Firefox · DOM
CVE-2026-100816
Logic Error in DOM
Overview
Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifnetwerk/protocol/http/HttpBaseChannel.cpp |
modified |
Files Changed
dom/fetch/FetchDriver.cppipc/glue/BackgroundUtils.cppnetwerk/base/LoadInfo.hnetwerk/base/nsILoadInfo.idlnetwerk/ipc/NeckoChannelParams.ipdlhnetwerk/protocol/http/HttpBaseChannel.cpp
Patch
diff --git a/dom/fetch/FetchDriver.cpp b/dom/fetch/FetchDriver.cpp
index 1f5e4385568..f3bb6cf6d21 100644
--- a/dom/fetch/FetchDriver.cpp
+++ b/dom/fetch/FetchDriver.cpp
@@ -714,14 +714,6 @@ nsresult FetchDriver::HttpFetch(
}
}
- if (mDocument && mDocument->GetEmbedderElement() &&
- mDocument->GetEmbedderElement()->IsAnyOfHTMLElements(nsGkAtoms::object,
- nsGkAtoms::embed)) {
- nsCOMPtr<nsILoadInfo> loadInfo = chan->LoadInfo();
- rv = loadInfo->SetIsFromObjectOrEmbed(true);
- NS_ENSURE_SUCCESS(rv, rv);
- }
-
// Insert ourselves into the notification callbacks chain so we can set
// headers on redirects.
#ifdef DEBUG
diff --git a/ipc/glue/BackgroundUtils.cpp b/ipc/glue/BackgroundUtils.cpp
index 2251dad0e11..e91cf98b07f 100644
--- a/ipc/glue/BackgroundUtils.cpp
+++ b/ipc/glue/BackgroundUtils.cpp
@@ -602,11 +602,11 @@ nsresult LoadInfoToLoadInfoArgs(nsILoadInfo* aLoadInfo,
aLoadInfo->GetAllowDeprecatedSystemRequests(),
aLoadInfo->GetIsInDevToolsContext(), aLoadInfo->GetParserCreatedScript(),
requestMode, aLoadInfo->GetIsFromProcessingFrameAttributes(),
- aLoadInfo->GetIsMediaRequest(), aLoadInfo->GetIsFromObjectOrEmbed(),
- cookieJarSettingsArgs, aLoadInfo->GetRequestBlockingReason(),
- maybePolicyContainerToInherit, aLoadInfo->GetStoragePermission(),
- aLoadInfo->GetParentIpAddressSpace(), aLoadInfo->GetIpAddressSpace(),
- overriddenFingerprintingSettingsArg, aLoadInfo->GetIsMetaRefresh(),
+ aLoadInfo->GetIsMediaRequest(), cookieJarSettingsArgs,
+ aLoadInfo->GetRequestBlockingReason(), maybePolicyContainerToInherit,
+ aLoadInfo->GetStoragePermission(), aLoadInfo->GetParentIpAddressSpace(),
+ aLoadInfo->GetIpAddressSpace(), overriddenFingerprintingSettingsArg,
+ aLoadInfo->GetIsMetaRefresh(),
aLoadInfo->GetActivatedFromNavigationalPrefetch(),
aLoadInfo->GetLoadingEmbedderPolicy(),
aLoadInfo->GetIsOriginTrialCoepCredentiallessEnabledForTopLevel(),
diff --git a/netwerk/base/LoadInfo.h b/netwerk/base/LoadInfo.h
index 7d4eb0f8ef0..64b79c03e4e 100644
--- a/netwerk/base/LoadInfo.h
+++ b/netwerk/base/LoadInfo.h
@@ -205,9 +205,6 @@ nsresult LoadInfoArgsToLoadInfo(const mozilla::net::LoadInfoArgs& aLoadInfoArgs,
GETTER(bool, IsMediaRequest, isMediaRequest, false) \
SETTER(bool, IsMediaRequest) \
\
- GETTER(bool, IsFromObjectOrEmbed, isFromObjectOrEmbed, false) \
- SETTER(bool, IsFromObjectOrEmbed) \
- \
GETTER(nsILoadInfo::CrossOriginEmbedderPolicy, LoadingEmbedderPolicy, \
loadingEmbedderPolicy, nsILoadInfo::EMBEDDER_POLICY_NULL) \
SETTER(nsILoadInfo::CrossOriginEmbedderPolicy, LoadingEmbedderPolicy) \
diff --git a/netwerk/base/nsILoadInfo.idl b/netwerk/base/nsILoadInfo.idl
index 0cde3cee553..1830c86aead 100644
--- a/netwerk/base/nsILoadInfo.idl
+++ b/netwerk/base/nsILoadInfo.idl
@@ -1637,12 +1637,6 @@ interface nsILoadInfo : nsISupports
*/
[infallible] attribute boolean isMediaRequest;
- /**
- * This attribute will be true if the fetch request is from object or embed
- * elements
- */
- [infallible] attribute boolean isFromObjectOrEmbed;
-
/**
* If this is non-null, this property holds the URI as it was before query
* stripping was performed.
diff --git a/netwerk/ipc/NeckoChannelParams.ipdlh b/netwerk/ipc/NeckoChannelParams.ipdlh
index 3bf268b3efb..a6ca1b8cb39 100644
--- a/netwerk/ipc/NeckoChannelParams.ipdlh
+++ b/netwerk/ipc/NeckoChannelParams.ipdlh
@@ -208,7 +208,6 @@ struct LoadInfoArgs
RequestMode? requestMode;
bool isFromProcessingFrameAttributes;
bool isMediaRequest;
- bool isFromObjectOrEmbed;
CookieJarSettingsArgs cookieJarSettings;
uint32_t requestBlockingReason;
PolicyContainerArgs? policyContainerToInherit;
diff --git a/netwerk/protocol/http/HttpBaseChannel.cpp b/netwerk/protocol/http/HttpBaseChannel.cpp
index 0f77e4451c3..77e11d8302b 100644
--- a/netwerk/protocol/http/HttpBaseChannel.cpp
+++ b/netwerk/protocol/http/HttpBaseChannel.cpp
@@ -3414,12 +3414,6 @@ bool HttpBaseChannel::ShouldBlockOpaqueResponse() const {
return false;
}
- // Ignore the request from object or embed elements
- if (mLoadInfo->GetIsFromObjectOrEmbed()) {
- LOGORB("No block: Request From <object> or <embed>");
- return false;
- }
-
// Exclude no_cors System XHR
if (extContentPolicyType == ExtContentPolicy::TYPE_XMLHTTPREQUEST) {
if (securityMode ==
Loading diff…
References
On This Page