Firefox · Core
CVE-2025-11713
Logic Error in Core
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
devtools/client/netmonitor/test/browser_net_curl-utils.jsdevtools/client/shared/curl.js
Patch
diff --git a/devtools/client/netmonitor/test/browser_net_curl-utils.js b/devtools/client/netmonitor/test/browser_net_curl-utils.js
index 8213f817b19..828f1935ae3 100644
--- a/devtools/client/netmonitor/test/browser_net_curl-utils.js
+++ b/devtools/client/netmonitor/test/browser_net_curl-utils.js
@@ -336,7 +336,7 @@ function testEscapeStringWin() {
const newLines = "line1\r\nline2\r\rline3\n\nline4";
is(
CurlUtils.escapeStringWin(newLines),
- '^\"line1\"^\r\n\r\n\"line2\"^\r\n\r\n\"\"^\r\n\r\n\"line3\"^\r\n\r\n\"\"^\r\n\r\n\"line4^\"',
+ '^\"line1^\n\nline2^\n\n^\n\nline3^\n\n^\n\nline4^\"',
"Newlines should be escaped."
);
@@ -357,7 +357,7 @@ function testEscapeStringWin() {
const evilCommand = `query=evil\r\rcmd" /c timeout /t 3 & calc.exe\r\r`;
is(
CurlUtils.escapeStringWin(evilCommand),
- '^\"query=evil\"^\r\n\r\n\"\"^\r\n\r\n\"cmd^\\^\" /c timeout /t 3 ^& calc.exe\"^\r\n\r\n\"\"^\r\n\r\n\"^\"',
+ '^\"query=evil^\n\n^\n\ncmd^\\^\" /c timeout /t 3 ^& calc.exe^\n\n^\n\n^\"',
"The evil command is escaped properly"
);
}
diff --git a/devtools/client/shared/curl.js b/devtools/client/shared/curl.js
index e8d72754cec..e3894da8123 100644
--- a/devtools/client/shared/curl.js
+++ b/devtools/client/shared/curl.js
@@ -474,15 +474,10 @@ const CurlUtils = {
// by the previous replace.
.replace(/%(?=[a-zA-Z0-9_])/g, "%^")
- // We replace \r and \r\n with \n, this allows to consistently escape all new
- // lines in the next replace
- .replace(/\r\n?/g, "\n")
-
// Lastly we replace new lines with ^ and TWO new lines because the first
// new line is there to enact the escape command the second is the character
// to escape (in this case new line).
- // The extra " enables escaping new lines with ^ within quotes in cmd.exe.
- .replace(/\n/g, '"^\r\n\r\n"') +
+ .replace(/\r?\n|\r/g, "^\n\n") +
encapsChars
);
},
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/devtools/client/netmonitor/test/browser_net_curl-utils.js b/devtools/client/netmonitor/test/browser_net_curl-utils.js
index 8213f817b19..828f1935ae3 100644
--- a/devtools/client/netmonitor/test/browser_net_curl-utils.js
+++ b/devtools/client/netmonitor/test/browser_net_curl-utils.js
@@ -336,7 +336,7 @@ function testEscapeStringWin() {
const newLines = "line1\r\nline2\r\rline3\n\nline4";
is(
CurlUtils.escapeStringWin(newLines),
- '^\"line1\"^\r\n\r\n\"line2\"^\r\n\r\n\"\"^\r\n\r\n\"line3\"^\r\n\r\n\"\"^\r\n\r\n\"line4^\"',
+ '^\"line1^\n\nline2^\n\n^\n\nline3^\n\n^\n\nline4^\"',
"Newlines should be escaped."
);
@@ -357,7 +357,7 @@ function testEscapeStringWin() {
const evilCommand = `query=evil\r\rcmd" /c timeout /t 3 & calc.exe\r\r`;
is(
CurlUtils.escapeStringWin(evilCommand),
- '^\"query=evil\"^\r\n\r\n\"\"^\r\n\r\n\"cmd^\\^\" /c timeout /t 3 ^& calc.exe\"^\r\n\r\n\"\"^\r\n\r\n\"^\"',
+ '^\"query=evil^\n\n^\n\ncmd^\\^\" /c timeout /t 3 ^& calc.exe^\n\n^\n\n^\"',
"The evil command is escaped properly"
);
}
Loading diff…
References
On This Page