Firefox · DOM
CVE-2026-12295
Sandbox Escape in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/base/Document.cpp |
modified |
Files Changed
docshell/base/nsDocShell.cppdocshell/base/nsDocShellLoadState.cppdom/base/Document.cppnetwerk/protocol/viewsource/nsViewSourceChannel.cpp
Patch
diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index a2e8d939f8f..92ca9d5eb1d 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -9028,6 +9028,8 @@ nsIPrincipal* nsDocShell::GetInheritedPrincipal(
MOZ_TRY(vsh->NewSrcdocChannel(aURI, aBaseURI, aSrcdoc, aLoadInfo,
getter_AddRefs(channel)));
} else {
+ MOZ_RELEASE_ASSERT(NS_IsAboutSrcdoc(aURI));
+
MOZ_TRY(NS_NewInputStreamChannelInternal(getter_AddRefs(channel), aURI,
aSrcdoc, "text/html"_ns, aLoadInfo,
true));
diff --git a/docshell/base/nsDocShellLoadState.cpp b/docshell/base/nsDocShellLoadState.cpp
index 52e6c0bc633..3d250d97275 100644
--- a/docshell/base/nsDocShellLoadState.cpp
+++ b/docshell/base/nsDocShellLoadState.cpp
@@ -163,6 +163,12 @@ nsDocShellLoadState::nsDocShellLoadState(
}
}
+ if (!mSrcdocData.IsVoid() && !mURI->SchemeIs("view-source") &&
+ !NS_IsAboutSrcdoc(mURI)) {
+ aActor->FatalError("nsDocShellLoadState with invalid srcdoc state");
+ return;
+ }
+
// We successfully read in the data - return a success value.
*aReadSuccess = true;
}
diff --git a/dom/base/Document.cpp b/dom/base/Document.cpp
index d535a519b53..d9a2ce48b01 100644
--- a/dom/base/Document.cpp
+++ b/dom/base/Document.cpp
@@ -3522,6 +3522,7 @@ nsresult Document::StartDocumentLoad(const char* aCommand, nsIChannel* aChannel,
bool isSrcdocChannel;
inStrmChan->GetIsSrcdocChannel(&isSrcdocChannel);
if (isSrcdocChannel) {
+ MOZ_RELEASE_ASSERT(!IsTopLevelContentDocument());
mIsSrcdocDocument = true;
}
}
diff --git a/netwerk/protocol/viewsource/nsViewSourceChannel.cpp b/netwerk/protocol/viewsource/nsViewSourceChannel.cpp
index 55710b51e14..a4f4841725c 100644
--- a/netwerk/protocol/viewsource/nsViewSourceChannel.cpp
+++ b/netwerk/protocol/viewsource/nsViewSourceChannel.cpp
@@ -11,6 +11,7 @@
#include "nsIHttpHeaderVisitor.h"
#include "nsIIOService.h"
#include "nsIInputStreamChannel.h"
+#include "nsINestedURI.h"
#include "nsIReferrerInfo.h"
#include "nsMimeTypes.h"
#include "nsNetUtil.h"
@@ -108,6 +109,14 @@ nsresult nsViewSourceChannel::InitSrcdoc(nsIURI* aURI, nsIURI* aBaseURI,
nsILoadInfo* aLoadInfo) {
nsresult rv;
+ MOZ_ASSERT(aURI->SchemeIs("view-source"));
+ nsCOMPtr<nsINestedURI> nestedURI(do_QueryInterface(aURI));
+ NS_ENSURE_TRUE(nestedURI, NS_ERROR_INVALID_ARG);
+ nsCOMPtr<nsIURI> innerURI;
+ rv = nestedURI->GetInnerURI(getter_AddRefs(innerURI));
+ NS_ENSURE_SUCCESS(rv, rv);
+ MOZ_RELEASE_ASSERT(NS_IsAboutSrcdoc(innerURI));
+
nsCOMPtr<nsIURI> inStreamURI;
// Need to strip view-source: from the URI. Hardcoded to
// about:srcdoc as this is the only permissible URI for srcdoc
Loading diff…
References
On This Page