Firefox · DOM
CVE-2026-100829
Logic Error in DOM
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
dom/security/nsContentSecurityUtils.cpptesting/web-platform/meta/content-security-policy/script-src/non-nonceable-elements.html.ini
Patch
diff --git a/dom/security/nsContentSecurityUtils.cpp b/dom/security/nsContentSecurityUtils.cpp
index b5e8ca95d7e..ea7e8944731 100644
--- a/dom/security/nsContentSecurityUtils.cpp
+++ b/dom/security/nsContentSecurityUtils.cpp
@@ -1185,8 +1185,9 @@ nsString nsContentSecurityUtils::GetIsElementNonceableNonce(
// element’s attribute list:
if (nsCOMPtr<nsIScriptElement> script =
do_QueryInterface(const_cast<Element*>(&aElement))) {
- auto containsScriptOrStyle = [](const nsAString& aStr) {
- return aStr.LowerCaseFindASCII("<script") != kNotFound ||
+ auto containsLinkScriptOrStyle = [](const nsAString& aStr) {
+ return aStr.LowerCaseFindASCII("<link") != kNotFound ||
+ aStr.LowerCaseFindASCII("<script") != kNotFound ||
aStr.LowerCaseFindASCII("<style") != kNotFound;
};
@@ -1194,21 +1195,21 @@ nsString nsContentSecurityUtils::GetIsElementNonceableNonce(
uint32_t i = 0;
while (BorrowedAttrInfo info = aElement.GetAttrInfoAt(i++)) {
// Step 2.1. If attribute’s name contains an ASCII case-insensitive match
- // for "<script" or "<style", return "Not Nonceable".
+ // for "<link", <script" or "<style", return "Not Nonceable".
const nsAttrName* name = info.mName;
if (nsAtom* prefix = name->GetPrefix()) {
- if (containsScriptOrStyle(nsDependentAtomString(prefix))) {
+ if (containsLinkScriptOrStyle(nsDependentAtomString(prefix))) {
return EmptyString();
}
}
- if (containsScriptOrStyle(nsDependentAtomString(name->LocalName()))) {
+ if (containsLinkScriptOrStyle(nsDependentAtomString(name->LocalName()))) {
return EmptyString();
}
// Step 2.2. If attribute’s value contains an ASCII case-insensitive match
- // for "<script" or "<style", return "Not Nonceable".
+ // for "<link", "<script" or "<style", return "Not Nonceable".
info.mValue->ToString(value);
- if (containsScriptOrStyle(value)) {
+ if (containsLinkScriptOrStyle(value)) {
return EmptyString();
}
}
diff --git a/testing/web-platform/meta/content-security-policy/script-src/non-nonceable-elements.html.ini b/testing/web-platform/meta/content-security-policy/script-src/non-nonceable-elements.html.ini
deleted file mode 100644
index 84e27326529..00000000000
--- a/testing/web-platform/meta/content-security-policy/script-src/non-nonceable-elements.html.ini
+++ /dev/null
@@ -1,9 +0,0 @@
-[non-nonceable-elements.html]
- [Non-nonceable script element 5]
- expected: FAIL
-
- [Non-nonceable script element 6]
- expected: FAIL
-
- [Non-nonceable script element 9]
- expected: FAIL
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/testing/web-platform/meta/content-security-policy/script-src/non-nonceable-elements.html.ini b/testing/web-platform/meta/content-security-policy/script-src/non-nonceable-elements.html.ini deleted file mode 100644 index 84e27326529..00000000000 --- a/testing/web-platform/meta/content-security-policy/script-src/non-nonceable-elements.html.ini +++ /dev/null @@ -1,9 +0,0 @@ -[non-nonceable-elements.html] - [Non-nonceable script element 5] - expected: FAIL - - [Non-nonceable script element 6] - expected: FAIL - - [Non-nonceable script element 9] - expected: FAIL
Loading diff…
References
On This Page