Firefox · DOM
CVE-2026-0888
Logic Error in DOM
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
mStatedom/l10n/DocumentL10n.cpp |
modified |
Files Changed
dom/l10n/DOMLocalization.cppdom/l10n/DOMLocalization.hdom/l10n/DocumentL10n.cppdom/l10n/DocumentL10n.hdom/xml/nsXMLPrettyPrinter.cppintl/l10n/Localization.cppintl/l10n/Localization.h
Patch
diff --git a/dom/l10n/DOMLocalization.cpp b/dom/l10n/DOMLocalization.cpp
index 4e4b7699729..824150046a1 100644
--- a/dom/l10n/DOMLocalization.cpp
+++ b/dom/l10n/DOMLocalization.cpp
@@ -48,6 +48,12 @@ DOMLocalization::DOMLocalization(nsIGlobalObject* aGlobal, bool aIsSync,
mMutations = new L10nMutations(this);
}
+DOMLocalization::DOMLocalization(nsIGlobalObject* aGlobal, bool aIsSync,
+ const nsTArray<nsCString>& aLocales)
+ : Localization(aGlobal, aIsSync, aLocales) {
+ mMutations = new L10nMutations(this);
+}
+
already_AddRefed<DOMLocalization> DOMLocalization::Constructor(
const GlobalObject& aGlobal,
const Sequence<dom::OwningUTF8StringOrResourceId>& aResourceIds,
diff --git a/dom/l10n/DOMLocalization.h b/dom/l10n/DOMLocalization.h
index 087db1d3e0c..8a8a0a66653 100644
--- a/dom/l10n/DOMLocalization.h
+++ b/dom/l10n/DOMLocalization.h
@@ -118,6 +118,8 @@ class DOMLocalization : public intl::Localization {
DOMLocalization(nsIGlobalObject* aGlobal, bool aSync);
DOMLocalization(nsIGlobalObject* aGlobal, bool aIsSync,
const intl::ffi::LocalizationRc* aRaw);
+ DOMLocalization(nsIGlobalObject* aGlobal, bool aSync,
+ const nsTArray<nsCString>& aLocales);
protected:
virtual ~DOMLocalization();
diff --git a/dom/l10n/DocumentL10n.cpp b/dom/l10n/DocumentL10n.cpp
index 0c628908d91..beae33864d0 100644
--- a/dom/l10n/DocumentL10n.cpp
+++ b/dom/l10n/DocumentL10n.cpp
@@ -48,6 +48,19 @@ RefPtr<DocumentL10n> DocumentL10n::Create(Document* aDocument, bool aSync) {
return l10n.forget();
}
+RefPtr<DocumentL10n> DocumentL10n::Create(Document* aDocument, bool aSync,
+ const nsTArray<nsCString>& aLocales) {
+ RefPtr<DocumentL10n> l10n = new DocumentL10n(aDocument, aSync, aLocales);
+
+ IgnoredErrorResult rv;
+ l10n->mReady = Promise::Create(l10n->mGlobal, rv);
+ if (NS_WARN_IF(rv.Failed())) {
+ return nullptr;
+ }
+
+ return l10n.forget();
+}
+
DocumentL10n::DocumentL10n(Document* aDocument, bool aSync)
: DOMLocalization(aDocument->GetScopeObject(), aSync),
mDocument(aDocument),
@@ -55,6 +68,14 @@ DocumentL10n::DocumentL10n(Document* aDocument, bool aSync)
mContentSink = do_QueryInterface(aDocument->GetCurrentContentSink());
}
+DocumentL10n::DocumentL10n(Document* aDocument, bool aSync,
+ const nsTArray<nsCString>& aLocales)
+ : DOMLocalization(aDocument->GetScopeObject(), aSync, aLocales),
+ mDocument(aDocument),
+ mState(DocumentL10nState::Constructed) {
+ mContentSink = do_QueryInterface(aDocument->GetCurrentContentSink());
+}
+
JSObject* DocumentL10n::WrapObject(JSContext* aCx,
