Firefox · DOM
CVE-2025-8032
Logic Error in DOM
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/base/nsSyncLoadService.cpp |
modified | |
ifdom/xslt/xslt/txMozillaStylesheetCompiler.cpp |
modified |
Files Changed
dom/base/nsSyncLoadService.cppdom/base/nsSyncLoadService.hdom/xml/nsXMLPrettyPrinter.cppdom/xslt/xml/txXMLParser.cppdom/xslt/xslt/txMozillaStylesheetCompiler.cpp
Patch
diff --git a/dom/base/nsSyncLoadService.cpp b/dom/base/nsSyncLoadService.cpp
index e74f1855f10..6fdde668894 100644
--- a/dom/base/nsSyncLoadService.cpp
+++ b/dom/base/nsSyncLoadService.cpp
@@ -280,16 +280,27 @@ nsSyncLoader::GetInterface(const nsIID& aIID, void** aResult) {
/* static */
nsresult nsSyncLoadService::LoadDocument(
- nsIURI* aURI, nsContentPolicyType aContentPolicyType,
+ nsIURI* aURI, nsContentPolicyType aContentPolicyType, Document* aLoaderDoc,
nsIPrincipal* aLoaderPrincipal, nsSecurityFlags aSecurityFlags,
nsILoadGroup* aLoadGroup, nsICookieJarSettings* aCookieJarSettings,
bool aForceToXML, ReferrerPolicy aReferrerPolicy, Document** aResult) {
+ MOZ_ASSERT(!!aLoaderPrincipal != !!aLoaderDoc);
+
nsCOMPtr<nsIChannel> channel;
- nsresult rv =
- NS_NewChannel(getter_AddRefs(channel), aURI, aLoaderPrincipal,
- aSecurityFlags, aContentPolicyType, aCookieJarSettings,
- nullptr, // PerformanceStorage
- aLoadGroup);
+ nsresult rv;
+ if (aLoaderDoc) {
+ MOZ_ASSERT(!aCookieJarSettings);
+ rv = NS_NewChannel(getter_AddRefs(channel), aURI, aLoaderDoc,
+ aSecurityFlags, aContentPolicyType,
+ nullptr, // PerformanceStorage
+ aLoadGroup);
+ } else {
+ rv = NS_NewChannel(getter_AddRefs(channel), aURI, aLoaderPrincipal,
+ aSecurityFlags, aContentPolicyType, aCookieJarSettings,
+ nullptr, // PerformanceStorage
+ aLoadGroup);
+ }
+
NS_ENSURE_SUCCESS(rv, rv);
if (!aForceToXML) {
diff --git a/dom/base/nsSyncLoadService.h b/dom/base/nsSyncLoadService.h
index 0f81f8ec802..c61f6693d9b 100644
--- a/dom/base/nsSyncLoadService.h
+++ b/dom/base/nsSyncLoadService.h
@@ -48,9 +48,10 @@ class nsSyncLoadService {
*/
static nsresult LoadDocument(
nsIURI* aURI, nsContentPolicyType aContentPolicyType,
- nsIPrincipal* aLoaderPrincipal, nsSecurityFlags aSecurityFlags,
- nsILoadGroup* aLoadGroup, nsICookieJarSettings* aCookieJarSettings,
- bool aForceToXML, mozilla::dom::ReferrerPolicy aReferrerPolicy,
+ mozilla::dom::Document* aLoaderDoc, nsIPrincipal* aLoaderPrincipal,
+ nsSecurityFlags aSecurityFlags, nsILoadGroup* aLoadGroup,
+ nsICookieJarSettings* aCookieJarSettings, bool aForceToXML,
+ mozilla::dom::ReferrerPolicy aReferrerPolicy,
mozilla::dom::Document** aResult);
/**
diff --git a/dom/xml/nsXMLPrettyPrinter.cpp b/dom/xml/nsXMLPrettyPrinter.cpp
index 19cf0afcb5d..17b740a614d 100644
--- a/dom/xml/nsXMLPrettyPrinter.cpp
+++ b/dom/xml/nsXMLPrettyPrinter.cpp
@@ -65,7 +65,8 @@ nsresult nsXMLPrettyPrinter::PrettyPrint(Document* aDocument,
nsCOMPtr<Document> xslDocument;
rv = nsSyncLoadService::LoadDocument(
- xslUri, nsIContentPolicy::TYPE_XSLT, nsContentUtils::GetSystemPrincipal(),
+ xslUri, nsIContentPolicy::TYPE_XSLT, nullptr,
