Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
Descriptionjar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but the fake extension after the null was used to determine the type of content. This could have been used to hide code in a web extension disguised as something else like an image.
ComponentSpiderMonkey
Bug ClassLogic Error
Tracker1940027
Fix commit047b388bc9f8 (firefox) +64/-61
CISA KEVNot listed
CreditedSurya Dev Singh
Disclosed2025-03-04

Changed Functions

FunctionChangeNotes
if
dom/xhr/XMLHttpRequestMainThread.cpp
modified
if
gfx/thebes/gfxFT2FontList.cpp
modified
if
intl/hyphenation/glue/nsHyphenator.cpp
modified
if
intl/locale/LocaleService.cpp
modified
if
js/xpconnect/loader/URLPreloader.cpp
modified
if
modules/libjar/nsJAR.cpp
modified

Files Changed

  • dom/xhr/XMLHttpRequestMainThread.cpp
  • gfx/thebes/gfxFT2FontList.cpp
  • intl/hyphenation/glue/nsHyphenator.cpp
  • intl/locale/LocaleService.cpp
  • js/xpconnect/loader/URLPreloader.cpp
  • modules/libjar/nsJAR.cpp
  • modules/libjar/nsJARInputStream.cpp
  • modules/libjar/nsZipArchive.cpp
  • modules/libjar/nsZipArchive.h
  • toolkit/mozapps/extensions/AddonManagerStartup.cpp
  • xpcom/build/FileLocation.cpp
  • xpcom/build/FileLocation.h
  • xpcom/build/Omnijar.cpp
  • xpcom/components/nsComponentManager.cpp
diff --git a/dom/xhr/XMLHttpRequestMainThread.cpp b/dom/xhr/XMLHttpRequestMainThread.cpp
index 59352f1e716..e9472466d26 100644
--- a/dom/xhr/XMLHttpRequestMainThread.cpp
+++ b/dom/xhr/XMLHttpRequestMainThread.cpp
@@ -4182,7 +4182,7 @@ nsresult ArrayBufferBuilder::MapToFileInPackage(const nsCString& aFile,
   if (!zip) {
     return NS_ERROR_FAILURE;
   }
-  nsZipItem* zipItem = zip->GetItem(aFile.get());
+  nsZipItem* zipItem = zip->GetItem(aFile);
   if (!zipItem) {
     return NS_ERROR_FILE_NOT_FOUND;
   }
diff --git a/gfx/thebes/gfxFT2FontList.cpp b/gfx/thebes/gfxFT2FontList.cpp
index 5c94e81d9be..13a32ef76fd 100644
--- a/gfx/thebes/gfxFT2FontList.cpp
+++ b/gfx/thebes/gfxFT2FontList.cpp
@@ -103,7 +103,7 @@ already_AddRefed<SharedFTFace> FT2FontEntry::GetFTFace(bool aCommit) {
   RefPtr<SharedFTFace> face;
   if (mFilename[0] != '/') {
     RefPtr<nsZipArchive> reader = Omnijar::GetReader(Omnijar::Type::GRE);
-    nsZipItem* item = reader->GetItem(mFilename.get());
+    nsZipItem* item = reader->GetItem(mFilename);
     NS_ASSERTION(item, "failed to find zip entry");
 
     uint32_t bufSize = item->RealSize();
@@ -468,7 +468,7 @@ hb_face_t* FT2FontEntry::CreateHBFace() const {
     // A relative path means an omnijar resource, which we may need to
     // decompress to a temporary buffer.
     RefPtr<nsZipArchive> reader = Omnijar::GetReader(Omnijar::Type::GRE);
-    nsZipItem* item = reader->GetItem(mFilename.get());
+    nsZipItem* item = reader->GetItem(mFilename);
     MOZ_ASSERT(item, "failed to find zip entry");
     if (item) {
       // TODO(jfkthame):
@@ -1510,7 +1510,7 @@ void gfxFT2FontList::AppendFacesFromOmnijarEntry(nsZipArchive* aArchive,
     }
   }
 
