Firefox · DOM
CVE-2026-100830
Logic Error in DOM
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/base/nsGlobalWindowOuter.cpp |
modified |
Files Changed
dom/base/nsGlobalWindowOuter.cppdom/clients/manager/ClientOpenWindowUtils.cppdom/documentpip/DocumentPictureInPicture.cppgfx/vr/nsFxrCommandLineHandler.cpplayout/tools/layout-debug/src/nsLayoutDebugCLH.cppsecurity/manager/pki/nsNSSDialogHelper.cppsecurity/manager/ssl/PKCS11ModuleDB.cpptoolkit/components/alerts/nsXULAlerts.cpptoolkit/components/windowwatcher/nsIWindowWatcher.idltoolkit/components/windowwatcher/nsPIWindowWatcher.idltoolkit/components/windowwatcher/nsWindowWatcher.cpptoolkit/components/windowwatcher/nsWindowWatcher.htoolkit/xre/ProfileReset.cpptoolkit/xre/nsAppRunner.cppwidget/android/nsWindow.cppwidget/uikit/nsWindow.mmwidget/windows/nsPrintDialogWin.cpp
Patch
diff --git a/dom/base/nsGlobalWindowOuter.cpp b/dom/base/nsGlobalWindowOuter.cpp
index 2ddc5344ff2..eea309778f6 100644
--- a/dom/base/nsGlobalWindowOuter.cpp
+++ b/dom/base/nsGlobalWindowOuter.cpp
@@ -6933,8 +6933,6 @@ nsresult nsGlobalWindowOuter::OpenInternal(
do_GetService(NS_WINDOWWATCHER_CONTRACTID, &rv);
NS_ENSURE_TRUE(wwatch, rv);
- NS_ConvertUTF16toUTF8 name(windowName);
-
nsCOMPtr<nsPIWindowWatcher> pwwatch(do_QueryInterface(wwatch));
NS_ENSURE_STATE(pwwatch);
@@ -6969,7 +6967,7 @@ nsresult nsGlobalWindowOuter::OpenInternal(
if (!aCalledNoScript) {
// We asserted at the top of this function that aNavigate is true for
// !aCalledNoScript.
- rv = pwwatch->OpenWindow2(this, uri, name, options, modifiers,
+ rv = pwwatch->OpenWindow2(this, uri, windowName, options, modifiers,
/* aCalledFromScript = */ true, aDialog,
aNavigate, aArguments, isPopupSpamWindow,
forceNoOpener, forceNoReferrer, wwPrintKind,
@@ -6985,7 +6983,7 @@ nsresult nsGlobalWindowOuter::OpenInternal(
// when it tries to compute the caller principal to associate with dialog
// arguments. That whole setup just really needs to be rewritten. :-(
AutoNoJSAPI nojsapi;
- rv = pwwatch->OpenWindow2(this, uri, name, options, modifiers,
+ rv = pwwatch->OpenWindow2(this, uri, windowName, options, modifiers,
/* aCalledFromScript = */ false, aDialog,
aNavigate, aArguments, isPopupSpamWindow,
forceNoOpener, forceNoReferrer, wwPrintKind,
diff --git a/dom/clients/manager/ClientOpenWindowUtils.cpp b/dom/clients/manager/ClientOpenWindowUtils.cpp
index 4f52b8b1064..7d815768768 100644
--- a/dom/clients/manager/ClientOpenWindowUtils.cpp
+++ b/dom/clients/manager/ClientOpenWindowUtils.cpp
@@ -260,7 +260,7 @@ static Result<Ok, nsresult> OpenNewWindow(
nsCOMPtr<mozIDOMWindowProxy> win;
MOZ_TRY(ww->OpenWindow(nullptr, nsDependentCString(BROWSER_CHROME_URL_QUOTED),
- "_blank"_ns, features, args, getter_AddRefs(win)));
+ u"_blank"_ns, features, args, getter_AddRefs(win)));
return Ok();
}
diff --git a/dom/documentpip/DocumentPictureInPicture.cpp b/dom/documentpip/DocumentPictureInPicture.cpp
index cb2fc309c06..272967957b0 100644
--- a/dom/documentpip/DocumentPictureInPicture.cpp
+++ b/dom/documentpip/DocumentPictureInPicture.cpp
@@ -152,7 +152,7 @@ static nsresult OpenPiPWindowUtility(nsPIDOMWindowOuter* aParent,
features += ",disallow_return_to_opener";
}
- rv = pww->OpenWindow2(aParent, uri, "_blank"_ns, features,
+ rv = pww->OpenWindow2(aParent, uri, u"_blank"_ns, features,
mozilla::dom::UserActivation::Modifiers::None(), false,
false, true, nullptr, false, false, false,
nsPIWindowWatcher::PrintKind::PRINT_NONE, loadState,
