Firefox · DOM
CVE-2026-2805
Logic Error in DOM
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/html/HTMLDialogElement.cpp |
modified |
Files Changed
dom/html/HTMLDialogElement.cppdom/html/HTMLDialogElement.h
Patch
diff --git a/dom/html/HTMLDialogElement.cpp b/dom/html/HTMLDialogElement.cpp
index a0e7cf681f6..a202ad2e700 100644
--- a/dom/html/HTMLDialogElement.cpp
+++ b/dom/html/HTMLDialogElement.cpp
@@ -71,7 +71,7 @@ class DialogCloseWatcherListener : public nsIDOMEventListener {
// 3. - closeAction being to close the dialog given dialog, dialog's
// request close return value, and dialog's request close source
// element.
- Optional<nsAString> retValue;
+ Maybe<nsAutoString> retValue;
dialog->GetRequestCloseReturnValue(retValue);
RefPtr<Element> source = dialog->GetRequestCloseSourceElement();
dialog->Close(source, retValue);
@@ -144,8 +144,8 @@ bool HTMLDialogElement::ParseAttribute(int32_t aNamespaceID, nsAtom* aAttribute,
// https://html.spec.whatwg.org/#dom-dialog-close
// https://html.spec.whatwg.org/#close-the-dialog
-void HTMLDialogElement::Close(
- Element* aSource, const mozilla::dom::Optional<nsAString>& aReturnValue) {
+void HTMLDialogElement::Close(Element* aSource,
+ const Maybe<nsAutoString>& aReturnValue) {
// 1. If subject does not have an open attribute, then return.
if (!Open()) {
return;
@@ -176,8 +176,8 @@ void HTMLDialogElement::Close(
// 9. If result is not null, then set subject's returnValue attribute to
// result.
- if (aReturnValue.WasPassed()) {
- SetReturnValue(aReturnValue.Value());
+ if (aReturnValue.isSome()) {
+ SetReturnValue(aReturnValue.ref());
}
// 10. Set subject's request close return value to null.
@@ -217,8 +217,8 @@ void HTMLDialogElement::Close(
// https://html.spec.whatwg.org/#dom-dialog-requestclose
// https://html.spec.whatwg.org/#dialog-request-close
-void HTMLDialogElement::RequestClose(
- Element* aSource, const mozilla::dom::Optional<nsAString>& aReturnValue) {
+void HTMLDialogElement::RequestClose(Element* aSource,
+ const Maybe<nsAutoString>& aReturnValue) {
RefPtr closeWatcher = mCloseWatcher;
// 1. If subject does not have an open attribute, then return.
if (!Open()) {
@@ -245,8 +245,8 @@ void HTMLDialogElement::RequestClose(
}
// 5. Set subject's request close return value to returnValue.
- if (aReturnValue.WasPassed()) {
- SetRequestCloseReturnValue(aReturnValue.Value());
+ if (aReturnValue.isSome()) {
+ SetRequestCloseReturnValue(aReturnValue.ref());
}
// 6. Set subject's request close source element to source.
@@ -624,7 +624,7 @@ void HTMLDialogElement::RunCancelDialogSteps() {
// the spec, over CloseWatcher though, so one day this code will need to be
// refactored when the CloseWatcher specifications settle.
if (defaultAction) {
- Optional<nsAString> retValue;
+ Maybe<nsAutoString> retValue;
GetRequestCloseReturnValue(retValue);
RefPtr<Element> source = GetRequestCloseSourceElement();
Close(source, retValue);
@@ -648,19 +648,18 @@ bool HTMLDialogElement::HandleCommandInternal(Element* aSource,
if ((aCommand == Command::Close || aCommand == Command::RequestClose) &&
Open()) {
- Optional<nsAString> retValueOpt;
- nsString retValue;
+ Maybe<nsAutoString> retValue;
if (aSource->HasAttr(nsGkAtoms::value)) {
if (auto* button = HTMLButtonElement::FromNodeOrNull(aSource)) {
- button->GetValue(retValue);
- retValueOpt = &retValue;
+ retValue.emplace();
+ button->GetValue(retValue.ref());
}
}
if (aCommand == Command::Close) {
- Close(aSource, retValueOpt);
+ Close(aSource, retValue);
} else {
MOZ_ASSERT(aCommand == Command::RequestClose);
- RequestClose(aSource, retValueOpt);
+ RequestClose(aSource, retValue);
}
return true;
}
diff --git a/dom/html/HTMLDialogElement.h b/dom/html/HTMLDialogElement.h
index a45dbf9b191..d265f5a287b 100644
--- a/dom/html/HTMLDialogElement.h
+++ b/dom/html/HTMLDialogElement.h
@@ -59,9 +59,9 @@ class HTMLDialogElement final : public nsGenericHTMLElement {
mReturnValue = aReturnValue;
}
- void GetRequestCloseReturnValue(Optional<nsAString>& aReturnValue) {
+ void GetRequestCloseReturnValue(Maybe<nsAutoString>& aReturnValue) {
if (mRequestCloseReturnValue.isSome()) {
- aReturnValue = &mRequestCloseReturnValue.ref();
+ aReturnValue.emplace(mRequestCloseReturnValue.ref());
}
}
void ClearRequestCloseReturnValue() { mRequestCloseReturnValue.reset(); }
@@ -74,16 +74,24 @@ class HTMLDialogElement final : public nsGenericHTMLElement {
MOZ_CAN_RUN_SCRIPT_BOUNDARY void Close(
const mozilla::dom::Optional<nsAString>& aReturnValue) {
- return Close(nullptr, aReturnValue);
+ Maybe<nsAutoString> retValueCopy;
+ if (aReturnValue.WasPassed()) {
+ retValueCopy.emplace(aReturnValue.Value());
+ }
+ return Close(nullptr, retValueCopy);
}
MOZ_CAN_RUN_SCRIPT_BOUNDARY void Close(
- Element* aSource, const mozilla::dom::Optional<nsAString>& aReturnValue);
+ Element* aSource, const Maybe<nsAutoString>& aReturnValue);
MOZ_CAN_RUN_SCRIPT void RequestClose(
const mozilla::dom::Optional<nsAString>& aReturnValue) {
- RequestClose(nullptr, aReturnValue);
+ Maybe<nsAutoString> retValueCopy;
+ if (aReturnValue.WasPassed()) {
+ retValueCopy.emplace(aReturnValue.Value());
+ }
+ RequestClose(nullptr, retValueCopy);
}
MOZ_CAN_RUN_SCRIPT_BOUNDARY void RequestClose(
- Element* aSource, const mozilla::dom::Optional<nsAString>& aReturnValue);
+ Element* aSource, const Maybe<nsAutoString>& aReturnValue);
RefPtr<Element> GetRequestCloseSourceElement();
Loading diff…
References
On This Page