Firefox · DOM
CVE-2026-16400
Logic Error in DOM
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/base/nsContentUtils.cpp |
modified | |
ifdom/reporting/ReportingUtils.cpp |
modified | |
nsAtomdom/reporting/ReportingUtils.h |
modified | |
ReportingUtilsdom/reporting/ReportingUtils.h |
modified | |
ifdom/security/featurepolicy/FeaturePolicyUtils.cpp |
modified |
Files Changed
dom/base/nsContentUtils.cppdom/reporting/ReportingUtils.cppdom/reporting/ReportingUtils.hdom/security/featurepolicy/FeaturePolicyUtils.cpp
Patch
diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp
index 264f64c35b2..4600cfde9c4 100644
--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@@ -5522,14 +5522,8 @@ void nsContentUtils::ReportDeprecation(
MOZ_ASSERT(aGlobal);
MOZ_ASSERT(aURI);
- // If the URI has the data scheme, report that instead of the spec,
- // as the spec may be arbitrarily long and we would like to avoid
- // copying it.
- nsAutoCString specOrScheme;
- nsresult rv = nsContentUtils::AnonymizeURI(aURI, specOrScheme);
- if (NS_WARN_IF(NS_FAILED(rv))) {
- return;
- }
+ nsAutoCString url;
+ ReportingUtils::StripURL(aURI, url);
const char* operation =
kDeprecatedOperations[static_cast<size_t>(aOperation)];
@@ -5542,25 +5536,27 @@ void nsContentUtils::ReportDeprecation(
// XXX do we really want the localized string for deprecation report?
nsAutoString msg;
- rv = nsContentUtils::GetMaybeLocalizedString(PropertiesFile::DOM_PROPERTIES,
- key.get(), aDoc, msg);
+ nsresult rv = nsContentUtils::GetMaybeLocalizedString(
+ PropertiesFile::DOM_PROPERTIES, key.get(), aDoc, msg);
if (NS_WARN_IF(NS_FAILED(rv))) {
return;
}
Nullable<uint32_t> lineNumber;
Nullable<uint32_t> columnNumber;
+ nsAutoCString sourceFile;
if (aLocation) {
lineNumber.SetValue(aLocation.mLine);
columnNumber.SetValue(aLocation.mColumn);
+ ReportingUtils::StripLocationFileName(aLocation, sourceFile);
}
RefPtr<DeprecationReportBody> body =
new DeprecationReportBody(aGlobal, type, nullptr /* date */, msg,
- aLocation.FileName(), lineNumber, columnNumber);
+ sourceFile, lineNumber, columnNumber);
ReportingUtils::Report(aGlobal, nsGkAtoms::deprecation, u"default"_ns,
- NS_ConvertUTF8toUTF16(specOrScheme), body);
+ NS_ConvertUTF8toUTF16(url), body);
}
void nsContentUtils::LogMessageToConsole(const char* aMsg) {
diff --git a/dom/reporting/ReportingUtils.cpp b/dom/reporting/ReportingUtils.cpp
index 4a481617108..9db668720c7 100644
--- a/dom/reporting/ReportingUtils.cpp
+++ b/dom/reporting/ReportingUtils.cpp
@@ -42,6 +42,22 @@ void ReportingUtils::StripURL(nsIURI* aURI, nsACString& outStrippedURL) {
stripped->GetSpec(outStrippedURL);
}
+// static
+void ReportingUtils::StripLocationFileName(
+ const mozilla::JSCallingLocation& aLocation,
+ nsACString& outStrippedFileName) {
+ nsCOMPtr<nsIURI> uri;
+ if (aLocation.mResource.is<nsCOMPtr<nsIURI>>()) {
+ uri = aLocation.mResource.as<nsCOMPtr<nsIURI>>();
+ } else {
+ (void)NS_NewURI(getter_AddRefs(uri), aLocation.FileName());
+ }
+
+ if (uri) {
+ ReportingUtils::StripURL(uri, outStrippedFileName);
+ }
+}
+
// static
void ReportingUtils::Report(nsIGlobalObject* aGlobal, nsAtom* aType,
const nsAString& aGroupName, const nsAString& aURL,
diff --git a/dom/reporting/ReportingUtils.h b/dom/reporting/ReportingUtils.h
index c6aba30112b..752f313ce13 100644
--- a/dom/reporting/ReportingUtils.h
+++ b/dom/reporting/ReportingUtils.h
@@ -5,6 +5,7 @@
#ifndef mozilla_dom_ReportingUtils_h
#define mozilla_dom_ReportingUtils_h
+#include "mozilla/SourceLocation.h"
#include "nsString.h"
class nsAtom;
@@ -19,6 +20,8 @@ class ReportBody;
class ReportingUtils final {
public:
static void StripURL(nsIURI* aURI, nsACString& outStrippedURL);
+ static void StripLocationFileName(const mozilla::JSCallingLocation& aLocation,
+ nsACString& outStrippedFileName);
static void Report(nsIGlobalObject* aGlobal, nsAtom* aType,
const nsAString& aGroupName, const nsAString& aURL,
diff --git a/dom/security/featurepolicy/FeaturePolicyUtils.cpp b/dom/security/featurepolicy/FeaturePolicyUtils.cpp
index f8208bfed77..656117208c1 100644
--- a/dom/security/featurepolicy/FeaturePolicyUtils.cpp
+++ b/dom/security/featurepolicy/FeaturePolicyUtils.cpp
@@ -215,14 +215,9 @@ void FeaturePolicyUtils::ReportViolation(Document* aDocument,
return;
}
- // Strip the URL of any possible username/password and make it ready to be
- // presented in the UI.
- nsCOMPtr<nsIURI> exposableURI = net::nsIOService::CreateExposableURI(uri);
- nsAutoCString spec;
- nsresult rv = exposableURI->GetSpec(spec);
- if (NS_WARN_IF(NS_FAILED(rv))) {
- return;
- }
+ nsAutoCString url;
+ ReportingUtils::StripURL(uri, url);
+
JSContext* cx = nsContentUtils::GetCurrentJSContext();
if (NS_WARN_IF(!cx)) {
return;
@@ -230,10 +225,11 @@ void FeaturePolicyUtils::ReportViolation(Document* aDocument,
Nullable<int32_t> lineNumber;
Nullable<int32_t> columnNumber;
- auto loc = JSCallingLocation::Get();
- if (loc) {
+ nsAutoCString sourceFile;
+ if (auto loc = JSCallingLocation::Get()) {
lineNumber.SetValue(static_cast<int32_t>(loc.mLine));
columnNumber.SetValue(static_cast<int32_t>(loc.mColumn));
+ ReportingUtils::StripLocationFileName(loc, sourceFile);
}
nsPIDOMWindowInner* window = aDocument->GetInnerWindow();
@@ -243,11 +239,11 @@ void FeaturePolicyUtils::ReportViolation(Document* aDocument,
RefPtr<FeaturePolicyViolationReportBody> body =
new FeaturePolicyViolationReportBody(window->AsGlobal(), aFeatureName,
- loc.FileName(), lineNumber,
- columnNumber, u"enforce"_ns);
+ sourceFile, lineNumber, columnNumber,
+ u"enforce"_ns);
ReportingUtils::Report(window->AsGlobal(), nsGkAtoms::featurePolicyViolation,
- u"default"_ns, NS_ConvertUTF8toUTF16(spec), body);
+ u"default"_ns, NS_ConvertUTF8toUTF16(url), body);
}
} // namespace dom
Loading diff…
References
On This Page