JS::Handle<JSObject*> aGivenProto) {
return DocumentL10n_Binding::Wrap(aCx, this, aGivenProto);
diff --git a/dom/l10n/DocumentL10n.h b/dom/l10n/DocumentL10n.h
index 98e969b1844..6608e5a05de 100644
--- a/dom/l10n/DocumentL10n.h
+++ b/dom/l10n/DocumentL10n.h
@@ -47,9 +47,13 @@ class DocumentL10n final : public DOMLocalization {
NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(DocumentL10n, DOMLocalization)
static RefPtr<DocumentL10n> Create(Document* aDocument, bool aSync);
+ static RefPtr<DocumentL10n> Create(Document* aDocument, bool aSync,
+ const nsTArray<nsCString>& aLocales);
protected:
explicit DocumentL10n(Document* aDocument, bool aSync);
+ explicit DocumentL10n(Document* aDocument, bool aSync,
+ const nsTArray<nsCString>& aLocales);
virtual ~DocumentL10n() = default;
RefPtr<Document> mDocument;
diff --git a/dom/xml/nsXMLPrettyPrinter.cpp b/dom/xml/nsXMLPrettyPrinter.cpp
index 605ddadf50f..61bf0a206c9 100644
--- a/dom/xml/nsXMLPrettyPrinter.cpp
+++ b/dom/xml/nsXMLPrettyPrinter.cpp
@@ -101,7 +101,13 @@ nsresult nsXMLPrettyPrinter::PrettyPrint(Document* aDocument,
// Create a DocumentL10n, as the XML document is not allowed to have one.
// Make it sync so that the test for bug 590812 does not require a setTimeout.
- RefPtr<DocumentL10n> l10n = DocumentL10n::Create(aDocument, true);
+ RefPtr<DocumentL10n> l10n;
+ if (aDocument->ShouldResistFingerprinting(RFPTarget::JSLocale)) {
+ AutoTArray<nsCString, 1> langs = {nsRFPService::GetSpoofedJSLocale()};
+ l10n = DocumentL10n::Create(aDocument, true, langs);
+ } else {
+ l10n = DocumentL10n::Create(aDocument, true);
+ }
NS_ENSURE_TRUE(l10n, NS_ERROR_UNEXPECTED);
l10n->AddResourceId("dom/XMLPrettyPrint.ftl"_ns);
diff --git a/intl/l10n/Localization.cpp b/intl/l10n/Localization.cpp
index 81b79093e1b..b876637528d 100644
--- a/intl/l10n/Localization.cpp
+++ b/intl/l10n/Localization.cpp
@@ -164,6 +164,14 @@ Localization::Localization(nsIGlobalObject* aGlobal, bool aIsSync,
RegisterObservers();
}
+Localization::Localization(nsIGlobalObject* aGlobal, bool aIsSync,
+ const nsTArray<nsCString>& aLocales)
+ : mGlobal(aGlobal) {
+ nsTArray<ffi::GeckoResourceId> resIds;
+ ffi::localization_new_with_locales(&resIds, aIsSync, nullptr, &aLocales,
+ getter_AddRefs(mRaw));
+}
+
/* static */
bool Localization::IsAPIEnabled(JSContext* aCx, JSObject* aObject) {
JS::Rooted<JSObject*> obj(aCx, aObject);
diff --git a/intl/l10n/Localization.h b/intl/l10n/Localization.h
index 78e05b8493d..4c166da1ed2 100644
--- a/intl/l10n/Localization.h
+++ b/intl/l10n/Localization.h
@@ -156,6 +156,9 @@ class Localization : public nsIObserver,
Localization(nsIGlobalObject* aGlobal, bool aIsSync,
const ffi::LocalizationRc* aRaw);
+ Localization(nsIGlobalObject* aGlobal, bool aIsSync,
+ const nsTArray<nsCString>& aLocales);
+
virtual ~Localization();
void RegisterObservers();
Loading diff…
References
On This Page