A URL spoofing bug in Firefox, reported 2 years ago and it's still working

update: I updated to 78.0.2 and it seems to be fixed. It's not in the release notes though, https://www.mozilla.org/en-US/firefox/78.0.2/releasenotes/