-  nsZipItem* item = aArchive->GetItem(aEntryName.get());
+  nsZipItem* item = aArchive->GetItem(aEntryName);
   NS_ASSERTION(item, "failed to find zip entry");
 
   uint32_t bufSize = item->RealSize();
diff --git a/intl/hyphenation/glue/nsHyphenator.cpp b/intl/hyphenation/glue/nsHyphenator.cpp
index e506a3a423d..40ce45018b9 100644
--- a/intl/hyphenation/glue/nsHyphenator.cpp
+++ b/intl/hyphenation/glue/nsHyphenator.cpp
@@ -52,7 +52,7 @@ static const void* GetItemPtrFromJarURI(nsIJARURI* aJAR, uint32_t* aLength) {
   if (archive) {
     nsCString path;
     aJAR->GetJAREntry(path);
-    nsZipItem* item = archive->GetItem(path.get());
+    nsZipItem* item = archive->GetItem(path);
     if (item && item->Compression() == 0 && item->Size() > 0) {
       // We do NOT own this data, but it won't go away until the omnijar
       // file is closed during shutdown.
diff --git a/intl/locale/LocaleService.cpp b/intl/locale/LocaleService.cpp
index 1527f279103..7cb42fbb11c 100644
--- a/intl/locale/LocaleService.cpp
+++ b/intl/locale/LocaleService.cpp
@@ -338,7 +338,7 @@ static bool GetGREFileContents(const char* aFilePath, nsCString* aOutString) {
   // Look for the requested file in omnijar.
   RefPtr<nsZipArchive> zip = Omnijar::GetReader(Omnijar::GRE);
   if (zip) {
-    nsZipItemPtr<char> item(zip, aFilePath);
+    nsZipItemPtr<char> item(zip, nsDependentCString(aFilePath));
     if (!item) {
       return false;
     }
diff --git a/js/xpconnect/loader/URLPreloader.cpp b/js/xpconnect/loader/URLPreloader.cpp
index 1aa18aca44f..6721cd04711 100644
--- a/js/xpconnect/loader/URLPreloader.cpp
+++ b/js/xpconnect/loader/URLPreloader.cpp
@@ -402,7 +402,7 @@ void URLPreloader::BackgroundReadFiles() {
             entry->TypeString(), entry->mPath.get());
       }
 
-      auto item = zip->GetItem(entry->mPath.get());
+      auto item = zip->GetItem(entry->mPath);
       if (!item) {
         entry->mResultCode = NS_ERROR_FILE_NOT_FOUND;
         continue;
@@ -567,7 +567,7 @@ Result<nsCString, nsresult> URLPreloader::ReadURIInternal(nsIURI* uri,
   }
 
   // Not an Omnijar archive, so just read it directly.
-  FileLocation location(zip, PromiseFlatCString(path).BeginReading());
+  FileLocation location(zip, path);
   return URLEntry::ReadLocation(location);
 }
 
@@ -636,7 +636,7 @@ Result<FileLocation, nsresult> URLPreloader::CacheKey::ToFileLocation() {
   }
 
   RefPtr<nsZipArchive> zip = Archive();
-  return FileLocation(zip, mPath.get());
+  return FileLocation(zip, mPath);
 }
 
 Result<nsCString, nsresult> URLPreloader::URLEntry::Read() {
diff --git a/modules/libjar/nsJAR.cpp b/modules/libjar/nsJAR.cpp
index bc413190705..8193e72563f 100644
--- a/modules/libjar/nsJAR.cpp
+++ b/modules/libjar/nsJAR.cpp
@@ -135,8 +135,7 @@ nsJAR::OpenInner(nsIZipReader* aZipReader, const nsACString& aZipEntry) {
   {
     nsJAR* outerJAR = static_cast<nsJAR*>(aZipReader);
     RecursiveMutexAutoLock outerLock(outerJAR->mLock);
-    rv = nsZipHandle::Init(outerJAR->mZip.get(),
-                           PromiseFlatCString(aZipEntry).get(),
+    rv = nsZipHandle::Init(outerJAR->mZip.get(), aZipEntry,
                            getter_AddRefs(handle));
     NS_ENSURE_SUCCESS(rv, rv);
   }
@@ -191,8 +190,7 @@ nsJAR::Test(const nsACString& aEntryName) {
   if (!mZip) {
     return NS_ERROR_FAILURE;
   }
-  return mZip->Test(
-      aEntryName.IsEmpty() ? nullptr : PromiseFlatCString(aEntryName).get());
+  return mZip->Test(aEntryName);
 }
 
 NS_IMETHODIMP
@@ -205,7 +203,7 @@ nsJAR::Extract(const nsACString& aEntryName, nsIFile* outFile) {
   }
 
