Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionInformation disclosure in the XML component
ComponentDOM
Bug ClassLogic Error
Tracker1985996
Fix commit2e2bb17d71f8 (firefox) +51/-1
CISA KEVNot listed
CreditedPier Angelo Vendrame
Disclosed2026-01-13

Changed Functions

FunctionChangeNotes
mState
dom/l10n/DocumentL10n.cpp
modified

Files Changed

  • dom/l10n/DOMLocalization.cpp
  • dom/l10n/DOMLocalization.h
  • dom/l10n/DocumentL10n.cpp
  • dom/l10n/DocumentL10n.h
  • dom/xml/nsXMLPrettyPrinter.cpp
  • intl/l10n/Localization.cpp
  • intl/l10n/Localization.h
diff --git a/dom/l10n/DOMLocalization.cpp b/dom/l10n/DOMLocalization.cpp
index 4e4b7699729..824150046a1 100644
--- a/dom/l10n/DOMLocalization.cpp
+++ b/dom/l10n/DOMLocalization.cpp
@@ -48,6 +48,12 @@ DOMLocalization::DOMLocalization(nsIGlobalObject* aGlobal, bool aIsSync,
   mMutations = new L10nMutations(this);
 }
 
+DOMLocalization::DOMLocalization(nsIGlobalObject* aGlobal, bool aIsSync,
+                                 const nsTArray<nsCString>& aLocales)
+    : Localization(aGlobal, aIsSync, aLocales) {
+  mMutations = new L10nMutations(this);
+}
+
 already_AddRefed<DOMLocalization> DOMLocalization::Constructor(
     const GlobalObject& aGlobal,
     const Sequence<dom::OwningUTF8StringOrResourceId>& aResourceIds,
diff --git a/dom/l10n/DOMLocalization.h b/dom/l10n/DOMLocalization.h
index 087db1d3e0c..8a8a0a66653 100644
--- a/dom/l10n/DOMLocalization.h
+++ b/dom/l10n/DOMLocalization.h
@@ -118,6 +118,8 @@ class DOMLocalization : public intl::Localization {
   DOMLocalization(nsIGlobalObject* aGlobal, bool aSync);
   DOMLocalization(nsIGlobalObject* aGlobal, bool aIsSync,
                   const intl::ffi::LocalizationRc* aRaw);
+  DOMLocalization(nsIGlobalObject* aGlobal, bool aSync,
+                  const nsTArray<nsCString>& aLocales);
 
  protected:
   virtual ~DOMLocalization();
diff --git a/dom/l10n/DocumentL10n.cpp b/dom/l10n/DocumentL10n.cpp
index 0c628908d91..beae33864d0 100644
--- a/dom/l10n/DocumentL10n.cpp
+++ b/dom/l10n/DocumentL10n.cpp
@@ -48,6 +48,19 @@ RefPtr<DocumentL10n> DocumentL10n::Create(Document* aDocument, bool aSync) {
   return l10n.forget();
 }
 
+RefPtr<DocumentL10n> DocumentL10n::Create(Document* aDocument, bool aSync,
+                                          const nsTArray<nsCString>& aLocales) {
+  RefPtr<DocumentL10n> l10n = new DocumentL10n(aDocument, aSync, aLocales);
+
+  IgnoredErrorResult rv;
+  l10n->mReady = Promise::Create(l10n->mGlobal, rv);
+  if (NS_WARN_IF(rv.Failed())) {
+    return nullptr;
+  }
+
+  return l10n.forget();
+}
+
 DocumentL10n::DocumentL10n(Document* aDocument, bool aSync)
     : DOMLocalization(aDocument->GetScopeObject(), aSync),
       mDocument(aDocument),
@@ -55,6 +68,14 @@ DocumentL10n::DocumentL10n(Document* aDocument, bool aSync)
   mContentSink = do_QueryInterface(aDocument->GetCurrentContentSink());
 }
 
