search

Kunzisoft / KeePassDX

Lightweight vault and password manager for Android, KeePassDX allows editing encrypted data in a single file in KeePass format and fill in the forms in a secure way.
https://www.keepassdx.com/
GNU General Public License v3.0
4.28k stars 261 forks source link

Matching against domain goes too far #1820

Open cbiere opened 1 month ago

cbiere commented 1 month ago

When the setting "Subdomain search" is disabled, entries are suggested that match only the last part of the domain name.

To Reproduce

Steps to reproduce the behavior:

  1. Add an entry to the database with the URL https://box.com/
  2. Add an entry to the database with the URL https://dropbox.com/
  3. Browse to https://account.box.com/login
  4. Enter a email address as username
  5. Use autofill with KeePassDX and see that both dropbox and box are suggested, even though dropbox.com should clearly not match box.com and this is even on account.box.com.

Expected behavior

An entry with https://box.com might match any subdomain like example.box.com but not a domain that just has box.com at the end. While enabling the "Subdomain search" setting prevents this from happening, there should be no match because these domains are completely unrelated and it only benefits phishing.

KeePass Database

Irrelevant.

KeePassDX:

Android:

SuperITMan commented 1 month ago

Same issue here, the autofill provides wrong entries for the following examples :

cbiere commented 1 month ago

Same issue here, the autofill provides wrong entries for the following examples :

192.168.0.1: 192.168.0.10 entries 192.168.0.11 entries 192.168.0.1 entries

Yeah, this looks wrong and even more odd. I wonder if there is a specific logic for matching IP addresses to cause these results.

  • mydomain.com:

    • sub1.mydomain.com entries
    • sub2.mydomain.com entries
    • mydomain.com entries

This is okay if you don't have the option "Subdomain search" enabled. The idea behind this is presumably that many domains use the same credentials on different subdomains like www. or login., for example. The problem is that it also matches sub1mydomain.com which is not a sub-domain of mydomain at all.