diff --git a/gfx/vr/nsFxrCommandLineHandler.cpp b/gfx/vr/nsFxrCommandLineHandler.cpp
index 00b460aede5..db85a35394d 100644
--- a/gfx/vr/nsFxrCommandLineHandler.cpp
+++ b/gfx/vr/nsFxrCommandLineHandler.cpp
@@ -80,7 +80,7 @@ nsFxrCommandLineHandler::Handle(nsICommandLine* aCmdLine) {
result = wwatch->OpenWindow(
nullptr, // aParent
"chrome://fxr/content/fxrui.html"_ns, // aUrl
- "_blank"_ns, // aName
+ u"_blank"_ns, // aName
"chrome,dialog=no,all,private,alwaysontop"_ns, // aFeatures
nullptr, // aArguments
getter_AddRefs(newWindow));
diff --git a/layout/tools/layout-debug/src/nsLayoutDebugCLH.cpp b/layout/tools/layout-debug/src/nsLayoutDebugCLH.cpp
index 620a32c6919..86063968f0a 100644
--- a/layout/tools/layout-debug/src/nsLayoutDebugCLH.cpp
+++ b/layout/tools/layout-debug/src/nsLayoutDebugCLH.cpp
@@ -223,9 +223,10 @@ nsLayoutDebugCLH::Handle(nsICommandLine* aCmdLine) {
NS_ENSURE_TRUE(wwatch, NS_ERROR_FAILURE);
nsCOMPtr<mozIDOMWindowProxy> opened;
- wwatch->OpenWindow(
- nullptr, "chrome://layoutdebug/content/layoutdebug.xhtml"_ns, "_blank"_ns,
- "chrome,dialog=no,all"_ns, argsArray, getter_AddRefs(opened));
+ wwatch->OpenWindow(nullptr,
+ "chrome://layoutdebug/content/layoutdebug.xhtml"_ns,
+ u"_blank"_ns, "chrome,dialog=no,all"_ns, argsArray,
+ getter_AddRefs(opened));
aCmdLine->SetPreventDefault(true);
return NS_OK;
}
diff --git a/security/manager/pki/nsNSSDialogHelper.cpp b/security/manager/pki/nsNSSDialogHelper.cpp
index 4f119c94623..62f660d6dc0 100644
--- a/security/manager/pki/nsNSSDialogHelper.cpp
+++ b/security/manager/pki/nsNSSDialogHelper.cpp
@@ -37,7 +37,7 @@ nsresult nsNSSDialogHelper::openDialog(mozIDOMWindowProxy* window,
nsCOMPtr<mozIDOMWindowProxy> newWindow;
rv = windowWatcher->OpenWindow(
- parent, nsDependentCString(url), "_blank"_ns,
+ parent, nsDependentCString(url), u"_blank"_ns,
nsDependentCString(modal ? kOpenDialogParam : kOpenWindowParam), params,
getter_AddRefs(newWindow));
return rv;
diff --git a/security/manager/ssl/PKCS11ModuleDB.cpp b/security/manager/ssl/PKCS11ModuleDB.cpp
index 9584ef7af2b..9f73c1e2708 100644
--- a/security/manager/ssl/PKCS11ModuleDB.cpp
+++ b/security/manager/ssl/PKCS11ModuleDB.cpp
@@ -820,7 +820,7 @@ void ShowProtectedAuthDialog(const nsCString& tokenName,
nsCOMPtr<mozIDOMWindowProxy> newWindow;
(void)ww->OpenWindow(activeWindow,
"chrome://pippki/content/protectedAuth.xhtml"_ns,
- "_blank"_ns, "centerscreen,chrome,modal,titlebar"_ns,
+ u"_blank"_ns, "centerscreen,chrome,modal,titlebar"_ns,
dialogArgs, getter_AddRefs(newWindow));
}
diff --git a/toolkit/components/alerts/nsXULAlerts.cpp b/toolkit/components/alerts/nsXULAlerts.cpp
index b77334544ff..21badadfc86 100644
--- a/toolkit/components/alerts/nsXULAlerts.cpp
+++ b/toolkit/components/alerts/nsXULAlerts.cpp
@@ -352,7 +352,7 @@ nsresult nsXULAlerts::ShowAlertImpl(nsIAlertNotification* aAlert,
features.AppendLiteral(",private");
}
rv = wwatch->OpenWindow(
- nullptr, "chrome://global/content/alerts/alert.xhtml"_ns, "_blank"_ns,
+ nullptr, "chrome://global/content/alerts/alert.xhtml"_ns, u"_blank"_ns,
features, argsArray, getter_AddRefs(newWindow));
NS_ENSURE_SUCCESS(rv, rv);
diff --git a/toolkit/components/windowwatcher/nsIWindowWatcher.idl b/toolkit/components/windowwatcher/nsIWindowWatcher.idl
index 041d82b91d0..9af0f45f343 100644
--- a/toolkit/components/windowwatcher/nsIWindowWatcher.idl
+++ b/toolkit/components/windowwatcher/nsIWindowWatcher.idl
@@ -65,7 +65,7 @@ interface nsIWindowWatcher : nsISupports {
via nsIObserverService if the window did not already exist.
