Firefox · Core
CVE-2024-11695
Logic Error in Core
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
browser/components/urlbar/UrlbarInput.sys.mjs
Patch
diff --git a/browser/components/urlbar/UrlbarInput.sys.mjs b/browser/components/urlbar/UrlbarInput.sys.mjs
index d046e637057..960c3e2fa85 100644
--- a/browser/components/urlbar/UrlbarInput.sys.mjs
+++ b/browser/components/urlbar/UrlbarInput.sys.mjs
@@ -4889,12 +4889,13 @@ function losslessDecodeURI(aURI) {
// Encode all adjacent space chars (U+0020), to prevent spoofing attempts
// where they would push part of the URL to overflow the location bar
// (bug 1395508). A single space, or the last space if the are many, is
- // preserved to maintain readability of certain urls. We only do this for the
- // common space, because others may be eaten when copied to the clipboard, so
- // it's safer to preserve them encoded.
+ // preserved to maintain readability of certain urls if it's not followed by a
+ // control or separator character. We only do this for the common space,
+ // because others may be eaten when copied to the clipboard,so it's safer to
+ // preserve them encoded.
value = value.replace(
// eslint-disable-next-line no-control-regex
- /[\u0000-\u001f\u007f-\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u2800\u3000\ufffc]|[\r\n\t]|\u0020(?=\u0020)|\s$/g,
+ /[[\p{Separator}--\u0020]\p{Control}\u2800\ufffc]|\u0020(?=[\p{Other}\p{Separator}])|\s$/gv,
encodeURIComponent
);
@@ -4916,9 +4917,10 @@ function losslessDecodeURI(aURI) {
// U+1BCA0-1BCA3 (U+D82F + U+DCA0-DCA3)
// Mimicking UI parts:
// U+1F50F-1F513 (U+D83D + U+DD0F-DD13), U+1F6E1 (U+D83D + U+DEE1)
+ // Unassigned codepoints, sometimes shown as empty glyphs.
value = value.replace(
// eslint-disable-next-line no-misleading-character-class
- /[\u00ad\u034f\u061c\u06dd\u070f\u115f\u1160\u17b4\u17b5\u180b-\u180e\u200b\u200e\u200f\u202a-\u202e\u2060-\u206f\u3164\u0600-\u0605\u08e2\ufe00-\ufe0f\ufeff\uffa0\ufff0-\ufffb]|\ud804[\udcbd\udccd]|\ud80d[\udc30-\udc38]|\ud82f[\udca0-\udca3]|\ud834[\udd73-\udd7a]|[\udb40-\udb43][\udc00-\udfff]|\ud83d[\udd0f-\udd13\udee1]/g,
+ /[\u00ad\u034f\u061c\u06dd\u070f\u115f\u1160\u17b4\u17b5\u180b-\u180e\u200b\u200e\u200f\u202a-\u202e\u2060-\u206f\u3164\u0600-\u0605\u08e2\ufe00-\ufe0f\ufeff\uffa0\ufff0-\ufffb\p{Unassigned}\p{Private_Use}]|\ud804[\udcbd\udccd]|\ud80d[\udc30-\udc38]|\ud82f[\udca0-\udca3]|\ud834[\udd73-\udd7a]|[\udb40-\udb43][\udc00-\udfff]|\ud83d[\udd0f-\udd13\udee1]/gv,
encodeURIComponent
);
return value;
Loading diff…
References
On This Page