Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionXSLT document loading did not correctly propagate the source document which bypassed its CSP.
ComponentDOM
Bug ClassLogic Error
Tracker1974407
Fix commit22795e4ed8db (firefox) +36/-29
CISA KEVNot listed
CreditedJoe Turki
Disclosed2025-07-22

Changed Functions

FunctionChangeNotes
if
dom/base/nsSyncLoadService.cpp
modified
if
dom/xslt/xslt/txMozillaStylesheetCompiler.cpp
modified

Files Changed

  • dom/base/nsSyncLoadService.cpp
  • dom/base/nsSyncLoadService.h
  • dom/xml/nsXMLPrettyPrinter.cpp
  • dom/xslt/xml/txXMLParser.cpp
  • dom/xslt/xslt/txMozillaStylesheetCompiler.cpp
diff --git a/dom/base/nsSyncLoadService.cpp b/dom/base/nsSyncLoadService.cpp
index e74f1855f10..6fdde668894 100644
--- a/dom/base/nsSyncLoadService.cpp
+++ b/dom/base/nsSyncLoadService.cpp
@@ -280,16 +280,27 @@ nsSyncLoader::GetInterface(const nsIID& aIID, void** aResult) {
 
 /* static */
 nsresult nsSyncLoadService::LoadDocument(
-    nsIURI* aURI, nsContentPolicyType aContentPolicyType,
+    nsIURI* aURI, nsContentPolicyType aContentPolicyType, Document* aLoaderDoc,
     nsIPrincipal* aLoaderPrincipal, nsSecurityFlags aSecurityFlags,
     nsILoadGroup* aLoadGroup, nsICookieJarSettings* aCookieJarSettings,
     bool aForceToXML, ReferrerPolicy aReferrerPolicy, Document** aResult) {
+  MOZ_ASSERT(!!aLoaderPrincipal != !!aLoaderDoc);
+
   nsCOMPtr<nsIChannel> channel;
-  nsresult rv =
-      NS_NewChannel(getter_AddRefs(channel), aURI, aLoaderPrincipal,
-                    aSecurityFlags, aContentPolicyType, aCookieJarSettings,
-                    nullptr,  // PerformanceStorage
-                    aLoadGroup);
+  nsresult rv;
+  if (aLoaderDoc) {
+    MOZ_ASSERT(!aCookieJarSettings);
+    rv = NS_NewChannel(getter_AddRefs(channel), aURI, aLoaderDoc,
+                       aSecurityFlags, aContentPolicyType,
+                       nullptr,  // PerformanceStorage
+                       aLoadGroup);
+  } else {
+    rv = NS_NewChannel(getter_AddRefs(channel), aURI, aLoaderPrincipal,
+                       aSecurityFlags, aContentPolicyType, aCookieJarSettings,
+                       nullptr,  // PerformanceStorage
+                       aLoadGroup);
+  }
+
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (!aForceToXML) {
diff --git a/dom/base/nsSyncLoadService.h b/dom/base/nsSyncLoadService.h
index 0f81f8ec802..c61f6693d9b 100644
--- a/dom/base/nsSyncLoadService.h
+++ b/dom/base/nsSyncLoadService.h
@@ -48,9 +48,10 @@ class nsSyncLoadService {
    */
   static nsresult LoadDocument(
       nsIURI* aURI, nsContentPolicyType aContentPolicyType,
-      nsIPrincipal* aLoaderPrincipal, nsSecurityFlags aSecurityFlags,
-      nsILoadGroup* aLoadGroup, nsICookieJarSettings* aCookieJarSettings,
-      bool aForceToXML, mozilla::dom::ReferrerPolicy aReferrerPolicy,
+      mozilla::dom::Document* aLoaderDoc, nsIPrincipal* aLoaderPrincipal,
+      nsSecurityFlags aSecurityFlags, nsILoadGroup* aLoadGroup,
+      nsICookieJarSettings* aCookieJarSettings, bool aForceToXML,
+      mozilla::dom::ReferrerPolicy aReferrerPolicy,
       mozilla::dom::Document** aResult);
 