*/
mozIDOMWindowProxy openWindow(in mozIDOMWindowProxy aParent, in ACString aUrl,
- in ACString aName, in ACString aFeatures,
+ in AString aName, in ACString aFeatures,
in nsISupports aArguments);
/** Clients of this service can register themselves to be notified
diff --git a/toolkit/components/windowwatcher/nsPIWindowWatcher.idl b/toolkit/components/windowwatcher/nsPIWindowWatcher.idl
index 3377a40fabf..93e4c9af3a0 100644
--- a/toolkit/components/windowwatcher/nsPIWindowWatcher.idl
+++ b/toolkit/components/windowwatcher/nsPIWindowWatcher.idl
@@ -100,7 +100,7 @@ interface nsPIWindowWatcher : nsISupports
*/
[noscript]
BrowsingContext openWindow2(in mozIDOMWindowProxy aParent, in nsIURI aUri,
- in ACString aName, in ACString aFeatures,
+ in AString aName, in ACString aFeatures,
in UserActivationModifiersRef aModifiers,
in boolean aCalledFromScript,
in boolean aDialog,
diff --git a/toolkit/components/windowwatcher/nsWindowWatcher.cpp b/toolkit/components/windowwatcher/nsWindowWatcher.cpp
index 15e5f4982dd..1a7068e4d6e 100644
--- a/toolkit/components/windowwatcher/nsWindowWatcher.cpp
+++ b/toolkit/components/windowwatcher/nsWindowWatcher.cpp
@@ -275,8 +275,7 @@ static already_AddRefed<nsIArray> ConvertArgsToArray(nsISupports* aArguments) {
NS_IMETHODIMP
nsWindowWatcher::OpenWindow(mozIDOMWindowProxy* aParent, const nsACString& aUrl,
- const nsACString& aName,
- const nsACString& aFeatures,
+ const nsAString& aName, const nsACString& aFeatures,
nsISupports* aArguments,
mozIDOMWindowProxy** aResult) {
nsCOMPtr<nsIArray> argv = ConvertArgsToArray(aArguments);
@@ -359,7 +358,7 @@ static SizeSpec CalcSizeSpec(const WindowFeatures&, bool aHasChromeParent,
NS_IMETHODIMP
nsWindowWatcher::OpenWindow2(
- mozIDOMWindowProxy* aParent, nsIURI* aUri, const nsACString& aName,
+ mozIDOMWindowProxy* aParent, nsIURI* aUri, const nsAString& aName,
const nsACString& aFeatures, const UserActivation::Modifiers& aModifiers,
bool aCalledFromScript, bool aDialog, bool aNavigate, nsIArray* aArguments,
bool aIsPopupSpam, bool aForceNoOpener, bool aForceNoReferrer,
@@ -601,8 +600,8 @@ nsWindowWatcher::OpenWindowWithRemoteTab(nsIRemoteTab* aRemoteTab,
}
nsresult nsWindowWatcher::OpenWindowInternal(
- mozIDOMWindowProxy* aParent, const nsACString& aUrl,
- const nsACString& aName, const nsACString& aFeatures,
+ mozIDOMWindowProxy* aParent, const nsACString& aUrl, const nsAString& aName,
+ const nsACString& aFeatures,
const mozilla::dom::UserActivation::Modifiers& aModifiers,
bool aCalledFromJS, bool aDialog, bool aNavigate, nsIArray* aArgv,
bool aIsPopupSpam, bool aForceNoOpener, bool aForceNoReferrer,
@@ -632,7 +631,7 @@ nsresult nsWindowWatcher::OpenWindowInternal(
}
nsresult nsWindowWatcher::OpenWindowInternal(
- mozIDOMWindowProxy* aParent, nsIURI* aUri, const nsACString& aName,
