From 7c429f525e8f6303c409c3b67d3de073488f554d Mon Sep 17 00:00:00 2001 From: Moonchild Date: Sun, 3 Jul 2022 08:12:45 +0000 Subject: [PATCH 1/6] [network] Clean up and update the list of external protocol handlers. --- modules/libpref/init/all.js | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js index e7a5b32dff..14ce7180e2 100644 --- a/modules/libpref/init/all.js +++ b/modules/libpref/init/all.js @@ -1360,22 +1360,27 @@ pref("network.protocol-handler.external-default", true); // OK to load pref("network.protocol-handler.warn-external-default", true); // warn before load // Prevent using external protocol handlers for these schemes -pref("network.protocol-handler.external.hcp", false); -pref("network.protocol-handler.external.vbscript", false); -pref("network.protocol-handler.external.javascript", false); +pref("network.protocol-handler.external.afp", false); pref("network.protocol-handler.external.data", false); -pref("network.protocol-handler.external.ms-help", false); +pref("network.protocol-handler.external.disk", false); +pref("network.protocol-handler.external.disks", false); +pref("network.protocol-handler.external.hcp", false); +pref("network.protocol-handler.external.javascript", false); pref("network.protocol-handler.external.mk", false); +pref("network.protocol-handler.external.moz-icon", false); pref("network.protocol-handler.external.res", false); pref("network.protocol-handler.external.shell", false); +pref("network.protocol-handler.external.vbscript", false); pref("network.protocol-handler.external.vnd.ms.radio", false); +#ifdef XP_WIN +pref("network.protocol-handler.external.ms-help", false); +pref("network.protocol-handler.external.ms-msdt", false); +pref("network.protocol-handler.external.search", false); +pref("network.protocol-handler.external.search-ms", false); +#endif #ifdef XP_MACOSX pref("network.protocol-handler.external.help", false); #endif -pref("network.protocol-handler.external.disk", false); -pref("network.protocol-handler.external.disks", false); -pref("network.protocol-handler.external.afp", false); -pref("network.protocol-handler.external.moz-icon", false); // Don't allow external protocol handlers for common typos pref("network.protocol-handler.external.ttp", false); // http From 6066cc36cdc94a6b92ec6881b1d71b7e8472c376 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Sun, 3 Jul 2022 10:21:06 +0000 Subject: [PATCH 2/6] [DOM media] Remove potentially unsafe type accesses when debug logging --- dom/media/mediasource/TrackBuffersManager.cpp | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/dom/media/mediasource/TrackBuffersManager.cpp b/dom/media/mediasource/TrackBuffersManager.cpp index 8663c1a8f8..022bb5bd10 100644 --- a/dom/media/mediasource/TrackBuffersManager.cpp +++ b/dom/media/mediasource/TrackBuffersManager.cpp @@ -22,15 +22,15 @@ extern mozilla::LogModule* GetMediaSourceLog(); -#define MSE_DEBUG(arg, ...) MOZ_LOG(GetMediaSourceLog(), mozilla::LogLevel::Debug, ("TrackBuffersManager(%p:%s)::%s: " arg, this, mType.get(), __func__, ##__VA_ARGS__)) -#define MSE_DEBUGV(arg, ...) MOZ_LOG(GetMediaSourceLog(), mozilla::LogLevel::Verbose, ("TrackBuffersManager(%p:%s)::%s: " arg, this, mType.get(), __func__, ##__VA_ARGS__)) +#define MSE_DEBUG(arg, ...) MOZ_LOG(GetMediaSourceLog(), mozilla::LogLevel::Debug, ("TrackBuffersManager(%p)::%s: " arg, this,__func__, ##__VA_ARGS__)) +#define MSE_DEBUGV(arg, ...) MOZ_LOG(GetMediaSourceLog(), mozilla::LogLevel::Verbose, ("TrackBuffersManager(%p)::%s: " arg, this, __func__, ##__VA_ARGS__)) mozilla::LogModule* GetMediaSourceSamplesLog() { static mozilla::LazyLogModule sLogModule("MediaSourceSamples"); return sLogModule; } -#define