Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionInformation disclosure in the DOM: Security component
ComponentDOM
Bug ClassLogic Error
Tracker2050430
Fix commitcaafcdcb8aea (firefox) +36/-25
CISA KEVNot listed
CreditedRintaro Kawasugi
Disclosed2026-07-21

Changed Functions

FunctionChangeNotes
if
dom/base/nsContentUtils.cpp
modified
if
dom/reporting/ReportingUtils.cpp
modified
nsAtom
dom/reporting/ReportingUtils.h
modified
ReportingUtils
dom/reporting/ReportingUtils.h
modified
if
dom/security/featurepolicy/FeaturePolicyUtils.cpp
modified

Files Changed

  • dom/base/nsContentUtils.cpp
  • dom/reporting/ReportingUtils.cpp
  • dom/reporting/ReportingUtils.h
  • dom/security/featurepolicy/FeaturePolicyUtils.cpp
diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp
index 264f64c35b2..4600cfde9c4 100644
--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@@ -5522,14 +5522,8 @@ void nsContentUtils::ReportDeprecation(
   MOZ_ASSERT(aGlobal);
   MOZ_ASSERT(aURI);
 
-  // If the URI has the data scheme, report that instead of the spec,
-  // as the spec may be arbitrarily long and we would like to avoid
-  // copying it.
-  nsAutoCString specOrScheme;
-  nsresult rv = nsContentUtils::AnonymizeURI(aURI, specOrScheme);
-  if (NS_WARN_IF(NS_FAILED(rv))) {
-    return;
-  }
+  nsAutoCString url;
+  ReportingUtils::StripURL(aURI, url);
 
   const char* operation =
       kDeprecatedOperations[static_cast<size_t>(aOperation)];
@@ -5542,25 +5536,27 @@ void nsContentUtils::ReportDeprecation(
 
   // XXX do we really want the localized string for deprecation report?
   nsAutoString msg;
-  rv = nsContentUtils::GetMaybeLocalizedString(PropertiesFile::DOM_PROPERTIES,
-                                               key.get(), aDoc, msg);
+  nsresult rv = nsContentUtils::GetMaybeLocalizedString(
+      PropertiesFile::DOM_PROPERTIES, key.get(), aDoc, msg);
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return;
   }
 
   Nullable<uint32_t> lineNumber;
   Nullable<uint32_t> columnNumber;
+  nsAutoCString sourceFile;
   if (aLocation) {
     lineNumber.SetValue(aLocation.mLine);
     columnNumber.SetValue(aLocation.mColumn);
+    ReportingUtils::StripLocationFileName(aLocation, sourceFile);
   }
 
   RefPtr<DeprecationReportBody> body =
       new DeprecationReportBody(aGlobal, type, nullptr /* date */, msg,
-                                aLocation.FileName(), lineNumber, columnNumber);
+                                sourceFile, lineNumber, columnNumber);
 
   ReportingUtils::Report(aGlobal, nsGkAtoms::deprecation, u"default"_ns,
-                         NS_ConvertUTF8toUTF16(specOrScheme), body);
+                         NS_ConvertUTF8toUTF16(url), body);
 }
 
 void nsContentUtils::LogMessageToConsole(const char* aMsg) {
diff --git a/dom/reporting/ReportingUtils.cpp b/dom/reporting/ReportingUtils.cpp
index 4a481617108..9db668720c7 100644
--- a/dom/reporting/ReportingUtils.cpp
+++ b/dom/reporting/ReportingUtils.cpp
@@ -42,6 +42,22 @@ void ReportingUtils::StripURL(nsIURI* aURI, nsACString& outStrippedURL) {
   stripped->GetSpec(outStrippedURL);
 }
 