+ mozIDOMWindowProxy* aParent, nsIURI* aUri, const nsAString& aName,
const nsACString& aFeatures,
const mozilla::dom::UserActivation::Modifiers& aModifiers,
bool aCalledFromJS, bool aDialog, bool aNavigate, nsIArray* aArgv,
@@ -652,7 +651,7 @@ nsresult nsWindowWatcher::OpenWindowInternal(
bool uriToLoadIsChrome = false;
uint32_t chromeFlags;
- nsAutoString name; // string version of aName
+ nsAutoString name; // local copy of aName, voided if unspecified
nsCOMPtr<nsIDocShellTreeOwner>
parentTreeOwner; // from the parent window, if any
RefPtr<BrowsingContext> targetBC; // from the new window
@@ -686,7 +685,7 @@ nsresult nsWindowWatcher::OpenWindowInternal(
bool nameSpecified = false;
if (!aName.IsEmpty()) {
- CopyUTF8toUTF16(aName, name);
+ name.Assign(aName);
nameSpecified = true;
} else {
name.SetIsVoid(true);
diff --git a/toolkit/components/windowwatcher/nsWindowWatcher.h b/toolkit/components/windowwatcher/nsWindowWatcher.h
index d66bdbf1b68..47747541a55 100644
--- a/toolkit/components/windowwatcher/nsWindowWatcher.h
+++ b/toolkit/components/windowwatcher/nsWindowWatcher.h
@@ -92,13 +92,13 @@ class nsWindowWatcher : public nsIWindowWatcher,
// (which means called from script) or called via OpenWindow.
nsresult OpenWindowInternal(
mozIDOMWindowProxy* aParent, const nsACString& aUrl,
- const nsACString& aName, const nsACString& aFeatures,
+ const nsAString& aName, const nsACString& aFeatures,
const mozilla::dom::UserActivation::Modifiers& aModifiers,
bool aCalledFromJS, bool aDialog, bool aNavigate, nsIArray* aArgv,
bool aIsPopupSpam, bool aForceNoOpener, bool aForceNoReferrer, PrintKind,
nsDocShellLoadState* aLoadState, mozilla::dom::BrowsingContext** aResult);
nsresult OpenWindowInternal(
- mozIDOMWindowProxy* aParent, nsIURI* aUri, const nsACString& aName,
+ mozIDOMWindowProxy* aParent, nsIURI* aUri, const nsAString& aName,
const nsACString& aFeatures,
const mozilla::dom::UserActivation::Modifiers& aModifiers,
bool aCalledFromJS, bool aDialog, bool aNavigate, nsIArray* aArgv,
diff --git a/toolkit/xre/ProfileReset.cpp b/toolkit/xre/ProfileReset.cpp
index 09a5acf2097..0d4038417dc 100644
--- a/toolkit/xre/ProfileReset.cpp
+++ b/toolkit/xre/ProfileReset.cpp
@@ -114,9 +114,10 @@ nsresult ProfileResetCleanup(nsToolkitProfileService* aService,
if (!appStartup) return NS_ERROR_FAILURE;
nsCOMPtr<mozIDOMWindowProxy> progressWindow;
- rv = windowWatcher->OpenWindow(nullptr, nsDependentCString(kResetProgressURL),
- "_blank"_ns, "centerscreen,chrome,titlebar"_ns,
- nullptr, getter_AddRefs(progressWindow));
+ rv =
+ windowWatcher->OpenWindow(nullptr, nsDependentCString(kResetProgressURL),
+ u"_blank"_ns, "centerscreen,chrome,titlebar"_ns,
+ nullptr, getter_AddRefs(progressWindow));
if (NS_FAILED(rv)) return rv;
// Create a new thread to do the bulk of profile cleanup to stay responsive.
