Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionInsufficient escaping in the “Copy as cURL” feature could have been used to trick a user into executing unexpected code on Windows. This did not affect Firefox running on other operating systems.
ComponentCore
Bug ClassLogic Error
Tracker1986142
Fix commitb7fce3e36d02 (firefox) +3/-8
CISA KEVNot listed
CreditedHafiizh & kang ali
Disclosed2025-10-14

Files Changed

  • devtools/client/netmonitor/test/browser_net_curl-utils.js
  • devtools/client/shared/curl.js
diff --git a/devtools/client/netmonitor/test/browser_net_curl-utils.js b/devtools/client/netmonitor/test/browser_net_curl-utils.js
index 8213f817b19..828f1935ae3 100644
--- a/devtools/client/netmonitor/test/browser_net_curl-utils.js
+++ b/devtools/client/netmonitor/test/browser_net_curl-utils.js
@@ -336,7 +336,7 @@ function testEscapeStringWin() {
   const newLines = "line1\r\nline2\r\rline3\n\nline4";
   is(
     CurlUtils.escapeStringWin(newLines),
-    '^\"line1\"^\r\n\r\n\"line2\"^\r\n\r\n\"\"^\r\n\r\n\"line3\"^\r\n\r\n\"\"^\r\n\r\n\"line4^\"',
+    '^\"line1^\n\nline2^\n\n^\n\nline3^\n\n^\n\nline4^\"',
     "Newlines should be escaped."
   );
 
@@ -357,7 +357,7 @@ function testEscapeStringWin() {
   const evilCommand = `query=evil\r\rcmd" /c timeout /t 3 & calc.exe\r\r`;
   is(
     CurlUtils.escapeStringWin(evilCommand),
-    '^\"query=evil\"^\r\n\r\n\"\"^\r\n\r\n\"cmd^\\^\" /c timeout /t 3 ^& calc.exe\"^\r\n\r\n\"\"^\r\n\r\n\"^\"',
+    '^\"query=evil^\n\n^\n\ncmd^\\^\" /c timeout /t 3 ^& calc.exe^\n\n^\n\n^\"',
     "The evil command is escaped properly"
   );
 }
diff --git a/devtools/client/shared/curl.js b/devtools/client/shared/curl.js
index e8d72754cec..e3894da8123 100644
--- a/devtools/client/shared/curl.js
+++ b/devtools/client/shared/curl.js
@@ -474,15 +474,10 @@ const CurlUtils = {
         // by the previous replace.
         .replace(/%(?=[a-zA-Z0-9_])/g, "%^")
 
-        // We replace \r and \r\n with \n, this allows to consistently escape all new
-        // lines in the next replace
-        .replace(/\r\n?/g, "\n")
-
         // Lastly we replace new lines with ^ and TWO new lines because the first
         // new line is there to enact the escape command the second is the character
         // to escape (in this case new line).
-        // The extra " enables escaping new lines with ^ within quotes in cmd.exe.
-        .replace(/\n/g, '"^\r\n\r\n"') +
+        .replace(/\r?\n|\r/g, "^\n\n") +
       encapsChars
     );
   },
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/devtools/client/netmonitor/test/browser_net_curl-utils.js b/devtools/client/netmonitor/test/browser_net_curl-utils.js
index 8213f817b19..828f1935ae3 100644
--- a/devtools/client/netmonitor/test/browser_net_curl-utils.js
+++ b/devtools/client/netmonitor/test/browser_net_curl-utils.js
@@ -336,7 +336,7 @@ function testEscapeStringWin() {
   const newLines = "line1\r\nline2\r\rline3\n\nline4";
   is(
     CurlUtils.escapeStringWin(newLines),
-    '^\"line1\"^\r\n\r\n\"line2\"^\r\n\r\n\"\"^\r\n\r\n\"line3\"^\r\n\r\n\"\"^\r\n\r\n\"line4^\"',
+    '^\"line1^\n\nline2^\n\n^\n\nline3^\n\n^\n\nline4^\"',
     "Newlines should be escaped."
   );
 
@@ -357,7 +357,7 @@ function testEscapeStringWin() {
   const evilCommand = `query=evil\r\rcmd" /c timeout /t 3 & calc.exe\r\r`;
   is(
     CurlUtils.escapeStringWin(evilCommand),
-    '^\"query=evil\"^\r\n\r\n\"\"^\r\n\r\n\"cmd^\\^\" /c timeout /t 3 ^& calc.exe\"^\r\n\r\n\"\"^\r\n\r\n\"^\"',
+    '^\"query=evil^\n\n^\n\ncmd^\\^\" /c timeout /t 3 ^& calc.exe^\n\n^\n\n^\"',
     "The evil command is escaped properly"
   );
 }
Loading diff…