SAMPLE_DEBUG(arg, ...) MOZ_LOG(GetMediaSourceSamplesLog(), mozilla::LogLevel::Debug, ("TrackBuffersManager(%p:%s)::%s: " arg, this, mType.get(), __func__, ##__VA_ARGS__)) +#define SAMPLE_DEBUG(arg, ...) MOZ_LOG(GetMediaSourceSamplesLog(), mozilla::LogLevel::Debug, ("TrackBuffersManager(%p)::%s: " arg, this, __func__, ##__VA_ARGS__)) namespace mozilla { From 2706ef696dba1677a96723fc8e08f8ea72f0cd76 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Sun, 3 Jul 2022 11:30:19 +0000 Subject: [PATCH 3/6] Update NSS --- security/nss/lib/softoken/legacydb/lginit.c | 7 +------ security/nss/lib/util/secasn1d.c | 15 +++++++++++++-- 2 files changed, 14 insertions(+), 8 deletions(-) diff --git a/security/nss/lib/softoken/legacydb/lginit.c b/security/nss/lib/softoken/legacydb/lginit.c index 4f0b53f521..f34d015b5d 100644 --- a/security/nss/lib/softoken/legacydb/lginit.c +++ b/security/nss/lib/softoken/legacydb/lginit.c @@ -515,6 +515,7 @@ lg_init(SDB **pSdb, int flags, NSSLOWCERTCertDBHandle *certdbPtr, lgdb_p->hashTable = PL_NewHashTable(64, lg_HashNumber, PL_CompareValues, SECITEM_HashCompare, NULL, 0); if (lgdb_p->hashTable == NULL) { + PR_DestroyLock(lgdb_p->dbLock); goto loser; } @@ -546,12 +547,6 @@ loser: PORT_Free(sdb); } if (lgdb_p) { - if (lgdb_p->dbLock) { - PR_DestroyLock(lgdb_p->dbLock); - } - if (lgdb_p->hashTable) { - PL_HashTableDestroy(lgdb_p->hashTable); - } PORT_Free(lgdb_p); } return error; diff --git a/security/nss/lib/util/secasn1d.c b/security/nss/lib/util/secasn1d.c index ed237ed72c..3a40ce68a2 100644 --- a/security/nss/lib/util/secasn1d.c +++ b/security/nss/lib/util/secasn1d.c @@ -1114,7 +1114,7 @@ sec_asn1d_prepare_for_contents(sec_asn1d_state *state) * inspection, too) then move this code into the switch statement * below under cases SET_OF and SEQUENCE_OF; it will be cleaner. */ - PORT_Assert(state->underlying_kind == SEC_ASN1_SET_OF || state->underlying_kind == SEC_ASN1_SEQUENCE_OF || state->underlying_kind == (SEC_ASN1_SEQUENCE_OF | SEC_ASN1_DYNAMIC) || state->underlying_kind == (SEC_ASN1_SEQUENCE_OF | SEC_ASN1_DYNAMIC)); + PORT_Assert(state->underlying_kind == SEC_ASN1_SET_OF || state->underlying_kind == SEC_ASN1_SEQUENCE_OF || state->underlying_kind == (SEC_ASN1_SET_OF | SEC_ASN1_DYNAMIC) || state->underlying_kind == (SEC_ASN1_SEQUENCE_OF | SEC_ASN1_DYNAMIC)); if (state->contents_length != 0 || state->indefinite) { const SEC_ASN1Template *subt; @@ -2463,7 +2463,18 @@ sec_asn1d_parse_end_of_contents(sec_asn1d_state *state, if (state->pending == 0) { state->place = afterEndOfContents; - state->endofcontents = PR_TRUE; + /* These end-of-contents octets either terminate a SEQUENCE, a GROUP, + * or a constructed string. The SEQUENCE case is unique in that the + * state parses its own end-of-contents octets and therefore should not + * have its `endofcontents` flag set. We identify the SEQUENCE case by + * checking whether the child state's template is pointing at a + * template terminator (see `sec_asn1d_next_in_sequence`). + */ + if (state->child && state->child->theTemplate->kind == 0) { + state->endofcontents = PR_FALSE; + } else { + state->endofcontents = PR_TRUE; + } } return len; From 991e2ffb4ba5068e1988f873512f97281b650f1d Mon Sep 17 00:00:00 2001 From: Moonchild Date: Sun, 3 Jul 2022 12:28:57 +0000 Subject: [PATCH 4/6] [network] Clear PAC loader when the load failed --- netwerk/base/nsPACMan.cpp | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/netwerk/base/nsPACMan.cpp b/netwerk/base/nsPACMan.cpp index 37d3e8b6bb..f00c3cc434 100644 --- a/netwerk/base/nsPACMan.cpp +++ b/netwerk/base/nsPACMan.cpp @@ -474,6 +474,11 @@ nsPACMan::StartLoading() void nsPACMan::OnLoadFailure() { + // We