   LOG(("Extract[%p] %s", this, PromiseFlatCString(aEntryName).get()));
-  nsZipItem* item = mZip->GetItem(PromiseFlatCString(aEntryName).get());
+  nsZipItem* item = mZip->GetItem(aEntryName);
   NS_ENSURE_TRUE(item, NS_ERROR_FILE_NOT_FOUND);
 
   // Remove existing file or directory so we set permissions correctly.
@@ -245,7 +243,7 @@ nsJAR::GetEntry(const nsACString& aEntryName, nsIZipEntry** result) {
   if (!mZip) {
     return NS_ERROR_FAILURE;
   }
-  nsZipItem* zipItem = mZip->GetItem(PromiseFlatCString(aEntryName).get());
+  nsZipItem* zipItem = mZip->GetItem(aEntryName);
   NS_ENSURE_TRUE(zipItem, NS_ERROR_FILE_NOT_FOUND);
 
   RefPtr<nsJARItem> jarItem = new nsJARItem(zipItem);
@@ -261,7 +259,7 @@ nsJAR::HasEntry(const nsACString& aEntryName, bool* result) {
   if (!mZip) {
     return NS_ERROR_FAILURE;
   }
-  *result = mZip->GetItem(PromiseFlatCString(aEntryName).get()) != nullptr;
+  *result = mZip->GetItem(aEntryName) != nullptr;
   return NS_OK;
 }
 
@@ -301,7 +299,7 @@ nsJAR::GetInputStream(const nsACString& aEntryName, nsIInputStream** result) {
   const nsCString& entry = PromiseFlatCString(aEntryName);
   if (*entry.get()) {
     // First check if item exists in jar
-    item = mZip->GetItem(entry.get());
+    item = mZip->GetItem(entry);
     if (!item) return NS_ERROR_FILE_NOT_FOUND;
   }
   RefPtr<nsJARInputStream> jis = new nsJARInputStream();
diff --git a/modules/libjar/nsJARInputStream.cpp b/modules/libjar/nsJARInputStream.cpp
index 83f8f3c224e..8095f9edf12 100644
--- a/modules/libjar/nsJARInputStream.cpp
+++ b/modules/libjar/nsJARInputStream.cpp
@@ -341,7 +341,8 @@ nsresult nsJARInputStream::ReadDirectory(char* aBuffer, uint32_t aCount,
 
       const char* entryName = mArray[mArrPos].get();
       uint32_t entryNameLen = mArray[mArrPos].Length();
-      nsZipItem* ze = mJar->mZip->GetItem(entryName);
+      nsZipItem* ze = mJar->mZip->GetItem(
+          nsDependentCString(mArray[mArrPos].get(), mArray[mArrPos].Length()));
       NS_ENSURE_TRUE(ze, NS_ERROR_FILE_NOT_FOUND);
 
       // Last Modified Time
diff --git a/modules/libjar/nsZipArchive.cpp b/modules/libjar/nsZipArchive.cpp
index cf894dc9d1e..dcbd9327b92 100644
--- a/modules/libjar/nsZipArchive.cpp
+++ b/modules/libjar/nsZipArchive.cpp
@@ -237,12 +237,12 @@ nsresult nsZipHandle::Init(nsIFile* file, nsZipHandle** ret, PRFileDesc** aFd) {
   return NS_OK;
 }
 
-nsresult nsZipHandle::Init(nsZipArchive* zip, const char* entry,
+nsresult nsZipHandle::Init(nsZipArchive* zip, const nsACString& entry,
                            nsZipHandle** ret) {
   RefPtr<nsZipHandle> handle = new nsZipHandle();
   if (!handle) return NS_ERROR_OUT_OF_MEMORY;
 
-  LOG(("ZipHandle::Init entry %s", entry));
+  LOG(("ZipHandle::Init entry %s", PromiseFlatCString(entry).get()));
 
   nsZipItem* item = zip->GetItem(entry);
   if (item && item->Compression() == DEFLATED &&
@@ -414,10 +414,10 @@ already_AddRefed<nsZipArchive> nsZipArchive::OpenArchive(nsIFile* aFile) {
 //---------------------------------------------
 //  nsZipArchive::Test
 //---------------------------------------------
-nsresult nsZipArchive::Test(const char* aEntryName) {
+nsresult nsZipArchive::Test(const nsACString& aEntryName) {
Loading diff…