+ nsContentUtils::GetSystemPrincipal(),
nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL, nullptr,
aDocument->CookieJarSettings(), true, ReferrerPolicy::_empty,
getter_AddRefs(xslDocument));
diff --git a/dom/xslt/xml/txXMLParser.cpp b/dom/xslt/xml/txXMLParser.cpp
index 1d576cdbacf..9cc1b3b465d 100644
--- a/dom/xslt/xml/txXMLParser.cpp
+++ b/dom/xslt/xml/txXMLParser.cpp
@@ -36,10 +36,9 @@ Result<txXPathNode, nsresult> txParseDocumentFromURI(const nsAString& aHref,
SyncOperationBehavior::eSuspendInput);
rv = nsSyncLoadService::LoadDocument(
documentURI, nsIContentPolicy::TYPE_INTERNAL_XMLHTTPREQUEST_SYNC,
- loaderDocument->NodePrincipal(),
- nsILoadInfo::SEC_REQUIRE_CORS_INHERITS_SEC_CONTEXT, loadGroup,
- loaderDocument->CookieJarSettings(), true,
- loaderDocument->GetReferrerPolicy(), getter_AddRefs(theDocument));
+ loaderDocument, nullptr,
+ nsILoadInfo::SEC_REQUIRE_CORS_INHERITS_SEC_CONTEXT, loadGroup, nullptr,
+ true, loaderDocument->GetReferrerPolicy(), getter_AddRefs(theDocument));
if (NS_FAILED(rv)) {
aErrMsg.AppendLiteral("Document load of ");
diff --git a/dom/xslt/xslt/txMozillaStylesheetCompiler.cpp b/dom/xslt/xslt/txMozillaStylesheetCompiler.cpp
index 35933a17b38..ac58e9ba88f 100644
--- a/dom/xslt/xslt/txMozillaStylesheetCompiler.cpp
+++ b/dom/xslt/xslt/txMozillaStylesheetCompiler.cpp
@@ -539,29 +539,24 @@ nsresult txSyncCompileObserver::loadURI(const nsAString& aUri,
nsresult rv = NS_NewURI(getter_AddRefs(uri), aUri);
NS_ENSURE_SUCCESS(rv, rv);
- nsCOMPtr<nsIURI> referrerUri;
- rv = NS_NewURI(getter_AddRefs(referrerUri), aReferrerUri);
- NS_ENSURE_SUCCESS(rv, rv);
-
- nsCOMPtr<nsIPrincipal> referrerPrincipal =
- BasePrincipal::CreateContentPrincipal(referrerUri, OriginAttributes());
- NS_ENSURE_TRUE(referrerPrincipal, NS_ERROR_FAILURE);
+ nsCOMPtr<nsPIDOMWindowInner> window =
+ do_QueryInterface(mProcessor->GetParentObject());
+ NS_ENSURE_TRUE(window, NS_ERROR_FAILURE);
+ nsCOMPtr<Document> loaderDoc = window->GetExtantDoc();
+ NS_ENSURE_TRUE(loaderDoc, NS_ERROR_FAILURE);
// This is probably called by js, a loadGroup for the channel doesn't
// make sense.
- nsCOMPtr<nsINode> source;
- if (mProcessor) {
- source = mProcessor->GetSourceContentModel();
- }
+ nsCOMPtr<nsINode> source = mProcessor->GetSourceContentModel();
dom::nsAutoSyncOperation sync(source ? source->OwnerDoc() : nullptr,
dom::SyncOperationBehavior::eSuspendInput);
nsCOMPtr<Document> document;
rv = nsSyncLoadService::LoadDocument(
- uri, nsIContentPolicy::TYPE_XSLT, referrerPrincipal,
- nsILoadInfo::SEC_REQUIRE_CORS_INHERITS_SEC_CONTEXT, nullptr,
- source ? source->OwnerDoc()->CookieJarSettings() : nullptr, false,
- aReferrerPolicy, getter_AddRefs(document));
+ uri, nsIContentPolicy::TYPE_XSLT, loaderDoc,
+ /* aLoaderPrincipal */ nullptr,
+ nsILoadInfo::SEC_REQUIRE_CORS_INHERITS_SEC_CONTEXT, nullptr, nullptr,
+ false, aReferrerPolicy, getter_AddRefs(document));
NS_ENSURE_SUCCESS(rv, rv);
rv = handleNode(document, aCompiler);
Loading diff…
References
On This Page