   /**
diff --git a/dom/xml/nsXMLPrettyPrinter.cpp b/dom/xml/nsXMLPrettyPrinter.cpp
index 19cf0afcb5d..17b740a614d 100644
--- a/dom/xml/nsXMLPrettyPrinter.cpp
+++ b/dom/xml/nsXMLPrettyPrinter.cpp
@@ -65,7 +65,8 @@ nsresult nsXMLPrettyPrinter::PrettyPrint(Document* aDocument,
 
   nsCOMPtr<Document> xslDocument;
   rv = nsSyncLoadService::LoadDocument(
-      xslUri, nsIContentPolicy::TYPE_XSLT, nsContentUtils::GetSystemPrincipal(),
+      xslUri, nsIContentPolicy::TYPE_XSLT, nullptr,
+      nsContentUtils::GetSystemPrincipal(),
       nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL, nullptr,
       aDocument->CookieJarSettings(), true, ReferrerPolicy::_empty,
       getter_AddRefs(xslDocument));
diff --git a/dom/xslt/xml/txXMLParser.cpp b/dom/xslt/xml/txXMLParser.cpp
index 1d576cdbacf..9cc1b3b465d 100644
--- a/dom/xslt/xml/txXMLParser.cpp
+++ b/dom/xslt/xml/txXMLParser.cpp
@@ -36,10 +36,9 @@ Result<txXPathNode, nsresult> txParseDocumentFromURI(const nsAString& aHref,
                            SyncOperationBehavior::eSuspendInput);
   rv = nsSyncLoadService::LoadDocument(
       documentURI, nsIContentPolicy::TYPE_INTERNAL_XMLHTTPREQUEST_SYNC,
-      loaderDocument->NodePrincipal(),
-      nsILoadInfo::SEC_REQUIRE_CORS_INHERITS_SEC_CONTEXT, loadGroup,
-      loaderDocument->CookieJarSettings(), true,
-      loaderDocument->GetReferrerPolicy(), getter_AddRefs(theDocument));
+      loaderDocument, nullptr,
+      nsILoadInfo::SEC_REQUIRE_CORS_INHERITS_SEC_CONTEXT, loadGroup, nullptr,
+      true, loaderDocument->GetReferrerPolicy(), getter_AddRefs(theDocument));
 
   if (NS_FAILED(rv)) {
     aErrMsg.AppendLiteral("Document load of ");
diff --git a/dom/xslt/xslt/txMozillaStylesheetCompiler.cpp b/dom/xslt/xslt/txMozillaStylesheetCompiler.cpp
index 35933a17b38..ac58e9ba88f 100644
--- a/dom/xslt/xslt/txMozillaStylesheetCompiler.cpp
+++ b/dom/xslt/xslt/txMozillaStylesheetCompiler.cpp
@@ -539,29 +539,24 @@ nsresult txSyncCompileObserver::loadURI(const nsAString& aUri,
   nsresult rv = NS_NewURI(getter_AddRefs(uri), aUri);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsCOMPtr<nsIURI> referrerUri;
-  rv = NS_NewURI(getter_AddRefs(referrerUri), aReferrerUri);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  nsCOMPtr<nsIPrincipal> referrerPrincipal =
-      BasePrincipal::CreateContentPrincipal(referrerUri, OriginAttributes());
-  NS_ENSURE_TRUE(referrerPrincipal, NS_ERROR_FAILURE);
+  nsCOMPtr<nsPIDOMWindowInner> window =
+      do_QueryInterface(mProcessor->GetParentObject());
+  NS_ENSURE_TRUE(window, NS_ERROR_FAILURE);
+  nsCOMPtr<Document> loaderDoc = window->GetExtantDoc();
+  NS_ENSURE_TRUE(loaderDoc, NS_ERROR_FAILURE);
 
   // This is probably called by js, a loadGroup for the channel doesn't
   // make sense.
-  nsCOMPtr<nsINode> source;
-  if (mProcessor) {
-    source = mProcessor->GetSourceContentModel();
-  }
+  nsCOMPtr<nsINode> source = mProcessor->GetSourceContentModel();
   dom::nsAutoSyncOperation sync(source ? source->OwnerDoc() : nullptr,
                                 dom::SyncOperationBehavior::eSuspendInput);
   nsCOMPtr<Document> document;
 
   rv = nsSyncLoadService::LoadDocument(
-      uri, nsIContentPolicy::TYPE_XSLT, referrerPrincipal,
-      nsILoadInfo::SEC_REQUIRE_CORS_INHERITS_SEC_CONTEXT, nullptr,
-      source ? source->OwnerDoc()->CookieJarSettings() : nullptr, false,
-      aReferrerPolicy, getter_AddRefs(document));
+      uri, nsIContentPolicy::TYPE_XSLT, loaderDoc,
+      /* aLoaderPrincipal */ nullptr,
+      nsILoadInfo::SEC_REQUIRE_CORS_INHERITS_SEC_CONTEXT, nullptr, nullptr,
+      false, aReferrerPolicy, getter_AddRefs(document));
   NS_ENSURE_SUCCESS(rv, rv);
 
   rv = handleNode(document, aCompiler);
Loading diff…