Firefox · Networking
CVE-2026-8948
Cross Origin in Networking
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
GetTaintingnetwerk/base/LoadInfo.cpp |
modified | |
GetTaintingnetwerk/base/TRRLoadInfo.cpp |
modified |
Files Changed
ipc/glue/BackgroundUtils.cppnetwerk/base/LoadInfo.cppnetwerk/base/LoadInfo.hnetwerk/base/TRRLoadInfo.cpp
Patch
diff --git a/ipc/glue/BackgroundUtils.cpp b/ipc/glue/BackgroundUtils.cpp
index 35bc5fd63d7..5bac0c19d36 100644
--- a/ipc/glue/BackgroundUtils.cpp
+++ b/ipc/glue/BackgroundUtils.cpp
@@ -877,6 +877,7 @@ nsresult LoadInfoArgsToLoadInfo(const LoadInfoArgs& loadInfoArgs,
reservedClientInfo, initialClientInfo, controller,
loadInfoArgs.securityFlags(), loadInfoArgs.sandboxFlags(),
loadInfoArgs.contentPolicyType(),
+ loadInfoArgs.serviceWorkerTaintingSynthesized(),
static_cast<LoadTainting>(loadInfoArgs.tainting()),
#define DEFINE_ARGUMENT(_t, _n, name, _d) loadInfoArgs.name(),
diff --git a/netwerk/base/LoadInfo.cpp b/netwerk/base/LoadInfo.cpp
index 5359994177e..a9abddc425e 100644
--- a/netwerk/base/LoadInfo.cpp
+++ b/netwerk/base/LoadInfo.cpp
@@ -723,6 +723,8 @@ LoadInfo::LoadInfo(const LoadInfo& rhs)
mSecurityFlags(rhs.mSecurityFlags),
mSandboxFlags(rhs.mSandboxFlags),
mInternalContentPolicyType(rhs.mInternalContentPolicyType),
+ // mServiceWorkerTaintingSynthesized must be handled specially during
+ // redirect
mTainting(rhs.mTainting),
#define DEFINE_INIT(_t, name, _n, _d) m##name(rhs.m##name),
LOADINFO_FOR_EACH_FIELD(DEFINE_INIT, LOADINFO_DUMMY_SETTER)
@@ -764,7 +766,8 @@ LoadInfo::LoadInfo(
const Maybe<ClientInfo>& aInitialClientInfo,
const Maybe<ServiceWorkerDescriptor>& aController,
nsSecurityFlags aSecurityFlags, uint32_t aSandboxFlags,
- nsContentPolicyType aContentPolicyType, LoadTainting aTainting,
+ nsContentPolicyType aContentPolicyType,
+ bool aServiceWorkerTaintingSynthesized, LoadTainting aTainting,
#define DEFINE_PARAMETER(type, name, _n, _d) type a##name,
LOADINFO_FOR_EACH_FIELD(DEFINE_PARAMETER, LOADINFO_DUMMY_SETTER)
#undef DEFINE_PARAMETER
@@ -803,6 +806,7 @@ LoadInfo::LoadInfo(
mSecurityFlags(aSecurityFlags),
mSandboxFlags(aSandboxFlags),
mInternalContentPolicyType(aContentPolicyType),
+ mServiceWorkerTaintingSynthesized(aServiceWorkerTaintingSynthesized),
mTainting(aTainting),
#define DEFINE_INIT(_t, name, _n, _d) m##name(a##name),
@@ -1661,6 +1665,14 @@ LoadInfo::GetLoadTriggeredFromExternal(bool* aLoadTriggeredFromExternal) {
return NS_OK;
}
+NS_IMETHODIMP
+LoadInfo::GetServiceWorkerTaintingSynthesized(
+ bool* aServiceWorkerTaintingSynthesized) {
+ MOZ_ASSERT(aServiceWorkerTaintingSynthesized);
+ *aServiceWorkerTaintingSynthesized = mServiceWorkerTaintingSynthesized;
+ return NS_OK;
+}
+
NS_IMETHODIMP
LoadInfo::GetTainting(uint32_t* aTaintingOut) {
MOZ_ASSERT(aTaintingOut);
diff --git a/netwerk/base/LoadInfo.h b/netwerk/base/LoadInfo.h
index 50052f1af15..797517e6959 100644
--- a/netwerk/base/LoadInfo.h
+++ b/netwerk/base/LoadInfo.h
@@ -139,9 +139,6 @@ nsresult LoadInfoArgsToLoadInfo(const mozilla::net::LoadInfoArgs& aLoadInfoArgs,
\
GETTER(bool, IsPreflight, isPreflight, false) \
\
- GETTER(bool, ServiceWorkerTaintingSynthesized, \
- serviceWorkerTaintingSynthesized, false) \
- \
GETTER(bool, DocumentHasUserInteracted, documentHasUserInteracted, false) \
SETTER(bool, DocumentHasUserInteracted) \
\
@@ -418,7 +415,8 @@ class LoadInfo final : public nsILoadInfo {
const Maybe<mozilla::dom::ClientInfo>& aInitialClientInfo,
const Maybe<mozilla::dom::ServiceWorkerDescriptor>& aController,
nsSecurityFlags aSecurityFlags, uint32_t aSandboxFlags,
- nsContentPolicyType aContentPolicyType, LoadTainting aTainting,
+ nsContentPolicyType aContentPolicyType,
+ bool aServiceWorkerTaintingSynthesized, LoadTainting aTainting,
#define DEFINE_PARAMETER(type, name, _n, _d) type a##name,
LOADINFO_FOR_EACH_FIELD(DEFINE_PARAMETER, LOADINFO_DUMMY_SETTER)
@@ -511,6 +509,7 @@ class LoadInfo final : public nsILoadInfo {
dom::ReferrerPolicy mFrameReferrerPolicySnapshot =
dom::ReferrerPolicy::_empty;
nsContentPolicyType mInternalContentPolicyType;
+ bool mServiceWorkerTaintingSynthesized = false;
LoadTainting mTainting = LoadTainting::Basic;
#define DEFINE_FIELD(type, name, _, default_init) type m##name = default_init;
diff --git a/netwerk/base/TRRLoadInfo.cpp b/netwerk/base/TRRLoadInfo.cpp
index debfc6aa22b..8acc7468ae6 100644
--- a/netwerk/base/TRRLoadInfo.cpp
+++ b/netwerk/base/TRRLoadInfo.cpp
@@ -355,6 +355,12 @@ TRRLoadInfo::GetLoadTriggeredFromExternal(bool* aLoadTriggeredFromExternal) {
return NS_ERROR_NOT_IMPLEMENTED;
}
+NS_IMETHODIMP
+TRRLoadInfo::GetServiceWorkerTaintingSynthesized(
+ bool* aServiceWorkerTaintingSynthesized) {
+ return NS_ERROR_NOT_IMPLEMENTED;
+}
+
NS_IMETHODIMP
TRRLoadInfo::GetTainting(uint32_t* aTaintingOut) {
return NS_ERROR_NOT_IMPLEMENTED;
Loading diff…
References
On This Page