Firefox · Networking
CVE-2026-109751
Logic Error in Networking
Overview
Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
netwerk/base/nsSimpleNestedURI.cpp
Patch
diff --git a/netwerk/base/nsSimpleNestedURI.cpp b/netwerk/base/nsSimpleNestedURI.cpp
index f38be0981a8..df4f60bc4f6 100644
--- a/netwerk/base/nsSimpleNestedURI.cpp
+++ b/netwerk/base/nsSimpleNestedURI.cpp
@@ -136,12 +136,23 @@ bool nsSimpleNestedURI::Deserialize(const mozilla::ipc::URIParams& aParams) {
const SimpleNestedURIParams& params = aParams.get_SimpleNestedURIParams();
if (!nsSimpleURI::Deserialize(params.simpleParams())) return false;
- mInnerURI = DeserializeURI(params.innerURI());
- if (!mInnerURI || !IsValidInnerURI(mInnerURI)) {
+ nsCOMPtr<nsIURI> innerURI = DeserializeURI(params.innerURI());
+ if (!innerURI || !IsValidInnerURI(innerURI)) {
return false;
}
- return true;
+ if (!XRE_IsParentProcess()) {
+ // A content process can trust the serialized URI
+ mInnerURI = innerURI;
+ return true;
+ }
+
+ nsAutoCString innerSpec;
+ if (NS_FAILED(innerURI->GetAsciiSpec(innerSpec))) {
+ return false;
+ }
+ mInnerURI = nullptr;
+ return NS_SUCCEEDED(NS_NewURI(getter_AddRefs(mInnerURI), innerSpec));
}
bool nsSimpleNestedURI::IsValidInnerURI(nsIURI* aInnerURI) {
Loading diff…
References
On This Page