Firefox · Toolkit
CVE-2025-0237
Logic Error in Toolkit
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
_onMessageToChrometoolkit/actors/WebChannelChild.sys.mjs |
modified | |
iftoolkit/actors/WebChannelChild.sys.mjs |
modified | |
iftoolkit/actors/WebChannelParent.sys.mjs |
modified |
Files Changed
toolkit/actors/WebChannelChild.sys.mjstoolkit/actors/WebChannelParent.sys.mjs
Patch
diff --git a/toolkit/actors/WebChannelChild.sys.mjs b/toolkit/actors/WebChannelChild.sys.mjs
index d84659bcde7..b7a37238aa8 100644
--- a/toolkit/actors/WebChannelChild.sys.mjs
+++ b/toolkit/actors/WebChannelChild.sys.mjs
@@ -21,11 +21,6 @@ export class WebChannelChild extends JSWindowActorChild {
}
_onMessageToChrome(e) {
- // If target is window then we want the document principal, otherwise fallback to target itself.
- let principal = e.target.nodePrincipal
- ? e.target.nodePrincipal
- : e.target.document.nodePrincipal;
-
if (e.detail) {
if (typeof e.detail != "string") {
console.error("WebChannelMessageToChrome must only send strings");
@@ -39,7 +34,6 @@ export class WebChannelChild extends JSWindowActorChild {
this.sendAsyncMessage("WebChannelMessageToChrome", {
contentData: e.detail,
eventTarget,
- principal,
});
} else {
console.error("WebChannel message failed. No message detail.");
diff --git a/toolkit/actors/WebChannelParent.sys.mjs b/toolkit/actors/WebChannelParent.sys.mjs
index 98b3ad093a3..c5d78235cc4 100644
--- a/toolkit/actors/WebChannelParent.sys.mjs
+++ b/toolkit/actors/WebChannelParent.sys.mjs
@@ -5,7 +5,9 @@
import { WebChannelBroker } from "resource://gre/modules/WebChannel.sys.mjs";
-const ERRNO_MISSING_PRINCIPAL = 1;
+// Note: ERRNO 1 deprecated and unused.
+// We used to err for cases where the child did not send a principal,
+// but now we infer it from the actor.
const ERRNO_NO_SUCH_CHANNEL = 2;
export class WebChannelParent extends JSWindowActorParent {
@@ -15,7 +17,7 @@ export class WebChannelParent extends JSWindowActorParent {
browsingContext: this.browsingContext,
browser: this.browsingContext.top.embedderElement,
eventTarget: msg.data.eventTarget,
- principal: msg.data.principal,
+ principal: this.manager.documentPrincipal,
};
// data must be a string except for a few legacy origins allowed by browser-content.js.
if (typeof data == "string") {
@@ -28,28 +30,19 @@ export class WebChannelParent extends JSWindowActorParent {
}
if (data && data.id) {
- if (!msg.data.principal) {
+ let validChannelFound = WebChannelBroker.tryToDeliver(
+ data,
+ sendingContext
+ );
+
+ // if no valid origins send an event that there is no such valid channel
+ if (!validChannelFound) {
this._sendErrorEventToContent(
data.id,
sendingContext,
- ERRNO_MISSING_PRINCIPAL,
- "Message principal missing"
- );
- } else {
- let validChannelFound = WebChannelBroker.tryToDeliver(
- data,
- sendingContext
+ ERRNO_NO_SUCH_CHANNEL,
+ "No Such Channel"
);
-
- // if no valid origins send an event that there is no such valid channel
- if (!validChannelFound) {
- this._sendErrorEventToContent(
- data.id,
- sendingContext,
- ERRNO_NO_SUCH_CHANNEL,
- "No Such Channel"
- );
- }
}
} else {
console.error("WebChannel channel id missing");
Loading diff…
References
On This Page