Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionMitigation bypass in the DOM: Security component
ComponentDOM
Bug ClassLogic Error
Tracker2066321
Fix commit14faf842ea3b (firefox) +8/-16
CISA KEVNot listed
CreditedRintaro Kawasugi
Disclosed2026-09-29

Files Changed

  • dom/security/nsContentSecurityUtils.cpp
  • testing/web-platform/meta/content-security-policy/script-src/non-nonceable-elements.html.ini
diff --git a/dom/security/nsContentSecurityUtils.cpp b/dom/security/nsContentSecurityUtils.cpp
index b5e8ca95d7e..ea7e8944731 100644
--- a/dom/security/nsContentSecurityUtils.cpp
+++ b/dom/security/nsContentSecurityUtils.cpp
@@ -1185,8 +1185,9 @@ nsString nsContentSecurityUtils::GetIsElementNonceableNonce(
   // element’s attribute list:
   if (nsCOMPtr<nsIScriptElement> script =
           do_QueryInterface(const_cast<Element*>(&aElement))) {
-    auto containsScriptOrStyle = [](const nsAString& aStr) {
-      return aStr.LowerCaseFindASCII("<script") != kNotFound ||
+    auto containsLinkScriptOrStyle = [](const nsAString& aStr) {
+      return aStr.LowerCaseFindASCII("<link") != kNotFound ||
+             aStr.LowerCaseFindASCII("<script") != kNotFound ||
              aStr.LowerCaseFindASCII("<style") != kNotFound;
     };
 
@@ -1194,21 +1195,21 @@ nsString nsContentSecurityUtils::GetIsElementNonceableNonce(
     uint32_t i = 0;
     while (BorrowedAttrInfo info = aElement.GetAttrInfoAt(i++)) {
       // Step 2.1. If attribute’s name contains an ASCII case-insensitive match
-      // for "<script" or "<style", return "Not Nonceable".
+      // for "<link", <script" or "<style", return "Not Nonceable".
       const nsAttrName* name = info.mName;
       if (nsAtom* prefix = name->GetPrefix()) {
-        if (containsScriptOrStyle(nsDependentAtomString(prefix))) {
+        if (containsLinkScriptOrStyle(nsDependentAtomString(prefix))) {
           return EmptyString();
         }
       }
-      if (containsScriptOrStyle(nsDependentAtomString(name->LocalName()))) {
+      if (containsLinkScriptOrStyle(nsDependentAtomString(name->LocalName()))) {
         return EmptyString();
       }
 
       // Step 2.2. If attribute’s value contains an ASCII case-insensitive match
-      // for "<script" or "<style", return "Not Nonceable".
+      // for "<link", "<script" or "<style", return "Not Nonceable".
       info.mValue->ToString(value);
-      if (containsScriptOrStyle(value)) {
+      if (containsLinkScriptOrStyle(value)) {
         return EmptyString();
       }
     }
diff --git a/testing/web-platform/meta/content-security-policy/script-src/non-nonceable-elements.html.ini b/testing/web-platform/meta/content-security-policy/script-src/non-nonceable-elements.html.ini
deleted file mode 100644
index 84e27326529..00000000000
--- a/testing/web-platform/meta/content-security-policy/script-src/non-nonceable-elements.html.ini
+++ /dev/null
@@ -1,9 +0,0 @@
-[non-nonceable-elements.html]
-  [Non-nonceable script element 5]
-    expected: FAIL
-
-  [Non-nonceable script element 6]
-    expected: FAIL
-
-  [Non-nonceable script element 9]
-    expected: FAIL
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/testing/web-platform/meta/content-security-policy/script-src/non-nonceable-elements.html.ini b/testing/web-platform/meta/content-security-policy/script-src/non-nonceable-elements.html.ini
deleted file mode 100644
index 84e27326529..00000000000
--- a/testing/web-platform/meta/content-security-policy/script-src/non-nonceable-elements.html.ini
+++ /dev/null
@@ -1,9 +0,0 @@
-[non-nonceable-elements.html]
-  [Non-nonceable script element 5]
-    expected: FAIL
-
-  [Non-nonceable script element 6]
-    expected: FAIL
-
-  [Non-nonceable script element 9]
-    expected: FAIL
Loading diff…