Firefox · DOM
CVE-2026-12309
Logic Error in DOM
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
dom/base/nsContentUtils.cpp
Patch
diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp
index 9e696280346..392d88c6171 100644
--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@@ -10797,19 +10797,24 @@ static CheckedInt<uint32_t> ExtraSpaceNeededForAttrEncoding(
return CheckedInt<uint32_t>(numEncodedChars) * maxCharExtraSpace;
}
+static void AppendEncodedAtomAttributeValue(nsAtom* aAtom,
+ StringBuilder& aBuilder) {
+ nsDependentAtomString atomStr(aAtom);
+ auto space = ExtraSpaceNeededForAttrEncoding(atomStr);
+ if (space.isValid() && !space.value()) {
+ aBuilder.Append(aAtom);
+ } else {
+ aBuilder.AppendWithAttrEncode(nsString(atomStr), space + atomStr.Length());
+ }
+}
+
static void AppendEncodedAttributeValue(const nsAttrValue& aValue,
StringBuilder& aBuilder) {
if (nsAtom* atom = aValue.GetStoredAtom()) {
- nsDependentAtomString atomStr(atom);
- auto space = ExtraSpaceNeededForAttrEncoding(atomStr);
- if (space.isValid() && !space.value()) {
- aBuilder.Append(atom);
- } else {
- aBuilder.AppendWithAttrEncode(nsString(atomStr),
- space + atomStr.Length());
- }
+ AppendEncodedAtomAttributeValue(atom, aBuilder);
return;
}
+
// NOTE(emilio): In most cases this will just be a reference to the stored
// nsStringBuffer.
nsString str;
@@ -10838,7 +10843,7 @@ static void StartElement(Element* aElement, StringBuilder& aBuilder) {
nsAtom* isAttr = ceData->GetIs(aElement);
if (isAttr && !aElement->HasAttr(nsGkAtoms::is)) {
aBuilder.Append(uR"( is=")");
- aBuilder.Append(isAttr);
+ AppendEncodedAtomAttributeValue(isAttr, aBuilder);
aBuilder.Append(uR"(")");
}
}
Loading diff…
References
On This Page