Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionInsufficient escaping in the “Copy as cURL” feature could potentially be used to trick a user into executing unexpected code.
ComponentCore
Bug ClassLogic Error
Tracker1968414
Fix commit5dca7e838a6d (firefox) +1/-1
CISA KEVNot listed
CreditedAmeen Basha M K
Disclosed2025-07-22

Files Changed

  • devtools/client/shared/curl.js
diff --git a/devtools/client/shared/curl.js b/devtools/client/shared/curl.js
index 2d0f142fd44..0c19c13abb7 100644
--- a/devtools/client/shared/curl.js
+++ b/devtools/client/shared/curl.js
@@ -484,7 +484,7 @@ const CurlUtils = {
         // Lastly we replace new lines with ^ and TWO new lines because the first
         // new line is there to enact the escape command the second is the character
         // to escape (in this case new line).
-        .replace(/\r?\n/g, "^\n\n") +
+        .replace(/\r?\n|\r/g, "^\n\n") +
       encapsChars
     );
   },
Loading diff…