Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionIn multipart/x-mixed-replace responses, <code>Content-Disposition: attachment</code> in the response header was not respected and did not force a download, which could allow XSS attacks.
ComponentNetworking
Bug ClassLogic Error
Tracker1914521
Fix commitb24f93853b53 (firefox) +17/-5
CISA KEVNot listed
CreditedMasato Kinugawa
Disclosed2024-10-29

Files Changed

  • netwerk/streamconv/converters/nsMultiMixedConv.cpp
  • netwerk/streamconv/converters/nsMultiMixedConv.h
diff --git a/netwerk/streamconv/converters/nsMultiMixedConv.cpp b/netwerk/streamconv/converters/nsMultiMixedConv.cpp
index e1ccfda303c..5c4ea72a86e 100644
--- a/netwerk/streamconv/converters/nsMultiMixedConv.cpp
+++ b/netwerk/streamconv/converters/nsMultiMixedConv.cpp
@@ -474,6 +474,12 @@ nsMultiMixedConv::OnStartRequest(nsIRequest* request) {
     if (NS_SUCCEEDED(rv)) {
       mRootContentSecurityPolicy = csp;
     }
+    nsCString contentDisposition;
+    rv = httpChannel->GetResponseHeader("content-disposition"_ns,
+                                        contentDisposition);
+    if (NS_SUCCEEDED(rv)) {
+      mRootContentDisposition = contentDisposition;
+    }
   } else {
     // try asking the channel directly
     rv = mChannel->GetContentType(contentType);
@@ -850,7 +856,11 @@ nsresult nsMultiMixedConv::SendStart() {
   rv = mPartChannel->SetContentLength(mContentLength);
   if (NS_FAILED(rv)) return rv;
 
-  mPartChannel->SetContentDisposition(mContentDisposition);
+  if (!mRootContentDisposition.IsEmpty()) {
+    mPartChannel->SetContentDisposition(mRootContentDisposition);
+  } else {
+    mPartChannel->SetContentDisposition(mContentDisposition);
+  }
 
   // Each part of a multipart/replace response can be used
   // for the top level document.  We must inform upper layers
diff --git a/netwerk/streamconv/converters/nsMultiMixedConv.h b/netwerk/streamconv/converters/nsMultiMixedConv.h
index 4f773a69eb6..694150d69c2 100644
--- a/netwerk/streamconv/converters/nsMultiMixedConv.h
+++ b/netwerk/streamconv/converters/nsMultiMixedConv.h
@@ -151,15 +151,17 @@ class nsMultiMixedConv : public nsIStreamConverter {
   nsCOMPtr<nsIStreamListener> mFinalListener;  // this guy gets the converted
                                                // data via his OnDataAvailable()
 
-  nsCOMPtr<nsIChannel>
-      mChannel;  // The channel as we get in in OnStartRequest call
-  RefPtr<nsPartChannel> mPartChannel;  // the channel for the given part we're
-                                       // processing. one channel per part.
+  // The channel as we get it in OnStartRequest call
+  nsCOMPtr<nsIChannel> mChannel;
+  // the channel for the given part we're
+  // processing. one channel per part.
+  RefPtr<nsPartChannel> mPartChannel;
   nsCOMPtr<nsISupports> mContext;
   nsCString mContentType;
   nsCString mContentDisposition;
   nsCString mContentSecurityPolicy;
   nsCString mRootContentSecurityPolicy;
+  nsCString mRootContentDisposition;
   uint64_t mContentLength{UINT64_MAX};
   uint64_t mTotalSent{0};
 
Loading diff…