Firefox · Toolkit
CVE-2026-6765
Logic Error in Toolkit
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
switchtoolkit/components/formautofill/FormAutofillParent.sys.mjs |
modified |
Files Changed
browser/components/asrouter/modules/ASRouterTargeting.sys.mjsbrowser/components/asrouter/tests/browser/browser_asrouter_targeting.jstoolkit/components/formautofill/FormAutofillParent.sys.mjs
Patch
diff --git a/browser/components/asrouter/modules/ASRouterTargeting.sys.mjs b/browser/components/asrouter/modules/ASRouterTargeting.sys.mjs
index 1e1365ba06e..6075fa6d12a 100644
--- a/browser/components/asrouter/modules/ASRouterTargeting.sys.mjs
+++ b/browser/components/asrouter/modules/ASRouterTargeting.sys.mjs
@@ -612,11 +612,8 @@ async function getAutofillRecords(data) {
// JSActors, but that would import a lot of code for a targeting attribute.
return 0;
}
- let records = await actor?.receiveMessage({
- name: "FormAutofill:GetRecords",
- data,
- });
- return records?.records?.length ?? 0;
+ let records = await actor?.getRecords(data);
+ return records?.length ?? 0;
}
// Attribution data can be encoded multiple times so we need this function to
diff --git a/browser/components/asrouter/tests/browser/browser_asrouter_targeting.js b/browser/components/asrouter/tests/browser/browser_asrouter_targeting.js
index 549f0865034..5b10357fce9 100644
--- a/browser/components/asrouter/tests/browser/browser_asrouter_targeting.js
+++ b/browser/components/asrouter/tests/browser/browser_asrouter_targeting.js
@@ -1677,15 +1677,10 @@ add_task(async function test_creditCardsSaved() {
gBrowser.selectedBrowser.browsingContext.currentWindowGlobal.getActor(
"FormAutofill"
),
- "receiveMessage"
+ "getRecords"
)
- .withArgs(
- sandbox.match({
- name: "FormAutofill:GetRecords",
- data: { collectionName: "creditCards" },
- })
- )
- .resolves({ records: [creditcard] })
+ .withArgs(sandbox.match({ collectionName: "creditCards" }))
+ .resolves([creditcard])
.callThrough();
is(
@@ -1694,8 +1689,8 @@ add_task(async function test_creditCardsSaved() {
"Should return 1 when 1 credit card is saved"
);
ok(
- stub.calledWithMatch({ name: "FormAutofill:GetRecords" }),
- "Targeting called FormAutofill:GetRecords"
+ stub.calledWithMatch({ collectionName: "creditCards" }),
+ "Targeting called getRecords"
);
sandbox.restore();
diff --git a/toolkit/components/formautofill/FormAutofillParent.sys.mjs b/toolkit/components/formautofill/FormAutofillParent.sys.mjs
index a4f4cbef056..8c78702a0c3 100644
--- a/toolkit/components/formautofill/FormAutofillParent.sys.mjs
+++ b/toolkit/components/formautofill/FormAutofillParent.sys.mjs
@@ -49,7 +49,6 @@ ChromeUtils.defineESModuleGetters(lazy, {
FirefoxRelay: "resource://gre/modules/FirefoxRelay.sys.mjs",
LoginHelper: "resource://gre/modules/LoginHelper.sys.mjs",
NimbusFeatures: "resource://nimbus/ExperimentAPI.sys.mjs",
- OSKeyStore: "resource://gre/modules/OSKeyStore.sys.mjs",
});
ChromeUtils.defineLazyGetter(lazy, "log", () =>
@@ -64,6 +63,16 @@ const { ADDRESSES_COLLECTION_NAME, CREDITCARDS_COLLECTION_NAME, FIELD_STATES } =
let gMessageObservers = new Set();
+const FORM_AUTOFILL_MESSAGES = new Set([
+ "FormAutofill:InitStorage",
+ "FormAutofill:OnFormSubmit",
+ "FormAutofill:FieldsIdentified",
+ "FormAutofill:OnFieldsDetected",
+ "FormAutofill:OnFieldsUpdated",
+ "FormAutofill:FieldFilledModified",
+ "FormAutofill:FieldsUpdatedDuringAutofill",
+]);
+
export let FormAutofillStatus = {
_initialized: false,
@@ -300,6 +309,10 @@ export class FormAutofillParent extends JSWindowActorParent {
return undefined;
}
+ if (!FORM_AUTOFILL_MESSAGES.has(name) && !Cu.isInAutomation) {
+ return undefined;
+ }
+
switch (name) {
case "FormAutofill:InitStorage": {
await lazy.gFormAutofillStorage.initialize();
@@ -358,12 +371,6 @@ export class FormAutofillParent extends JSWindowActorParent {
break;
}
case "FormAutofill:SaveCreditCard": {
- // Setting the first parameter of OSKeyStore.ensurLoggedIn as false
- // since this case only called in tests. Also the reason why we're not calling FormAutofill.verifyUserOSAuth.
- if (!(await lazy.OSKeyStore.ensureLoggedIn(false)).authenticated) {
- lazy.log.warn("User canceled encryption login");
- return undefined;
- }
await lazy.gFormAutofillStorage.creditCards.add(data.creditcard);
break;
}
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/browser/components/asrouter/tests/browser/browser_asrouter_targeting.js b/browser/components/asrouter/tests/browser/browser_asrouter_targeting.js
index 549f0865034..5b10357fce9 100644
--- a/browser/components/asrouter/tests/browser/browser_asrouter_targeting.js
+++ b/browser/components/asrouter/tests/browser/browser_asrouter_targeting.js
@@ -1677,15 +1677,10 @@ add_task(async function test_creditCardsSaved() {
gBrowser.selectedBrowser.browsingContext.currentWindowGlobal.getActor(
"FormAutofill"
),
- "receiveMessage"
+ "getRecords"
)
- .withArgs(
- sandbox.match({
- name: "FormAutofill:GetRecords",
- data: { collectionName: "creditCards" },
- })
- )
- .resolves({ records: [creditcard] })
+ .withArgs(sandbox.match({ collectionName: "creditCards" }))
+ .resolves([creditcard])
.callThrough();
is(
@@ -1694,8 +1689,8 @@ add_task(async function test_creditCardsSaved() {
"Should return 1 when 1 credit card is saved"
);
ok(
- stub.calledWithMatch({ name: "FormAutofill:GetRecords" }),
- "Targeting called FormAutofill:GetRecords"
+ stub.calledWithMatch({ collectionName: "creditCards" }),
+ "Targeting called getRecords"
);
sandbox.restore();
Loading diff…
References
On This Page