+DocumentL10n::DocumentL10n(Document* aDocument, bool aSync,
+                           const nsTArray<nsCString>& aLocales)
+    : DOMLocalization(aDocument->GetScopeObject(), aSync, aLocales),
+      mDocument(aDocument),
+      mState(DocumentL10nState::Constructed) {
+  mContentSink = do_QueryInterface(aDocument->GetCurrentContentSink());
+}
+
 JSObject* DocumentL10n::WrapObject(JSContext* aCx,
                                    JS::Handle<JSObject*> aGivenProto) {
   return DocumentL10n_Binding::Wrap(aCx, this, aGivenProto);
diff --git a/dom/l10n/DocumentL10n.h b/dom/l10n/DocumentL10n.h
index 98e969b1844..6608e5a05de 100644
--- a/dom/l10n/DocumentL10n.h
+++ b/dom/l10n/DocumentL10n.h
@@ -47,9 +47,13 @@ class DocumentL10n final : public DOMLocalization {
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(DocumentL10n, DOMLocalization)
 
   static RefPtr<DocumentL10n> Create(Document* aDocument, bool aSync);
+  static RefPtr<DocumentL10n> Create(Document* aDocument, bool aSync,
+                                     const nsTArray<nsCString>& aLocales);
 
  protected:
   explicit DocumentL10n(Document* aDocument, bool aSync);
+  explicit DocumentL10n(Document* aDocument, bool aSync,
+                        const nsTArray<nsCString>& aLocales);
   virtual ~DocumentL10n() = default;
 
   RefPtr<Document> mDocument;
diff --git a/dom/xml/nsXMLPrettyPrinter.cpp b/dom/xml/nsXMLPrettyPrinter.cpp
index 605ddadf50f..61bf0a206c9 100644
--- a/dom/xml/nsXMLPrettyPrinter.cpp
+++ b/dom/xml/nsXMLPrettyPrinter.cpp
@@ -101,7 +101,13 @@ nsresult nsXMLPrettyPrinter::PrettyPrint(Document* aDocument,
 
   // Create a DocumentL10n, as the XML document is not allowed to have one.
   // Make it sync so that the test for bug 590812 does not require a setTimeout.
-  RefPtr<DocumentL10n> l10n = DocumentL10n::Create(aDocument, true);
+  RefPtr<DocumentL10n> l10n;
+  if (aDocument->ShouldResistFingerprinting(RFPTarget::JSLocale)) {
+    AutoTArray<nsCString, 1> langs = {nsRFPService::GetSpoofedJSLocale()};
+    l10n = DocumentL10n::Create(aDocument, true, langs);
+  } else {
+    l10n = DocumentL10n::Create(aDocument, true);
+  }
   NS_ENSURE_TRUE(l10n, NS_ERROR_UNEXPECTED);
   l10n->AddResourceId("dom/XMLPrettyPrint.ftl"_ns);
 
diff --git a/intl/l10n/Localization.cpp b/intl/l10n/Localization.cpp
index 81b79093e1b..b876637528d 100644
--- a/intl/l10n/Localization.cpp
+++ b/intl/l10n/Localization.cpp
@@ -164,6 +164,14 @@ Localization::Localization(nsIGlobalObject* aGlobal, bool aIsSync,
   RegisterObservers();
 }
 
+Localization::Localization(nsIGlobalObject* aGlobal, bool aIsSync,
+                           const nsTArray<nsCString>& aLocales)
+    : mGlobal(aGlobal) {
+  nsTArray<ffi::GeckoResourceId> resIds;
+  ffi::localization_new_with_locales(&resIds, aIsSync, nullptr, &aLocales,
+                                     getter_AddRefs(mRaw));
+}
+
 /* static */
 bool Localization::IsAPIEnabled(JSContext* aCx, JSObject* aObject) {
   JS::Rooted<JSObject*> obj(aCx, aObject);
diff --git a/intl/l10n/Localization.h b/intl/l10n/Localization.h
index 78e05b8493d..4c166da1ed2 100644
--- a/intl/l10n/Localization.h
+++ b/intl/l10n/Localization.h
@@ -156,6 +156,9 @@ class Localization : public nsIObserver,
   Localization(nsIGlobalObject* aGlobal, bool aIsSync,
                const ffi::LocalizationRc* aRaw);
 
+  Localization(nsIGlobalObject* aGlobal, bool aIsSync,
+               const nsTArray<nsCString>& aLocales);
+
   virtual ~Localization();
 
   void RegisterObservers();
Loading diff…