[hackerone] webtorrent redirect

[diracdeltas]

https://hackerone.com/reports/2139022 credit xiaoyinl

[LaurenWags]

@fallaciousreasoning could we get a test plan for this one?

Marking as QA/Blocked for now 👍🏻

[diracdeltas]

@LaurenWags i think it's ok to share the QA plan here since the risk (which is just phishing) is pretty low

1. Enable webtorrent
2. Go to chrome-extension://lgjmpdmojkpocjcopdikifhejkkjglho/extension/brave_webtorrent.html?https://www.microsoft.com/en-us/OperatingSystem/windows/updates/user/warnings/this/appears/to/be/a/legit/microsoft/user/warning/a/long/url/path/is/needed/so/that/users/do/not/see/the/message/is/in/url/itself/Warning:Call+1-206-555-0190!Right!Now!Your!Computer!Is!Very!Outdated!!!--@Microsoft--You!Must!Call!Us!Right!Now!Otherwise!Hackers!Will!Control!Your!Computer.torrent
3. Make sure you see webtorrent: at the start of the URL in the url bar

[LaurenWags]

that's great, thanks @diracdeltas 👍🏻

[fallaciousreasoning]

Sorry @LaurenWags - I updated the PR with a test plan (it's basically the same as @diracdeltas though)

[LaurenWags]

Verified with

Brave | 1.60.81 Chromium: 118.0.5993.54 (Official Build) beta (x86_64)
-- | --
Revision | 1efb3f333eb41cc34af46ca31fb33c30e0afbfae
OS | macOS Version 13.6 (Build 22G120)

Encountered #33524 when using dark theme, so used light theme to verify this issue.

Scenario 1:

Verified test plan from brave/brave-core#20062 (comment).
Confirmed webtorrent: is the prefix for the URL when loading a .torrent file.
Confirmed magnet: is the prefix for the URL when loading a .magnet file per comments below.

Torrent	Magnet

Scenario 2:
Verified test plan from #32856 (comment).
Reproduced the issue with 1.58.137.
Confirmed webtorrent: was prefix in URL when using STR and 1.60.81.

1.58.137	1.60.81

[LaurenWags]

@fallaciousreasoning when loading a magnet URL from https://webtorrent.io/free-torrents per brave/brave-core#20062 (comment), the prefix in the URL bar isn't webtorrent: it's magnet: which matches 1.58.137 (current release version).

Should it have been changed to webtorrent: with this issue?

1.58.137	1.60.81

[fallaciousreasoning]

No that's fine. Sorry, my bad :)

[MadhaviSeelam]

Verification PASSED using

Brave | 1.60.88 Chromium: 118.0.5993.70 (Official Build) beta (64-bit)
-- | --
Revision | ff9150ac5dd9934a7f431ddf478ad3e45ae68546
OS | Windows 11 Version 22H2 (Build 22621.2428)

Encountered #33524 when using dark theme, so used light theme to verify this issue.

Scenario 1:

• Verified test plan from Prefix url with webtorrent: to make it more obvious the origin is different brave-core#20062 (comment).
• Confirmed webtorrent: is the prefix for the URL when loading a .torrent file.
• Confirmed magnet: is the prefix for the URL when loading a .magnet file per comments below.

Torrent	Magnet

Scenario 2:

• Verified test plan from [hackerone] webtorrent redirect #32856 (comment).
• Reproduced the issue with 1.59.117.
• Confirmed webtorrent: was prefix in URL when using STR and 1.60.88.

1.59.117	1.60.88

[btlechowski]

Verified with

Brave	1.60.102 Chromium: 118.0.5993.96 (Official Build) beta (64-bit)
Revision	3598a9fc6b7752181feb25caa131bc386d6d054c
OS	Linux

Encountered #33524 when using dark theme, so used light theme to verify this issue.

Scenario 1:

Verified test plan from brave/brave-core#20062 (comment).
Confirmed webtorrent: is the prefix for the URL when loading a .torrent file.
Confirmed magnet: is the prefix for the URL when loading a .magnet file per comments below.

Torrent	Magnet

Scenario 2:
Verified test plan from #32856 (comment).
Reproduced the issue with 1.58.137.
Confirmed webtorrent: was prefix in URL when using STR and 1.60.x

1.58.137	1.60.x