+// static
+void ReportingUtils::StripLocationFileName(
+    const mozilla::JSCallingLocation& aLocation,
+    nsACString& outStrippedFileName) {
+  nsCOMPtr<nsIURI> uri;
+  if (aLocation.mResource.is<nsCOMPtr<nsIURI>>()) {
+    uri = aLocation.mResource.as<nsCOMPtr<nsIURI>>();
+  } else {
+    (void)NS_NewURI(getter_AddRefs(uri), aLocation.FileName());
+  }
+
+  if (uri) {
+    ReportingUtils::StripURL(uri, outStrippedFileName);
+  }
+}
+
 // static
 void ReportingUtils::Report(nsIGlobalObject* aGlobal, nsAtom* aType,
                             const nsAString& aGroupName, const nsAString& aURL,
diff --git a/dom/reporting/ReportingUtils.h b/dom/reporting/ReportingUtils.h
index c6aba30112b..752f313ce13 100644
--- a/dom/reporting/ReportingUtils.h
+++ b/dom/reporting/ReportingUtils.h
@@ -5,6 +5,7 @@
 #ifndef mozilla_dom_ReportingUtils_h
 #define mozilla_dom_ReportingUtils_h
 
+#include "mozilla/SourceLocation.h"
 #include "nsString.h"
 
 class nsAtom;
@@ -19,6 +20,8 @@ class ReportBody;
 class ReportingUtils final {
  public:
   static void StripURL(nsIURI* aURI, nsACString& outStrippedURL);
+  static void StripLocationFileName(const mozilla::JSCallingLocation& aLocation,
+                                    nsACString& outStrippedFileName);
 
   static void Report(nsIGlobalObject* aGlobal, nsAtom* aType,
                      const nsAString& aGroupName, const nsAString& aURL,
diff --git a/dom/security/featurepolicy/FeaturePolicyUtils.cpp b/dom/security/featurepolicy/FeaturePolicyUtils.cpp
index f8208bfed77..656117208c1 100644
--- a/dom/security/featurepolicy/FeaturePolicyUtils.cpp
+++ b/dom/security/featurepolicy/FeaturePolicyUtils.cpp
@@ -215,14 +215,9 @@ void FeaturePolicyUtils::ReportViolation(Document* aDocument,
     return;
   }
 
-  // Strip the URL of any possible username/password and make it ready to be
-  // presented in the UI.
-  nsCOMPtr<nsIURI> exposableURI = net::nsIOService::CreateExposableURI(uri);
-  nsAutoCString spec;
-  nsresult rv = exposableURI->GetSpec(spec);
-  if (NS_WARN_IF(NS_FAILED(rv))) {
-    return;
-  }
+  nsAutoCString url;
+  ReportingUtils::StripURL(uri, url);
+
   JSContext* cx = nsContentUtils::GetCurrentJSContext();
   if (NS_WARN_IF(!cx)) {
     return;
@@ -230,10 +225,11 @@ void FeaturePolicyUtils::ReportViolation(Document* aDocument,
 
   Nullable<int32_t> lineNumber;
   Nullable<int32_t> columnNumber;
-  auto loc = JSCallingLocation::Get();
-  if (loc) {
+  nsAutoCString sourceFile;
+  if (auto loc = JSCallingLocation::Get()) {
     lineNumber.SetValue(static_cast<int32_t>(loc.mLine));
     columnNumber.SetValue(static_cast<int32_t>(loc.mColumn));
+    ReportingUtils::StripLocationFileName(loc, sourceFile);
   }
 
   nsPIDOMWindowInner* window = aDocument->GetInnerWindow();
@@ -243,11 +239,11 @@ void FeaturePolicyUtils::ReportViolation(Document* aDocument,
 
   RefPtr<FeaturePolicyViolationReportBody> body =
       new FeaturePolicyViolationReportBody(window->AsGlobal(), aFeatureName,
-                                           loc.FileName(), lineNumber,
-                                           columnNumber, u"enforce"_ns);
+                                           sourceFile, lineNumber, columnNumber,
+                                           u"enforce"_ns);
 
   ReportingUtils::Report(window->AsGlobal(), nsGkAtoms::featurePolicyViolation,
-                         u"default"_ns, NS_ConvertUTF8toUTF16(spec), body);
+                         u"default"_ns, NS_ConvertUTF8toUTF16(url), body);
 }
 
 }  // namespace dom
Loading diff…