Firefox · Widget
CVE-2026-12322
Logic Error in Widget
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
forwidget/gtk/nsFilePicker.cpp |
modified | |
switchwidget/gtk/nsFilePicker.cpp |
modified |
Files Changed
widget/gtk/nsFilePicker.cpp
Patch
diff --git a/widget/gtk/nsFilePicker.cpp b/widget/gtk/nsFilePicker.cpp
index bfe6b88ec0c..dde3f3d7833 100644
--- a/widget/gtk/nsFilePicker.cpp
+++ b/widget/gtk/nsFilePicker.cpp
@@ -52,6 +52,14 @@ using mozilla::dom::Promise;
static nsIFile* sPrevDisplayDirectory = nullptr;
+// Use an application-defined response ID (non-negative) for the accept button
+// instead of GTK_RESPONSE_ACCEPT (-3). GTK's built-in negative response IDs
+// cause the button to be treated as the dialog's default widget, meaning it
+// activates on Enter. A non-negative ID prevents this, so a page that tricks
+// the user into holding Enter before the dialog appears cannot auto-confirm
+// an unintended file upload. See bug 2033848 and the equivalent Chrome fix.
+static const gint kFilePickerAccept = 0;
+
void nsFilePicker::Shutdown() { NS_IF_RELEASE(sPrevDisplayDirectory); }
#ifdef MOZ_ENABLE_DBUS
@@ -690,7 +698,7 @@ void nsFilePicker::OpenNonPortal() {
GtkFileChooser* file_chooser = GTK_FILE_CHOOSER(gtk_file_chooser_dialog_new(
title.get(), parent_widget, action, g_dgettext("gtk30", "_Cancel"),
- GTK_RESPONSE_CANCEL, accept_button, GTK_RESPONSE_ACCEPT, nullptr));
+ GTK_RESPONSE_CANCEL, accept_button, kFilePickerAccept, nullptr));
// If we have --enable-proxy-bypass-protection, then don't allow
// remote URLs to be used.
@@ -766,11 +774,6 @@ void nsFilePicker::OpenNonPortal() {
}
}
- if (GTK_IS_DIALOG(file_chooser)) {
- gtk_dialog_set_default_response(GTK_DIALOG(file_chooser),
- GTK_RESPONSE_ACCEPT);
- }
-
size_t count = mFilters.Length();
for (size_t i = 0; i < count; ++i) {
GtkFileFilter* filter = NewFilter(mFilters[i], mFilterNames[i]);
@@ -875,7 +878,8 @@ void nsFilePicker::DoneNonPortal(GtkWidget* file_chooser, gint response) {
nsIFilePicker::ResultCode result;
switch (response) {
case GTK_RESPONSE_OK:
- case GTK_RESPONSE_ACCEPT:
+ case GTK_RESPONSE_ACCEPT: // emitted by GTK internally on double-click
+ case kFilePickerAccept:
ReadValuesFromNonPortalFileChooser(GTK_FILE_CHOOSER(file_chooser));
result = nsIFilePicker::returnOK;
break;
Loading diff…
References
On This Page