PatchGap
Firefox · Networking

CVE-2025-5266

Cross Origin in Networking
Medium firefox Cross Origin 🔧 Commit mapped

Overview

Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionScript elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks.
ComponentNetworking
Bug ClassCross Origin
Tracker1965628
Fix commit8065bd80ce5a (firefox) +3/-27
CISA KEVNot listed
CreditedJakub Szymsza
Disclosed2025-05-27

Changed Functions

FunctionChangeNotes
if
netwerk/protocol/http/OpaqueResponseUtils.cpp
 modified

Files Changed

  • netwerk/protocol/http/OpaqueResponseUtils.cpp
  • testing/web-platform/meta/fetch/orb/tentative/known-mime-type.sub.any.js.ini

Patch

view commit
diff --git a/netwerk/protocol/http/OpaqueResponseUtils.cpp b/netwerk/protocol/http/OpaqueResponseUtils.cpp
index 94969648a2c..44fb272a115 100644
--- a/netwerk/protocol/http/OpaqueResponseUtils.cpp
+++ b/netwerk/protocol/http/OpaqueResponseUtils.cpp
@@ -559,8 +559,7 @@ nsresult OpaqueResponseBlocker::ValidateJavaScript(HttpBaseChannel* aChannel,
             self->AllowResponse();
             break;
           case OpaqueResponse::Block:
-            // We'll filter the data out later
-            self->AllowResponse();
+            self->BlockResponse(channel, NS_ERROR_FAILURE);
             break;
           default:
             MOZ_ASSERT_UNREACHABLE(
@@ -620,19 +619,11 @@ void OpaqueResponseBlocker::FilterResponse() {
 
 void OpaqueResponseBlocker::ResolveAndProcessData(
     HttpBaseChannel* aChannel, bool aAllowed, Maybe<ipc::Shmem>& aSharedData) {
-  if (!aAllowed) {
-    // OpaqueResponseFilter allows us to filter the headers
-    mNext = new OpaqueResponseFilter(mNext);
-  }
-
   nsresult rv = OnStartRequest(aChannel);
 
   if (!aAllowed || NS_FAILED(rv)) {
-    MOZ_ASSERT_IF(!aAllowed, mState == State::Allowed);
-    // No need to call OnDataAvailable because
-    //   1. The input stream is consumed by
-    //     OpaqueResponseBlocker::OnDataAvailable already
-    //   2. We don't want to pass any data over
+    MOZ_ASSERT_IF(!aAllowed, mState == State::Blocked);
+    // We decided to block, so nothing more to do.
     MaybeRunOnStopRequest(aChannel);
     return;
   }
diff --git a/testing/web-platform/meta/fetch/orb/tentative/known-mime-type.sub.any.js.ini b/testing/web-platform/meta/fetch/orb/tentative/known-mime-type.sub.any.js.ini
index 1502f4e6d2a..bb9c7c8677d 100644
--- a/testing/web-platform/meta/fetch/orb/tentative/known-mime-type.sub.any.js.ini
+++ b/testing/web-platform/meta/fetch/orb/tentative/known-mime-type.sub.any.js.ini
@@ -3,33 +3,18 @@
   [ORB should block opaque font/ttf: fetch(..., {mode: "no-cors"})]
     expected: FAIL
 
-  [ORB should block opaque font/ttf: <script src=...>]
-    expected: FAIL
-
   [ORB should block opaque text/plain: fetch(..., {mode: "no-cors"})]
     expected: FAIL
 
-  [ORB should block opaque text/plain: <script src=...>]
-    expected: FAIL
-
   [ORB should block opaque application/json (non-empty): fetch(..., {mode: "no-cors"})]
     expected: FAIL
 
-  [ORB should block opaque application/json (non-empty): <script src=...>]
-    expected: FAIL
-
   [ORB should block opaque application/json (empty): fetch(..., {mode: "no-cors"})]
     expected: FAIL
 
-  [ORB should block opaque application/json (empty): <script src=...>]
-    expected: FAIL
-
   [ORB should block opaque application/json which contains non ascii characters: fetch(..., {mode: "no-cors"})]
     expected: FAIL
 
-  [ORB should block opaque application/json which contains non ascii characters: <script src=...>]
-    expected: FAIL
-
 
 [known-mime-type.sub.any.worker.html]
   prefs: [browser.opaqueResponseBlocking:true, browser.opaqueResponseBlocking.filterFetchResponse:2]
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/testing/web-platform/meta/fetch/orb/tentative/known-mime-type.sub.any.js.ini b/testing/web-platform/meta/fetch/orb/tentative/known-mime-type.sub.any.js.ini
index 1502f4e6d2a..bb9c7c8677d 100644
--- a/testing/web-platform/meta/fetch/orb/tentative/known-mime-type.sub.any.js.ini
+++ b/testing/web-platform/meta/fetch/orb/tentative/known-mime-type.sub.any.js.ini
@@ -3,33 +3,18 @@
   [ORB should block opaque font/ttf: fetch(..., {mode: "no-cors"})]
     expected: FAIL
 
-  [ORB should block opaque font/ttf: <script src=...>]
-    expected: FAIL
-
   [ORB should block opaque text/plain: fetch(..., {mode: "no-cors"})]
     expected: FAIL
 
-  [ORB should block opaque text/plain: <script src=...>]
-    expected: FAIL
-
   [ORB should block opaque application/json (non-empty): fetch(..., {mode: "no-cors"})]
     expected: FAIL
 
-  [ORB should block opaque application/json (non-empty): <script src=...>]
-    expected: FAIL
-
   [ORB should block opaque application/json (empty): fetch(..., {mode: "no-cors"})]
     expected: FAIL
 
-  [ORB should block opaque application/json (empty): <script src=...>]
-    expected: FAIL
-
   [ORB should block opaque application/json which contains non ascii characters: fetch(..., {mode: "no-cors"})]
     expected: FAIL
 
-  [ORB should block opaque application/json which contains non ascii characters: <script src=...>]
-    expected: FAIL
-
 
 [known-mime-type.sub.any.worker.html]
   prefs: [browser.opaqueResponseBlocking:true, browser.opaqueResponseBlocking.filterFetchResponse:2]
Loading diff…
On This Page