CVE-2026-4717

Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium

Severity

—

CVSS

Exploited ITW

Fixed

Fix Status

Impactmoderate

DescriptionPrivilege escalation in the Netmonitor component

ComponentCore

Bug ClassLogic Error

Tracker2021695

Fix commitf605669eb235 (firefox) +69/-34

CISA KEVNot listed

CreditedSatoki Tsuji

Disclosed2026-03-24

Changed Functions

Function	Change	Notes
`add_task` devtools/client/netmonitor/test/browser_net_copy_as_fetch.js	modified
`if` devtools/client/netmonitor/test/browser_net_copy_as_fetch.js	modified

Files Changed

devtools/client/netmonitor/src/widgets/RequestListContextMenu.js
devtools/client/netmonitor/test/browser_net_copy_as_fetch.js

Patch

view commit

diff --git a/devtools/client/netmonitor/src/widgets/RequestListContextMenu.js b/devtools/client/netmonitor/src/widgets/RequestListContextMenu.js
index 10d6c362c3d..a0605751642 100644
--- a/devtools/client/netmonitor/src/widgets/RequestListContextMenu.js
+++ b/devtools/client/netmonitor/src/widgets/RequestListContextMenu.js
@@ -746,7 +746,7 @@ class RequestListContextMenu {
     };
 
     const options = JSON.stringify(fetchOptions, null, 4);
-    const fetchString = `await fetch("${url}", ${options});`;
+    const fetchString = `await fetch(${JSON.stringify(url)}, ${options});`;
     return fetchString;
   }
 
diff --git a/devtools/client/netmonitor/test/browser_net_copy_as_fetch.js b/devtools/client/netmonitor/test/browser_net_copy_as_fetch.js
index 517e9e54f87..e8589e097df 100644
--- a/devtools/client/netmonitor/test/browser_net_copy_as_fetch.js
+++ b/devtools/client/netmonitor/test/browser_net_copy_as_fetch.js
@@ -7,7 +7,7 @@
  * Tests if Copy as Fetch works.
  */
 
-add_task(async function () {
+add_task(async function testBasicCopyAsFetch() {
   const { tab, monitor } = await initNetMonitor(HTTPS_CURL_URL, {
     requestCount: 1,
   });
@@ -15,7 +15,9 @@ add_task(async function () {
 
   // GET request, no cookies (first request)
   await performRequest("GET");
-  await testClipboardContent(`await fetch("https://example.com/browser/devtools/client/netmonitor/test/sjs_simple-test-server.sjs", {
+  await testClipboardContent(
+    monitor,
+    `await fetch("https://example.com/browser/devtools/client/netmonitor/test/sjs_simple-test-server.sjs", {
     "credentials": "omit",
     "headers": {
         "User-Agent": "${navigator.userAgent}",
@@ -33,7 +35,8 @@ add_task(async function () {
     "referrer": "https://example.com/browser/devtools/client/netmonitor/test/html_copy-as-curl.html",
     "method": "GET",
     "mode": "cors"
-});`);
+});`
+  );
 
   await teardown(monitor);
 
@@ -54,39 +57,71 @@ add_task(async function () {
     );
     await waitRequest;
   }
+});
 
-  async function testClipboardContent(expectedResult) {
-    const { document } = monitor.panelWin;
+/**
+ * Tests for Url escaping of copy as Fetch
+ */
+add_task(async function testUrlEscapeOfCopyAsFetch() {
+  const { monitor } = await initNetMonitor(HTTPS_CURL_URL, {
+    requestCount: 1,
+  });
+  info("Starting test... ");
 
-    const items = document.querySelectorAll(".request-list-item");
-    EventUtils.sendMouseEvent({ type: "mousedown" }, items[items.length - 1]);
-    EventUtils.sendMouseEvent(
-      { type: "contextmenu" },
-      document.querySelectorAll(".request-list-item")[0]
-    );
+  const waitRequest = waitForNetworkEvents(monitor, 1);
+  await SpecialPowers.spawn(
+    gBrowser.selectedBrowser,
+    ['data:text/html,"+alert(document.domain)+"'],
+    url => {
+      content.fetch(url);
+    }
+  );
+  await waitRequest;
 
-    /* Ensure that the copy as fetch option is always visible */
-    is(
-      !!getContextMenuItem(monitor, "request-list-context-copy-as-fetch"),
-      true,
-      'The "Copy as Fetch" context menu item should not be hidden.'
-    );
+  await testClipboardContent(
+    monitor,
+    `await fetch("data:text/html,\\"+alert(document.domain)+\\"", {
+    "credentials": "omit",
+    "headers": {},
+    "method": "GET",
+    "mode": "cors"
+});`
+  );
 
-    await waitForClipboardPromise(
-      async function setup() {
-        await selectContextMenuItem(
-          monitor,
-          "request-list-context-copy-as-fetch"
-        );
-      },
-      function validate(result) {
-        if (typeof result !== "string") {
-          return false;
-        }
-        return expectedResult === result;
+  await teardown(monitor);
+});
+
+async function testClipboardContent(monitor, expectedResult) {
+  const { document } = monitor.panelWin;
+
+  const items = document.querySelectorAll(".request-list-item");
+  EventUtils.sendMouseEvent({ type: "mousedown" }, items[items.length - 1]);
+  EventUtils.sendMouseEvent(
+    { type: "contextmenu" },
+    document.querySelectorAll(".request-list-item")[0]
+  );
+
+  /* Ensure that the copy as fetch option is always visible */
+  is(
+    !!getContextMenuItem(monitor, "request-list-context-copy-as-fetch"),
+    true,
+    'The "Copy as Fetch" context menu item should not be hidden.'
+  );
+
+  await waitForClipboardPromise(
+    async function setup() {
+      await selectContextMenuItem(
+        monitor,
+        "request-list-context-copy-as-fetch"
+      );
+    },
+    function validate(result) {
+      if (typeof result !== "string") {
+        return false;
       }
-    );
+      return expectedResult === result;
+    }
+  );
 
