Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionMitigation bypass in the DOM: Networking component
ComponentDOM
Bug ClassLogic Error
Tracker2041902
Fix commit20d7ad5ebb76 (firefox) +19/-20
CISA KEVNot listed
CreditedIbuki Sato and Tomoya Nakanishi
Disclosed2026-07-21

Changed Functions

FunctionChangeNotes
if
dom/webtransport/api/WebTransport.cpp
modified

Files Changed

  • dom/webtransport/api/WebTransport.cpp
  • dom/webtransport/parent/WebTransportParent.cpp
  • dom/webtransport/parent/WebTransportParent.h
  • ipc/glue/BackgroundParentImpl.cpp
  • ipc/glue/BackgroundParentImpl.h
  • ipc/glue/PBackground.ipdl
diff --git a/dom/webtransport/api/WebTransport.cpp b/dom/webtransport/api/WebTransport.cpp
index 332dba455d1..23525bc5884 100644
--- a/dom/webtransport/api/WebTransport.cpp
+++ b/dom/webtransport/api/WebTransport.cpp
@@ -287,13 +287,12 @@ void WebTransport::Init(const GlobalObject& aGlobal, const nsAString& aURL,
     return;
   }
 
-  if (mGlobal->GetClientInfo().isNothing()) {
-    aError.Throw(NS_ERROR_DOM_INVALID_STATE_ERR);
-    return;
-  }
-  IPCClientInfo ipcClientInfo = mGlobal->GetClientInfo().ref().ToIPC();
-
   nsCOMPtr<nsIPrincipal> principal = mGlobal->PrincipalOrNull();
+  mozilla::Maybe<IPCClientInfo> ipcClientInfo;
+
+  if (mGlobal->GetClientInfo().isSome()) {
+    ipcClientInfo = mozilla::Some(mGlobal->GetClientInfo().ref().ToIPC());
+  }
 
   nsPIDOMWindowInner* window = mGlobal->GetAsInnerWindow();
   if (window) {
diff --git a/dom/webtransport/parent/WebTransportParent.cpp b/dom/webtransport/parent/WebTransportParent.cpp
index ff25539eb8f..2a56118b34d 100644
--- a/dom/webtransport/parent/WebTransportParent.cpp
+++ b/dom/webtransport/parent/WebTransportParent.cpp
@@ -33,9 +33,9 @@ WebTransportParent::~WebTransportParent() {
 
 void WebTransportParent::Create(
     const nsAString& aURL, nsIPrincipal* aPrincipal,
-    const uint64_t& aBrowsingContextID, const IPCClientInfo& aClientInfo,
-    const bool& aDedicated, const bool& aRequireUnreliable,
-    const uint32_t& aCongestionControl,
+    const uint64_t& aBrowsingContextID,
+    const mozilla::Maybe<IPCClientInfo>& aClientInfo, const bool& aDedicated,
+    const bool& aRequireUnreliable, const uint32_t& aCongestionControl,
     nsTArray<WebTransportHash>&& aServerCertHashes,
     Endpoint<PWebTransportParent>&& aParentEndpoint,
     std::function<void(std::tuple<const nsresult&, const uint8_t&>)>&&
@@ -93,11 +93,11 @@ void WebTransportParent::Create(
        nsServerCertHashes = std::move(nsServerCertHashes),
        principal = RefPtr{aPrincipal}, browsingContextID = aBrowsingContextID,
        flags = nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL,
-       clientInfo = ClientInfo{aClientInfo}] {
+       clientInfo = aClientInfo] {
         LOG(("WebTransport %p AsyncConnect", self.get()));
         if (NS_FAILED(self->mWebTransport->AsyncConnectWithClient(
                 uri, dedicated, std::move(nsServerCertHashes), principal,
-                browsingContextID, flags, self, Some(clientInfo),
+                browsingContextID, flags, self, clientInfo,
                 nsIWebTransport::HTTPVersion::h3))) {
           LOG(("AsyncConnect failure; we should get OnSessionClosed"));
         }
diff --git a/dom/webtransport/parent/WebTransportParent.h b/dom/webtransport/parent/WebTransportParent.h
index 766026317dd..1215e99fbf5 100644
--- a/dom/webtransport/parent/WebTransportParent.h
+++ b/dom/webtransport/parent/WebTransportParent.h
@@ -33,8 +33,8 @@ class WebTransportParent : public PWebTransportParent,
 