diff --git a/toolkit/xre/nsAppRunner.cpp b/toolkit/xre/nsAppRunner.cpp
index fb22d295623..e72ebc18f02 100644
--- a/toolkit/xre/nsAppRunner.cpp
+++ b/toolkit/xre/nsAppRunner.cpp
@@ -3096,7 +3096,7 @@ static ReturnAbortOnError ShowProfileDialog(
}
nsCOMPtr<mozIDOMWindowProxy> newWindow;
rv = windowWatcher->OpenWindow(nullptr, nsDependentCString(aDialogURL),
- "_blank"_ns, features, ioParamBlock,
+ u"_blank"_ns, features, ioParamBlock,
getter_AddRefs(newWindow));
NS_ENSURE_SUCCESS_LOG(rv, rv);
@@ -3604,7 +3604,7 @@ static ReturnAbortOnError HandleDetectedDowngrade(
}
nsCOMPtr<mozIDOMWindowProxy> newWindow;
rv = windowWatcher->OpenWindow(
- nullptr, nsDependentCString(kProfileDowngradeURL), "_blank"_ns,
+ nullptr, nsDependentCString(kProfileDowngradeURL), u"_blank"_ns,
features, paramBlock, getter_AddRefs(newWindow));
NS_ENSURE_SUCCESS(rv, rv);
diff --git a/widget/android/nsWindow.cpp b/widget/android/nsWindow.cpp
index 6cda914a721..d2bcff9b9bb 100644
--- a/widget/android/nsWindow.cpp
+++ b/widget/android/nsWindow.cpp
@@ -1886,8 +1886,8 @@ void GeckoViewSupport::Open(
chromeFlags += ",private";
}
nsCOMPtr<mozIDOMWindowProxy> domWindow;
- ww->OpenWindow(nullptr, url, nsDependentCString(aId->ToCString().get()),
- chromeFlags, androidView, getter_AddRefs(domWindow));
+ ww->OpenWindow(nullptr, url, aId->ToString(), chromeFlags, androidView,
+ getter_AddRefs(domWindow));
MOZ_RELEASE_ASSERT(domWindow);
nsCOMPtr<nsPIDOMWindowOuter> pdomWindow = nsPIDOMWindowOuter::From(domWindow);
diff --git a/widget/uikit/nsWindow.mm b/widget/uikit/nsWindow.mm
index f8749ea1737..c1c4c3deb34 100644
--- a/widget/uikit/nsWindow.mm
+++ b/widget/uikit/nsWindow.mm
@@ -41,6 +41,7 @@
#include "mozilla/BasicEvents.h"
#include "mozilla/EventForwards.h"
+#include "mozilla/MacStringHelpers.h"
#include "mozilla/ProfilerLabels.h"
#include "mozilla/TouchEvents.h"
#include "mozilla/dom/MouseEventBinding.h"
@@ -1289,12 +1290,12 @@ id<GeckoViewWindow> GeckoViewOpenWindow(NSString* aId,
chromeFlags += ",private";
}
+ nsAutoString windowId;
+ CopyNSStringToXPCOMString(aId, windowId);
+
nsCOMPtr<mozIDOMWindowProxy> domWindow;
- ww->OpenWindow(
- nullptr, url,
- nsDependentCString([aId UTF8String],
- [aId lengthOfBytesUsingEncoding:NSUTF8StringEncoding]),
- chromeFlags, iosView, getter_AddRefs(domWindow));
+ ww->OpenWindow(nullptr, url, windowId, chromeFlags, iosView,
+ getter_AddRefs(domWindow));
MOZ_RELEASE_ASSERT(domWindow);
nsCOMPtr<nsPIDOMWindowOuter> pdomWindow = nsPIDOMWindowOuter::From(domWindow);
diff --git a/widget/windows/nsPrintDialogWin.cpp b/widget/windows/nsPrintDialogWin.cpp
index 5edec5f8b6c..bb847b90928 100644
--- a/widget/windows/nsPrintDialogWin.cpp
+++ b/widget/windows/nsPrintDialogWin.cpp
@@ -185,7 +185,7 @@ nsresult nsPrintDialogServiceWin::DoDialog(mozIDOMWindowProxy* aParent,
nsCOMPtr<mozIDOMWindowProxy> dialog;
nsresult rv = mWatcher->OpenWindow(
- aParent, nsDependentCString(aChromeURL), "_blank"_ns,
+ aParent, nsDependentCString(aChromeURL), u"_blank"_ns,
"centerscreen,chrome,modal,titlebar"_ns, array, getter_AddRefs(dialog));
return rv;
Loading diff…
References
On This Page