Firefox · Core
CVE-2025-3035
Logic Error in Core
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
add_taskbrowser/components/genai/tests/browser/browser_chat_shortcuts.js |
modified |
Files Changed
browser/components/genai/GenAI.sys.mjsbrowser/components/genai/tests/browser/browser_chat_shortcuts.js
Patch
diff --git a/browser/components/genai/GenAI.sys.mjs b/browser/components/genai/GenAI.sys.mjs
index ab4b461aab5..2cd404595e7 100644
--- a/browser/components/genai/GenAI.sys.mjs
+++ b/browser/components/genai/GenAI.sys.mjs
@@ -435,6 +435,8 @@ export const GenAI = {
// Hide shortcuts and panel
const hide = () => {
aiActionButton.setAttribute("type", buttonDefaultState);
+ aiActionButton.removeEventListener("mouseover", aiActionButton.listener);
+ aiActionButton.listener = null;
chatShortcutsOptionsPanel.hidePopup();
selectionShortcutActionPanel.hidePopup();
};
@@ -486,7 +488,7 @@ export const GenAI = {
aiActionButton.setAttribute("type", buttonDefaultState);
// Detect hover to build and open the popup
- aiActionButton.addEventListener("mouseover", async () => {
+ aiActionButton.listener = async () => {
if (aiActionButton.hasAttribute("active")) {
return;
}
@@ -592,7 +594,8 @@ export const GenAI = {
provider: this.getProviderId(),
warning: showWarning,
});
- });
+ };
+ aiActionButton.addEventListener("mouseover", aiActionButton.listener);
// Save the latest selection so it can be used by popup
aiActionButton.data = data;
diff --git a/browser/components/genai/tests/browser/browser_chat_shortcuts.js b/browser/components/genai/tests/browser/browser_chat_shortcuts.js
index eb7f6028685..0fb240bc56d 100644
--- a/browser/components/genai/tests/browser/browser_chat_shortcuts.js
+++ b/browser/components/genai/tests/browser/browser_chat_shortcuts.js
@@ -107,6 +107,44 @@ add_task(async function test_show_shortcuts() {
});
});
+/**
+ * Check that shortcuts shown on second tab
+ */
+add_task(async function test_show_shortcuts_second_tab() {
+ // NB: this test runs after test_show_shortcuts, which showed shortcuts
+ await BrowserTestUtils.withNewTab(
+ "data:text/html,<title>second</title>page",
+ async browser => {
+ await SimpleTest.promiseFocus(browser);
+ const selectPromise = SpecialPowers.spawn(browser, [], () => {
+ ContentTaskUtils.waitForCondition(() => content.getSelection());
+ });
+ goDoCommand("cmd_selectAll");
+ await selectPromise;
+ BrowserTestUtils.synthesizeMouseAtCenter(
+ browser,
+ { type: "mouseup" },
+ browser
+ );
+
+ await TestUtils.waitForCondition(() => {
+ const panelElement = document.getElementById(
+ "selection-shortcut-action-panel"
+ );
+ return panelElement.getAttribute("panelopen") === "true";
+ });
+ const sandbox = sinon.createSandbox();
+ const stub = sandbox.stub(GenAI, "addAskChatItems");
+
+ const shortcuts = document.querySelector("#ai-action-button");
+ EventUtils.sendMouseEvent({ type: "mouseover" }, shortcuts);
+
+ Assert.equal(stub.callCount, 1, "Shortcuts added on select");
+ Assert.equal(stub.firstCall.args[0], browser, "Got correct browser");
+ }
+ );
+});
+
/**
* Check that the warning label is shown when too much text is selected
*/
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/browser/components/genai/tests/browser/browser_chat_shortcuts.js b/browser/components/genai/tests/browser/browser_chat_shortcuts.js
index eb7f6028685..0fb240bc56d 100644
--- a/browser/components/genai/tests/browser/browser_chat_shortcuts.js
+++ b/browser/components/genai/tests/browser/browser_chat_shortcuts.js
@@ -107,6 +107,44 @@ add_task(async function test_show_shortcuts() {
});
});
+/**
+ * Check that shortcuts shown on second tab
+ */
+add_task(async function test_show_shortcuts_second_tab() {
+ // NB: this test runs after test_show_shortcuts, which showed shortcuts
+ await BrowserTestUtils.withNewTab(
+ "data:text/html,<title>second</title>page",
+ async browser => {
+ await SimpleTest.promiseFocus(browser);
+ const selectPromise = SpecialPowers.spawn(browser, [], () => {
+ ContentTaskUtils.waitForCondition(() => content.getSelection());
+ });
+ goDoCommand("cmd_selectAll");
+ await selectPromise;
+ BrowserTestUtils.synthesizeMouseAtCenter(
+ browser,
+ { type: "mouseup" },
+ browser
+ );
+
+ await TestUtils.waitForCondition(() => {
+ const panelElement = document.getElementById(
+ "selection-shortcut-action-panel"
+ );
+ return panelElement.getAttribute("panelopen") === "true";
+ });
+ const sandbox = sinon.createSandbox();
+ const stub = sandbox.stub(GenAI, "addAskChatItems");
+
+ const shortcuts = document.querySelector("#ai-action-button");
+ EventUtils.sendMouseEvent({ type: "mouseover" }, shortcuts);
+
+ Assert.equal(stub.callCount, 1, "Shortcuts added on select");
+ Assert.equal(stub.firstCall.args[0], browser, "Got correct browser");
+ }
+ );
+});
+
/**
* Check that the warning label is shown when too much text is selected
*/
Loading diff…
References
On This Page