Firefox · Networking
CVE-2024-9398
Logic Error in Networking
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdocshell/base/nsDocShell.cpp |
modified |
Files Changed
docshell/base/nsDocShell.cppdocshell/base/nsDocShell.hnetwerk/ipc/DocumentLoadListener.cpp
Patch
diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index 14d7b59aa9c..21edd991239 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -6128,7 +6128,7 @@ already_AddRefed<nsIURI> nsDocShell::AttemptURIFixup(
nsresult nsDocShell::FilterStatusForErrorPage(
nsresult aStatus, nsIChannel* aChannel, uint32_t aLoadType,
- bool aIsTopFrame, bool aUseErrorPages, bool aIsInitialDocument,
+ bool aIsTopFrame, bool aUseErrorPages,
bool* aSkippedUnknownProtocolNavigation) {
// Errors to be shown only on top-level frames
if ((aStatus == NS_ERROR_UNKNOWN_HOST ||
@@ -6173,17 +6173,10 @@ nsresult nsDocShell::FilterStatusForErrorPage(
if (aStatus == NS_ERROR_UNKNOWN_PROTOCOL) {
// For unknown protocols we only display an error if the load is triggered
- // by the browser itself, or we're replacing the initial document (and
- // nothing else). Showing the error for page-triggered navigations causes
- // annoying behavior for users, see bug 1528305.
- //
- // We could, maybe, try to detect if this is in response to some user
- // interaction (like clicking a link, or something else) and maybe show
- // the error page in that case. But this allows for ctrl+clicking and such
- // to see the error page.
+ // by the browser itself. Showing the error for page-triggered navigations
+ // causes annoying behavior for users, see bug 1528305.
nsCOMPtr<nsILoadInfo> info = aChannel->LoadInfo();
- if (!info->TriggeringPrincipal()->IsSystemPrincipal() &&
- !aIsInitialDocument) {
+ if (!info->TriggeringPrincipal()->IsSystemPrincipal()) {
if (aSkippedUnknownProtocolNavigation) {
*aSkippedUnknownProtocolNavigation = true;
}
@@ -6333,12 +6326,9 @@ nsresult nsDocShell::EndPageLoad(nsIWebProgress* aProgress,
aStatus == NS_ERROR_CONTENT_BLOCKED);
UnblockEmbedderLoadEventForFailure(fireFrameErrorEvent);
- bool isInitialDocument =
- !GetExtantDocument() || GetExtantDocument()->IsInitialDocument();
bool skippedUnknownProtocolNavigation = false;
aStatus = FilterStatusForErrorPage(aStatus, aChannel, mLoadType, isTopFrame,
mBrowsingContext->GetUseErrorPages(),
- isInitialDocument,
&skippedUnknownProtocolNavigation);
hadErrorStatus = true;
if (NS_FAILED(aStatus)) {
diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
index 0ea84df4dde..efc85bf17dc 100644
--- a/docshell/base/nsDocShell.h
+++ b/docshell/base/nsDocShell.h
@@ -457,7 +457,7 @@ class nsDocShell final : public nsDocLoader,
// navigation.
static nsresult FilterStatusForErrorPage(
nsresult aStatus, nsIChannel* aChannel, uint32_t aLoadType,
- bool aIsTopFrame, bool aUseErrorPages, bool aIsInitialDocument,
+ bool aIsTopFrame, bool aUseErrorPages,
bool* aSkippedUnknownProtocolNavigation = nullptr);
// Notify consumers of a search being loaded through the observer service:
diff --git a/netwerk/ipc/DocumentLoadListener.cpp b/netwerk/ipc/DocumentLoadListener.cpp
index ef946929c9b..630a033659c 100644
--- a/netwerk/ipc/DocumentLoadListener.cpp
+++ b/netwerk/ipc/DocumentLoadListener.cpp
@@ -177,10 +177,11 @@ static auto CreateDocumentLoadInfo(CanonicalBrowsingContext* aBrowsingContext,
// Construct a LoadInfo object to use when creating the internal channel for an
// Object/Embed load.
-static auto CreateObjectLoadInfo(
- nsDocShellLoadState* aLoadState, uint64_t aInnerWindowId,
- nsContentPolicyType aContentPolicyType,
- uint32_t aSandboxFlags) -> already_AddRefed<LoadInfo> {
+static auto CreateObjectLoadInfo(nsDocShellLoadState* aLoadState,
+ uint64_t aInnerWindowId,
+ nsContentPolicyType aContentPolicyType,
+ uint32_t aSandboxFlags)
+ -> already_AddRefed<LoadInfo> {
RefPtr<WindowGlobalParent> wgp =
WindowGlobalParent::GetByInnerWindowId(aInnerWindowId);
MOZ_RELEASE_ASSERT(wgp);
@@ -1022,8 +1023,8 @@ auto DocumentLoadListener::OpenObject(
uint64_t aInnerWindowId, nsLoadFlags aLoadFlags,
nsContentPolicyType aContentPolicyType, bool aUrgentStart,
dom::ContentParent* aContentParent,
- ObjectUpgradeHandler* aObjectUpgradeHandler,
- nsresult* aRv) -> RefPtr<OpenPromise> {
+ ObjectUpgradeHandler* aObjectUpgradeHandler, nsresult* aRv)
+ -> RefPtr<OpenPromise> {
LOG(("DocumentLoadListener [%p] OpenObject [uri=%s]", this,
aLoadState->URI()->GetSpecOrDefault().get()));
@@ -1230,9 +1231,10 @@ void DocumentLoadListener::CleanupParentLoadAttempt(uint64_t aLoadIdent) {
registrar->DeregisterChannels(aLoadIdent);
}
-auto DocumentLoadListener::ClaimParentLoad(
- DocumentLoadListener** aListener, uint64_t aLoadIdent,
- Maybe<uint64_t> aChannelId) -> RefPtr<OpenPromise> {
+auto DocumentLoadListener::ClaimParentLoad(DocumentLoadListener** aListener,
+ uint64_t aLoadIdent,
+ Maybe<uint64_t> aChannelId)
+ -> RefPtr<OpenPromise> {
nsCOMPtr<nsIRedirectChannelRegistrar> registrar =
RedirectChannelRegistrar::GetOrCreate();
@@ -2364,15 +2366,9 @@ bool DocumentLoadListener::DocShellWillDisplayContent(nsresult aStatus) {
auto* loadingContext = GetLoadingBrowsingContext();
- bool isInitialDocument = true;
- if (WindowGlobalParent* currentWindow =
- loadingContext->GetCurrentWindowGlobal()) {
- isInitialDocument = currentWindow->IsInitialDocument();
- }
-
nsresult rv = nsDocShell::FilterStatusForErrorPage(
aStatus, mChannel, mLoadStateLoadType, loadingContext->IsTop(),
- loadingContext->GetUseErrorPages(), isInitialDocument, nullptr);
+ loadingContext->GetUseErrorPages(), nullptr);
if (NS_SUCCEEDED(rv)) {
MOZ_LOG(gProcessIsolationLog, LogLevel::Verbose,
Loading diff…
References
On This Page