Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionXSLT document loading did not correctly propagate the source document which bypassed its CSP.
ComponentDOM
Bug ClassLogic Error
Tracker1974407
Fix commit22795e4ed8db (firefox) +36/-29
CISA KEVNot listed
CreditedJoe Turki
Disclosed2025-07-22

Changed Functions

FunctionChangeNotes
if
dom/base/nsSyncLoadService.cpp
modified
if
dom/xslt/xslt/txMozillaStylesheetCompiler.cpp
modified

Files Changed

  • dom/base/nsSyncLoadService.cpp
  • dom/base/nsSyncLoadService.h
  • dom/xml/nsXMLPrettyPrinter.cpp
  • dom/xslt/xml/txXMLParser.cpp
  • dom/xslt/xslt/txMozillaStylesheetCompiler.cpp
diff --git a/dom/base/nsSyncLoadService.cpp b/dom/base/nsSyncLoadService.cpp
index e74f1855f10..6fdde668894 100644
--- a/dom/base/nsSyncLoadService.cpp
+++ b/dom/base/nsSyncLoadService.cpp
@@ -280,16 +280,27 @@ nsSyncLoader::GetInterface(const nsIID& aIID, void** aResult) {
 
 /* static */
 nsresult nsSyncLoadService::LoadDocument(
-    nsIURI* aURI, nsContentPolicyType aContentPolicyType,
+    nsIURI* aURI, nsContentPolicyType aContentPolicyType, Document* aLoaderDoc,
     nsIPrincipal* aLoaderPrincipal, nsSecurityFlags aSecurityFlags,
     nsILoadGroup* aLoadGroup, nsICookieJarSettings* aCookieJarSettings,
     bool aForceToXML, ReferrerPolicy aReferrerPolicy, Document** aResult) {
+  MOZ_ASSERT(!!aLoaderPrincipal != !!aLoaderDoc);
+
   nsCOMPtr<nsIChannel> channel;
-  nsresult rv =
-      NS_NewChannel(getter_AddRefs(channel), aURI, aLoaderPrincipal,
-                    aSecurityFlags, aContentPolicyType, aCookieJarSettings,
-                    nullptr,  // PerformanceStorage
-                    aLoadGroup);
+  nsresult rv;
+  if (aLoaderDoc) {
+    MOZ_ASSERT(!aCookieJarSettings);
+    rv = NS_NewChannel(getter_AddRefs(channel), aURI, aLoaderDoc,
+                       aSecurityFlags, aContentPolicyType,
+                       nullptr,  // PerformanceStorage
+                       aLoadGroup);
+  } else {
+    rv = NS_NewChannel(getter_AddRefs(channel), aURI, aLoaderPrincipal,
+                       aSecurityFlags, aContentPolicyType, aCookieJarSettings,
+                       nullptr,  // PerformanceStorage
+                       aLoadGroup);
+  }
+
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (!aForceToXML) {
diff --git a/dom/base/nsSyncLoadService.h b/dom/base/nsSyncLoadService.h
index 0f81f8ec802..c61f6693d9b 100644
--- a/dom/base/nsSyncLoadService.h
+++ b/dom/base/nsSyncLoadService.h
@@ -48,9 +48,10 @@ class nsSyncLoadService {
    */
   static nsresult LoadDocument(
       nsIURI* aURI, nsContentPolicyType aContentPolicyType,
-      nsIPrincipal* aLoaderPrincipal, nsSecurityFlags aSecurityFlags,
-      nsILoadGroup* aLoadGroup, nsICookieJarSettings* aCookieJarSettings,
-      bool aForceToXML, mozilla::dom::ReferrerPolicy aReferrerPolicy,
+      mozilla::dom::Document* aLoaderDoc, nsIPrincipal* aLoaderPrincipal,
+      nsSecurityFlags aSecurityFlags, nsILoadGroup* aLoadGroup,
+      nsICookieJarSettings* aCookieJarSettings, bool aForceToXML,
+      mozilla::dom::ReferrerPolicy aReferrerPolicy,
       mozilla::dom::Document** aResult);
 
