Firefox · Networking
CVE-2026-109705
Logic Error in Networking
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
modules/libpref/init/StaticPrefList.yamlnetwerk/base/nsStandardURL.cpp
Patch
diff --git a/modules/libpref/init/StaticPrefList.yaml b/modules/libpref/init/StaticPrefList.yaml
index 08beb6c32a4..0794e9b35c1 100644
--- a/modules/libpref/init/StaticPrefList.yaml
+++ b/modules/libpref/init/StaticPrefList.yaml
@@ -16097,6 +16097,13 @@
value: 1048576
mirror: always
+# Whether nsStandardURL::Deserialize should reparse the URL
+# it got from the content process
+- name: network.ipc.reparse_deserialized_uri
+ type: RelaxedAtomicBool
+ value: true
+ mirror: always
+
# If true, use the HSTS preload list.
- name: network.stricttransportsecurity.preloadlist
type: RelaxedAtomicBool
diff --git a/netwerk/base/nsStandardURL.cpp b/netwerk/base/nsStandardURL.cpp
index d0ee43603a4..5c93d0b73b1 100644
--- a/netwerk/base/nsStandardURL.cpp
+++ b/netwerk/base/nsStandardURL.cpp
@@ -3499,6 +3499,15 @@ nsresult nsStandardURL::ReadPrivate(nsIObjectInputStream* stream) {
NS_ENSURE_TRUE(CheckSegmentInvariants(), NS_ERROR_MALFORMED_URI);
+ if (StaticPrefs::network_ipc_reparse_deserialized_uri() &&
+ XRE_IsParentProcess()) {
+ nsAutoCString spec(mSpec);
+ rv = SetSpecInternal(spec);
+ if (NS_FAILED(rv)) {
+ return rv;
+ }
+ }
+
rv = CheckIfHostIsAscii();
if (NS_FAILED(rv)) {
return rv;
@@ -3802,6 +3811,13 @@ bool nsStandardURL::Deserialize(const URIParams& aParams) {
return false;
}
+ if (StaticPrefs::network_ipc_reparse_deserialized_uri() &&
+ XRE_IsParentProcess()) {
+ if (NS_FAILED(SetSpecInternal(params.spec()))) {
+ return false;
+ }
+ }
+
nsresult rv = CheckIfHostIsAscii();
if (NS_FAILED(rv)) {
return false;
Loading diff…
References
On This Page