-    info("Clipboard contains a fetch command for item " + (items.length - 1));
-  }
-});
+  info("Clipboard contains a fetch command for item " + (items.length - 1));
+}

Loading diff…

Regression Test / PoC

shipped with the fix

diff --git a/devtools/client/netmonitor/test/browser_net_copy_as_fetch.js b/devtools/client/netmonitor/test/browser_net_copy_as_fetch.js
index 517e9e54f87..e8589e097df 100644
--- a/devtools/client/netmonitor/test/browser_net_copy_as_fetch.js
+++ b/devtools/client/netmonitor/test/browser_net_copy_as_fetch.js
@@ -7,7 +7,7 @@
  * Tests if Copy as Fetch works.
  */
 
-add_task(async function () {
+add_task(async function testBasicCopyAsFetch() {
   const { tab, monitor } = await initNetMonitor(HTTPS_CURL_URL, {
     requestCount: 1,
   });
@@ -15,7 +15,9 @@ add_task(async function () {
 
   // GET request, no cookies (first request)
   await performRequest("GET");
-  await testClipboardContent(`await fetch("https://example.com/browser/devtools/client/netmonitor/test/sjs_simple-test-server.sjs", {
+  await testClipboardContent(
+    monitor,
+    `await fetch("https://example.com/browser/devtools/client/netmonitor/test/sjs_simple-test-server.sjs", {
     "credentials": "omit",
     "headers": {
         "User-Agent": "${navigator.userAgent}",
@@ -33,7 +35,8 @@ add_task(async function () {
     "referrer": "https://example.com/browser/devtools/client/netmonitor/test/html_copy-as-curl.html",
     "method": "GET",
     "mode": "cors"
-});`);
+});`
+  );
 
   await teardown(monitor);
 
@@ -54,39 +57,71 @@ add_task(async function () {
     );
     await waitRequest;
   }
+});
 
-  async function testClipboardContent(expectedResult) {
-    const { document } = monitor.panelWin;
+/**
+ * Tests for Url escaping of copy as Fetch
+ */
+add_task(async function testUrlEscapeOfCopyAsFetch() {
+  const { monitor } = await initNetMonitor(HTTPS_CURL_URL, {
+    requestCount: 1,
+  });
+  info("Starting test... ");
 
-    const items = document.querySelectorAll(".request-list-item");
-    EventUtils.sendMouseEvent({ type: "mousedown" }, items[items.length - 1]);
-    EventUtils.sendMouseEvent(
-      { type: "contextmenu" },
-      document.querySelectorAll(".request-list-item")[0]
-    );
+  const waitRequest = waitForNetworkEvents(monitor, 1);
+  await SpecialPowers.spawn(
+    gBrowser.selectedBrowser,
+    ['data:text/html,"+alert(document.domain)+"'],
+    url => {
+      content.fetch(url);
+    }
+  );
+  await waitRequest;
 
-    /* Ensure that the copy as fetch option is always visible */
-    is(
-      !!getContextMenuItem(monitor, "request-list-context-copy-as-fetch"),
-      true,
-      'The "Copy as Fetch" context menu item should not be hidden.'
-    );
+  await testClipboardContent(
+    monitor,
+    `await fetch("data:text/html,\\"+alert(document.domain)+\\"", {
+    "credentials": "omit",
+    "headers": {},
+    "method": "GET",
+    "mode": "cors"
+});`
+  );
 
-    await waitForClipboardPromise(
-      async function setup() {
-        await selectContextMenuItem(
-          monitor,
-          "request-list-context-copy-as-fetch"
-        );
-      },
-      function validate(result) {
-        if (typeof result !== "string") {
-          return false;
-        }
-        return expectedResult === result;
+  await teardown(monitor);
+});
+
+async function testClipboardContent(monitor, expectedResult) {
+  const { document } = monitor.panelWin;
+
+  const items = document.querySelectorAll(".request-list-item");
+  EventUtils.sendMouseEvent({ type: "mousedown" }, items[items.length - 1]);
+  EventUtils.sendMouseEvent(
+    { type: "contextmenu" },
+    document.querySelectorAll(".request-list-item")[0]
+  );
+
+  /* Ensure that the copy as fetch option is always visible */
+  is(
+    !!getContextMenuItem(monitor, "request-list-context-copy-as-fetch"),
+    true,
+    'The "Copy as Fetch" context menu item should not be hidden.'
+  );
+
+  await waitForClipboardPromise(
+    async function setup() {
+      await selectContextMenuItem(
+        monitor,
+        "request-list-context-copy-as-fetch"
+      );
+    },
+    function validate(result) {
+      if (typeof result !== "string") {
+        return false;
       }
-    );
+      return expectedResult === result;
+    }
+  );
 
-    info("Clipboard contains a fetch command for item " + (items.length - 1));
-  }
-});
+  info("Clipboard contains a fetch command for item " + (items.length - 1));
+}

Loading diff…

References

Vendor advisory Fix commit Bug tracker NVD

On This Page