   void Create(const nsAString& aURL, nsIPrincipal* aPrincipal,
               const uint64_t& aBrowsingContextID,
-              const IPCClientInfo& aClientInfo, const bool& aDedicated,
-              const bool& aRequireUnreliable,
+              const mozilla::Maybe<IPCClientInfo>& aClientInfo,
+              const bool& aDedicated, const bool& aRequireUnreliable,
               const uint32_t& aCongestionControl,
               nsTArray<WebTransportHash>&& aServerCertHashes,
               Endpoint<PWebTransportParent>&& aParentEndpoint,
diff --git a/ipc/glue/BackgroundParentImpl.cpp b/ipc/glue/BackgroundParentImpl.cpp
index 65e6c92d41f..95dd1148a1a 100644
--- a/ipc/glue/BackgroundParentImpl.cpp
+++ b/ipc/glue/BackgroundParentImpl.cpp
@@ -463,9 +463,9 @@ mozilla::ipc::IPCResult BackgroundParentImpl::RecvCreateFileSystemManagerParent(
 
 mozilla::ipc::IPCResult BackgroundParentImpl::RecvCreateWebTransportParent(
     const nsAString& aURL, nsIPrincipal* aPrincipal,
-    const uint64_t& aBrowsingContextID, const IPCClientInfo& aClientInfo,
-    const bool& aDedicated, const bool& aRequireUnreliable,
-    const uint32_t& aCongestionControl,
+    const uint64_t& aBrowsingContextID,
+    const mozilla::Maybe<IPCClientInfo>& aClientInfo, const bool& aDedicated,
+    const bool& aRequireUnreliable, const uint32_t& aCongestionControl,
     nsTArray<WebTransportHash>&& aServerCertHashes,
     Endpoint<PWebTransportParent>&& aParentEndpoint,
     CreateWebTransportParentResolver&& aResolver) {
diff --git a/ipc/glue/BackgroundParentImpl.h b/ipc/glue/BackgroundParentImpl.h
index 8a6f056be76..429fd9b3f57 100644
--- a/ipc/glue/BackgroundParentImpl.h
+++ b/ipc/glue/BackgroundParentImpl.h
@@ -121,9 +121,9 @@ class BackgroundParentImpl : public PBackgroundParent {
 
   mozilla::ipc::IPCResult RecvCreateWebTransportParent(
       const nsAString& aURL, nsIPrincipal* aPrincipal,
-      const uint64_t& aBrowsingContextID, const IPCClientInfo& aClientInfo,
-      const bool& aDedicated, const bool& aRequireUnreliable,
-      const uint32_t& aCongestionControl,
+      const uint64_t& aBrowsingContextID,
+      const mozilla::Maybe<IPCClientInfo>& aClientInfo, const bool& aDedicated,
+      const bool& aRequireUnreliable, const uint32_t& aCongestionControl,
       nsTArray<WebTransportHash>&& aServerCertHashes,
       Endpoint<PWebTransportParent>&& aParentEndpoint,
       CreateWebTransportParentResolver&& aResolver) override;
diff --git a/ipc/glue/PBackground.ipdl b/ipc/glue/PBackground.ipdl
index bfc523c53e0..3575bc03208 100644
--- a/ipc/glue/PBackground.ipdl
+++ b/ipc/glue/PBackground.ipdl
@@ -178,7 +178,7 @@ parent:
       nsString aURL,
       nullable nsIPrincipal aPrincipal,
       uint64_t aBrowsingContextID,
-      IPCClientInfo aClientInfo,
+      IPCClientInfo?  aClientInfo,
       bool aDedicated,
       bool aRequireUnreliable,
       uint32_t aCongestionControl,
Loading diff…