   /**
diff --git a/dom/xml/nsXMLPrettyPrinter.cpp b/dom/xml/nsXMLPrettyPrinter.cpp
index 19cf0afcb5d..17b740a614d 100644
--- a/dom/xml/nsXMLPrettyPrinter.cpp
+++ b/dom/xml/nsXMLPrettyPrinter.cpp
@@ -65,7 +65,8 @@ nsresult nsXMLPrettyPrinter::PrettyPrint(Document* aDocument,
 
   nsCOMPtr<Document> xslDocument;
   rv = nsSyncLoadService::LoadDocument(
-      xslUri, nsIContentPolicy::TYPE_XSLT, nsContentUtils::GetSystemPrincipal(),
+      xslUri, nsIContentPolicy::TYPE_XSLT, nullptr,
+      nsContentUtils::GetSystemPrincipal(),
       nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL, nullptr,
       aDocument->CookieJarSettings(), true, ReferrerPolicy::_empty,
       getter_AddRefs(xslDocument));
diff --git a/dom/xslt/xml/txXMLParser.cpp b/dom/xslt/xml/txXMLParser.cpp
index 1d576cdbacf..9cc1b3b465d 100644
--- a/dom/xslt/xml/txXMLParser.cpp
+++ b/dom/xslt/xml/txXMLParser.cpp
@@ -36,10 +36,9 @@ Result<txXPathNode, nsresult> txParseDocumentFromURI(const nsAString& aHref,
                            SyncOperationBehavior::eSuspendInput);
   rv = nsSyncLoadService::LoadDocument(
       documentURI, nsIContentPolicy::TYPE_INTERNAL_XMLHTTPREQUEST_SYNC,
-      loaderDocument->NodePrincipal(),
-      nsILoadInfo::SEC_REQUIRE_CORS_INHERITS_SEC_CONTEXT, loadGroup,
-      loaderDocument->CookieJarSettings(), true,
-      loaderDocument->GetReferrerPolicy(), getter_AddRefs(theDocument));
+      loaderDocument, nullptr,
+      nsILoadInfo::SEC_REQUIRE_CORS_INHERITS_SEC_CONTEXT, loadGroup, nullptr,
+      true, loaderDocument->GetReferrerPolicy(), getter_AddRefs(theDocument));
 
   if (NS_FAILED(rv)) {
     aErrMsg.AppendLiteral("Document load of ");
diff --git a/dom/xslt/xslt/txMozillaStylesheetCompiler.cpp b/dom/xslt/xslt/txMozillaStylesheetCompiler.cpp
index 35933a17b38..ac58e9ba88f 100644
--- a/dom/xslt/xslt/txMozillaStylesheetCompiler.cpp
+++ b/dom/xslt/xslt/txMozillaStylesheetCompiler.cpp
@@ -539,29 +539,24 @@ nsresult txSyncCompileObserver::loadURI(const nsAString& aUri,
   nsresult rv = NS_NewURI(getter_AddRefs(uri), aUri);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsCOMPtr<nsIURI> referrerUri;
-  rv = NS_NewURI(getter_AddRefs(referrerUri), aReferrerUri);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  nsCOMPtr<nsIPrincipal> referrerPrincipal =
-      BasePrincipal::CreateContentPrincipal(referrerUri, OriginAttributes());
-  NS_ENSURE_TRUE(referrerPrincipal, NS_ERROR_FAILURE);
+  nsCOMPtr<nsPIDOMWindowInner> window =
+      do_QueryInterface(mProcessor->GetParentObject());
+  NS_ENSURE_TRUE(window, NS_ERROR_FAILURE);
+  nsCOMPtr<Document> loaderDoc = window->GetExtantDoc();
+  NS_ENSURE_TRUE(loaderDoc, NS_ERROR_FAILURE);
 
   // This is probably called by js, a loadGroup for the channel doesn't
   // make sense.
-  nsCOMPtr<nsINode> source;
-  if (mProcessor) {
-    source = mProcessor->GetSourceContentModel();
-  }
+  nsCOMPtr<nsINode> source = mProcessor->GetSourceContentModel();
   dom::nsAutoSyncOperation sync(source ? source->OwnerDoc() : nullptr,
                                 dom::SyncOperationBehavior::eSuspendInput);
   nsCOMPtr<Document> document;
 
   rv = nsSyncLoadService::LoadDocument(
-      uri, nsIContentPolicy::TYPE_XSLT, referrerPrincipal,
-      nsILoadInfo::SEC_REQUIRE_CORS_INHERITS_SEC_CONTEXT, nullptr,
-      source ? source->OwnerDoc()->CookieJarSettings() : nullptr, false,
-      aReferrerPolicy, getter_AddRefs(document));
+      uri, nsIContentPolicy::TYPE_XSLT, loaderDoc,
+      /* aLoaderPrincipal */ nullptr,
+      nsILoadInfo::SEC_REQUIRE_CORS_INHERITS_SEC_CONTEXT, nullptr, nullptr,
+      false, aReferrerPolicy, getter_AddRefs(document));
   NS_ENSURE_SUCCESS(rv, rv);
 
   rv = handleNode(document, aCompiler);
Loading diff…