Firefox · DOM
CVE-2026-100758
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
docshell/base/nsDocShell.cppdocshell/base/nsDocShell.hdom/ipc/ContentParent.cpp
Patch
diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index 8c0d0538efd..40a86e42c9d 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -11119,7 +11119,6 @@ nsresult nsDocShell::UpdateURLAndHistory(
UpdateActiveEntry(false,
/* aPreviousScrollPos = */ Some(scrollPos), aNewURI,
- /* aOriginalURI = */ nullptr,
/* aReferrerInfo = */ referrerInfo,
/* aTriggeringPrincipal = */ aDocument->NodePrincipal(),
policyContainer, title, scrollRestorationIsManual, aData,
@@ -11128,9 +11127,6 @@ nsresult nsDocShell::UpdateURLAndHistory(
MOZ_LOG(gSHLog, LogLevel::Debug,
("nsDocShell %p UpdateActiveEntry (replacing) mActiveEntry %p",
this, mActiveEntry.get()));
- // Setting the resultPrincipalURI to nullptr is fine here: it will cause
- // NS_GetFinalChannelURI to use the originalURI as the URI, which is aNewURI
- // in our case. We could also set it to aNewURI, with the same result.
// We don't use aTitle here, see bug 544535.
nsString title;
nsCOMPtr<nsIReferrerInfo> referrerInfo;
@@ -11141,7 +11137,7 @@ nsresult nsDocShell::UpdateURLAndHistory(
referrerInfo = nullptr;
}
UpdateActiveEntry(
- true, /* aPreviousScrollPos = */ Nothing(), aNewURI, aNewURI,
+ true, /* aPreviousScrollPos = */ Nothing(), aNewURI,
/* aReferrerInfo = */ referrerInfo, aDocument->NodePrincipal(),
aDocument->GetPolicyContainer(), title,
mActiveEntry && mActiveEntry->GetScrollRestorationIsManual(), aData,
@@ -11249,7 +11245,7 @@ void nsDocShell::SetCacheKeyOnHistoryEntry(uint32_t aCacheKey) {
void nsDocShell::UpdateActiveEntry(
bool aReplace, const Maybe<nsPoint>& aPreviousScrollPos, nsIURI* aURI,
- nsIURI* aOriginalURI, nsIReferrerInfo* aReferrerInfo,
+ nsIReferrerInfo* aReferrerInfo,
nsIPrincipal* aTriggeringPrincipal, nsIPolicyContainer* aPolicyContainer,
const nsAString& aTitle, bool aScrollRestorationIsManual,
nsIStructuredCloneContainer* aData, bool aURIWasModified) {
@@ -11283,7 +11279,6 @@ void nsDocShell::UpdateActiveEntry(
aURI, aTriggeringPrincipal, doc->NodePrincipal(), nullptr,
aPolicyContainer, mContentTypeHint);
}
- mActiveEntry->SetOriginalURI(aOriginalURI);
mActiveEntry->SetUnstrippedURI(nullptr);
mActiveEntry->SetReferrerInfo(aReferrerInfo);
mActiveEntry->SetTitle(aTitle);
diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
index c3fcd2985a2..d892da75c85 100644
--- a/docshell/base/nsDocShell.h
+++ b/docshell/base/nsDocShell.h
@@ -605,7 +605,7 @@ class nsDocShell final : public nsDocLoader,
void UpdateActiveEntry(
bool aReplace, const mozilla::Maybe<nsPoint>& aPreviousScrollPos,
- nsIURI* aURI, nsIURI* aOriginalURI, nsIReferrerInfo* aReferrerInfo,
+ nsIURI* aURI, nsIReferrerInfo* aReferrerInfo,
nsIPrincipal* aTriggeringPrincipal, nsIPolicyContainer* aPolicyContainer,
const nsAString& aTitle, bool aScrollRestorationIsManual,
nsIStructuredCloneContainer* aData, bool aURIWasModified);
diff --git a/dom/ipc/ContentParent.cpp b/dom/ipc/ContentParent.cpp
index c15547a74fb..8418bb6add2 100644
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -7819,6 +7819,9 @@ mozilla::ipc::IPCResult ContentParent::RecvSetActiveSessionHistoryEntry(
const MaybeDiscarded<BrowsingContext>& aContext,
const Maybe<nsPoint>& aPreviousScrollPos, SessionHistoryInfo&& aInfo,
uint32_t aLoadType, uint32_t aUpdatedCacheKey, const nsID& aChangeID) {
+ if (aInfo.GetOriginalURI() || aInfo.GetResultPrincipalURI()) {
+ return IPC_FAIL(this, "Should not be set by content");
+ }
if (!aContext.IsNullOrDiscarded()) {
aContext.get_canonical()->SetActiveSessionHistoryEntry(
aPreviousScrollPos, &aInfo, aLoadType, aUpdatedCacheKey, aChangeID);
@@ -7829,6 +7832,9 @@ mozilla::ipc::IPCResult ContentParent::RecvSetActiveSessionHistoryEntry(
mozilla::ipc::IPCResult ContentParent::RecvReplaceActiveSessionHistoryEntry(
const MaybeDiscarded<BrowsingContext>& aContext,
SessionHistoryInfo&& aInfo) {
+ if (aInfo.GetOriginalURI() || aInfo.GetResultPrincipalURI()) {
+ return IPC_FAIL(this, "Should not be set by content");
+ }
if (!aContext.IsNullOrDiscarded()) {
aContext.get_canonical()->ReplaceActiveSessionHistoryEntry(&aInfo);
}
Loading diff…
References
On This Page