Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionMitigation bypass in the Safe Browsing component
ComponentToolkit
Bug ClassLogic Error
Tracker2041906
Fix commitdf4f46d77bb8 (firefox) +34/-28
CISA KEVNot listed
CreditedTomoya Nakanishi
Disclosed2026-08-18

Changed Functions

FunctionChangeNotes
for
toolkit/components/reputationservice/ApplicationReputation.cpp
modified

Files Changed

  • toolkit/components/reputationservice/ApplicationReputation.cpp
diff --git a/toolkit/components/reputationservice/ApplicationReputation.cpp b/toolkit/components/reputationservice/ApplicationReputation.cpp
index 016e3c2ca0e..09a409f6bbd 100644
--- a/toolkit/components/reputationservice/ApplicationReputation.cpp
+++ b/toolkit/components/reputationservice/ApplicationReputation.cpp
@@ -936,7 +936,8 @@ static const char* GetFileExt(const nsACString& aFilename,
                               const char* const aFileExtensions[],
                               const size_t aLength) {
   for (size_t i = 0; i < aLength; ++i) {
-    if (StringEndsWith(aFilename, nsDependentCString(aFileExtensions[i]))) {
+    if (StringEndsWith(aFilename, nsDependentCString(aFileExtensions[i]),
+                       nsCaseInsensitiveCStringComparator)) {
       return aFileExtensions[i];
     }
   }
@@ -976,37 +977,42 @@ ClientDownloadRequest::DownloadType PendingLookup::GetDownloadType(
     const nsACString& aFilename) {
   MOZ_ASSERT(IsBinary(aFilename));
 
+  // Extensions are matched case-insensitively, so compare against a lowercased
+  // copy of the filename.
+  nsAutoCString fileName(aFilename);
+  ToLowerCase(fileName);
+
   // From
   // https://cs.chromium.org/chromium/src/chrome/common/safe_browsing/download_protection_util.cc?l=17
-  if (StringEndsWith(aFilename, ".zip"_ns)) {
+  if (StringEndsWith(fileName, ".zip"_ns)) {
     return ClientDownloadRequest::ZIPPED_EXECUTABLE;
-  } else if (StringEndsWith(aFilename, ".apk"_ns)) {
+  } else if (StringEndsWith(fileName, ".apk"_ns)) {
     return ClientDownloadRequest::ANDROID_APK;
-  } else if (StringEndsWith(aFilename, ".app"_ns) ||
-             StringEndsWith(aFilename, ".applescript"_ns) ||
-             StringEndsWith(aFilename, ".cdr"_ns) ||
-             StringEndsWith(aFilename, ".dart"_ns) ||
-             StringEndsWith(aFilename, ".dc42"_ns) ||
-             StringEndsWith(aFilename, ".diskcopy42"_ns) ||
-             StringEndsWith(aFilename, ".dmg"_ns) ||
-             StringEndsWith(aFilename, ".dmgpart"_ns) ||
-             StringEndsWith(aFilename, ".dvdr"_ns) ||
-             StringEndsWith(aFilename, ".img"_ns) ||
-             StringEndsWith(aFilename, ".imgpart"_ns) ||
-             StringEndsWith(aFilename, ".iso"_ns) ||
-             StringEndsWith(aFilename, ".mpkg"_ns) ||
-             StringEndsWith(aFilename, ".ndif"_ns) ||
-             StringEndsWith(aFilename, ".osas"_ns) ||
-             StringEndsWith(aFilename, ".osax"_ns) ||
-             StringEndsWith(aFilename, ".pkg"_ns) ||
-             StringEndsWith(aFilename, ".scpt"_ns) ||
-             StringEndsWith(aFilename, ".scptd"_ns) ||
-             StringEndsWith(aFilename, ".seplugin"_ns) ||
-             StringEndsWith(aFilename, ".smi"_ns) ||
-             StringEndsWith(aFilename, ".sparsebundle"_ns) ||
-             StringEndsWith(aFilename, ".sparseimage"_ns) ||
-             StringEndsWith(aFilename, ".toast"_ns) ||
-             StringEndsWith(aFilename, ".udif"_ns)) {
+  } else if (StringEndsWith(fileName, ".app"_ns) ||
+             StringEndsWith(fileName, ".applescript"_ns) ||
+             StringEndsWith(fileName, ".cdr"_ns) ||
+             StringEndsWith(fileName, ".dart"_ns) ||
+             StringEndsWith(fileName, ".dc42"_ns) ||
+             StringEndsWith(fileName, ".diskcopy42"_ns) ||
+             StringEndsWith(fileName, ".dmg"_ns) ||
+             StringEndsWith(fileName, ".dmgpart"_ns) ||
+             StringEndsWith(fileName, ".dvdr"_ns) ||
+             StringEndsWith(fileName, ".img"_ns) ||
+             StringEndsWith(fileName, ".imgpart"_ns) ||
+             StringEndsWith(fileName, ".iso"_ns) ||
+             StringEndsWith(fileName, ".mpkg"_ns) ||
+             StringEndsWith(fileName, ".ndif"_ns) ||
+             StringEndsWith(fileName, ".osas"_ns) ||
+             StringEndsWith(fileName, ".osax"_ns) ||
+             StringEndsWith(fileName, ".pkg"_ns) ||
+             StringEndsWith(fileName, ".scpt"_ns) ||
+             StringEndsWith(fileName, ".scptd"_ns) ||
+             StringEndsWith(fileName, ".seplugin"_ns) ||
+             StringEndsWith(fileName, ".smi"_ns) ||
+             StringEndsWith(fileName, ".sparsebundle"_ns) ||
+             StringEndsWith(fileName, ".sparseimage"_ns) ||
+             StringEndsWith(fileName, ".toast"_ns) ||
+             StringEndsWith(fileName, ".udif"_ns)) {
     return ClientDownloadRequest::MAC_EXECUTABLE;
   }
 
Loading diff…