From 2d935300f6b414743833280e4221e2048090ac30 Mon Sep 17 00:00:00 2001
From: mohammed adib <adib@bugqore.com>
Date: Tue, 14 Jul 2026 11:01:03 +0530
Subject: [PATCH] escape dot in trusted referrer host regex

---
 src/impression.js            | 2 +-
 test/unit/test-impression.js | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/impression.js b/src/impression.js
index ee82f1c6d3c1..9e71a06dd60e 100644
--- a/src/impression.js
+++ b/src/impression.js
@@ -31,7 +31,7 @@ const TRUSTED_REFERRER_HOSTS = [
    * Twitter's link wrapper domains:
    * - t.co
    */
-  /^t.co$/,
+  /^t\.co$/,
 ];
 
 /**
diff --git a/test/unit/test-impression.js b/test/unit/test-impression.js
index 3fc85676d859..16e1bd24502f 100644
--- a/test/unit/test-impression.js
+++ b/test/unit/test-impression.js
@@ -481,5 +481,11 @@ describes.realWin('impression', {amp: true}, (env) => {
       test('https://t.com/asdf', false);
       test('https://t.cn/asdf', false);
     });
+
+    it('should not trust lookalike hosts that match an unescaped dot', () => {
+      test('https://taco/asdf', false);
+      test('https://txco/asdf', false);
+      test('https://t-co/asdf', false);
+    });
   });
 });