F%2Fwww.yelp.com%2F

{Got the above link generated by posting "https://www.yelp.com/" on Hackerone Platform}

If I change even a single character in the URL parameter above the link gets Invalid. We get "Something went wrong" Response. For Example (try changing yelp.com to yelk.com) https://hackerone.com/redirect?signature=829727b4188c43dcf394fd841fd19a8b7f391bd1&url=https%3A%2F%2Fwww.yelk.com%2F

Now Lets look at a sample Hackerone Redirect URL of a IDN HOMOGRAPH Link:

CASE 2:

https://hackerone.com/redirect?signature=e021a53caee6e288347ad14e95648ba6d8fb53cb&url=https%3A%2F%2Fwww.xn--elp-cfd.com%2F

{Got this link generated by posting https://www.уelp.com/ on hackerone platform. NOTE: Here "уelp.com" is actually an IDN and its punycode version is "xn--elp-cfd.com" & that's why it automatically got converted by Hackerone to its punycode representation in the above URL*}

Now lets replace "xn--elp-cfd.com" to the original IDN i.e "уelp.com" in the above URL.

As Infered from CASE 1, Upon changing any character in the URL parameter, Ideally we should get an error and the link should become invalid.

But,that is not the case here when we are dealing with IDN Links. The link is still valid even after changing value of the URL parameter-From Punycode version to IDN.

Have a look at the changed URL here: https://hackerone.com/redirect?signature=e021a53caee6e288347ad14e95648ba6d8fb53cb&url=https%3A%2F%2Fwww.%D1%83elp.com%2F

NOTE: Till Now the External Link Warning Page Displays : "https://www.xn--elp-cfd.com/"

Now, IF we Add extra "//" after "https:%3A%2F%2F" in the above url we get the following URL:

https://hackerone.com/redirect?signature=e021a53caee6e288347ad14e95648ba6d8fb53cb&url=https%3A%2F%2F//www.%D1%83elp.com%2F

***You can see that the above link displays "https:///www.yelp.com/" but actually redirects us to "https://www.xn--elp-cfd.com/" ***

And thus the current fix for Homograph attack seems to be bypassed. Mobile phone users are more likely to be affected by the above vulnerability.