have to clear the loader to indicate that we are currently not loading PAC. + if (mLoader) { + mLoader = nullptr; + } + int32_t minInterval = 5; // 5 seconds int32_t maxInterval = 300; // 5 minutes From c0429c9a0f5eec607ce0b97c9837f99610345cc3 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Sun, 3 Jul 2022 13:03:18 +0000 Subject: [PATCH 5/6] [DOM] use the sanitizer to restrict href in svg:use to fragment-only URLs --- dom/base/nsTreeSanitizer.cpp | 18 +++++++++++++++--- dom/base/nsTreeSanitizer.h | 4 +++- 2 files changed, 18 insertions(+), 4 deletions(-) diff --git a/dom/base/nsTreeSanitizer.cpp b/dom/base/nsTreeSanitizer.cpp index 39c2408b7c..970e4386b9 100644 --- a/dom/base/nsTreeSanitizer.cpp +++ b/dom/base/nsTreeSanitizer.cpp @@ -1185,7 +1185,8 @@ nsTreeSanitizer::SanitizeAttributes(mozilla::dom::Element* aElement, continue; } if (IsURL(aURLs, attrLocal)) { - if (SanitizeURL(aElement, attrNs, attrLocal)) { + bool fragmentOnly = aElement->IsSVGElement(nsGkAtoms::use); + if (SanitizeURL(aElement, attrNs, attrLocal, fragmentOnly)) { // in case the attribute removal shuffled the attribute order, start // the loop again. --ac; @@ -1239,7 +1240,8 @@ nsTreeSanitizer::SanitizeAttributes(mozilla::dom::Element* aElement, // else not allowed } else if (aAllowXLink && kNameSpaceID_XLink == attrNs) { if (nsGkAtoms::href == attrLocal) { - if (SanitizeURL(aElement, attrNs, attrLocal)) { + bool fragmentOnly = aElement->IsSVGElement(nsGkAtoms::use); + if (SanitizeURL(aElement, attrNs, attrLocal, fragmentOnly)) { // in case the attribute removal shuffled the attribute order, start // the loop again. --ac; @@ -1273,7 +1275,8 @@ nsTreeSanitizer::SanitizeAttributes(mozilla::dom::Element* aElement, bool nsTreeSanitizer::SanitizeURL(mozilla::dom::Element* aElement, int32_t aNamespace, - nsIAtom* aLocalName) + nsIAtom* aLocalName, + bool aFragmentOnly) { nsAutoString value; aElement->GetAttr(aNamespace, aLocalName, value); @@ -1282,6 +1285,15 @@ nsTreeSanitizer::SanitizeURL(mozilla::dom::Element* aElement, static const char* kWhitespace = "\n\r\t\b"; const nsAString& v = nsContentUtils::TrimCharsInSet(kWhitespace, value); + // Fragment-only url cannot be harmful. + if (!v.IsEmpty() && v.First() == u'#') { + return false; + } + // if we allow only same-document fragment URLs, stop and remove here + if (aFragmentOnly) { + aElement->UnsetAttr(aNamespace, aLocalName, false); + return true; + } nsIScriptSecurityManager* secMan = nsContentUtils::GetSecurityManager(); uint32_t flags = nsIScriptSecurityManager::DISALLOW_INHERIT_PRINCIPAL; diff --git a/dom/base/nsTreeSanitizer.h b/dom/base/nsTreeSanitizer.h index b4a333f619..fe4917150f 100644 --- a/dom/base/nsTreeSanitizer.h +++ b/dom/base/nsTreeSanitizer.h @@ -143,11 +143,13 @@ class MOZ_STACK_CLASS nsTreeSanitizer { * @param aElement the element whose attribute to possibly modify * @param aNamespace the namespace of the URL attribute * @param aLocalName the local name of the URL attribute + * @param aFragmentOnly allows same-document references only * @return true if the attribute was removed and false otherwise */ bool SanitizeURL(mozilla::dom::Element* aElement, int32_t aNamespace, - nsIAtom* aLocalName); + nsIAtom* aLocalName, + bool aFragmentOnly = false); /** * Checks a style rule for the presence of the 'binding' CSS property and From 37d0ffa17274eb5077f8e85c853383c30a38aa53 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Sun, 3 Jul 2022 15:38:40 +0000 Subject: [PATCH 6/6] [XPCOM] Crash safely when TArray replacements are OOB. In the unlikely event of TArray element replacement calls are OOB, crash safely with a debug breakpoint instead of corrupting memory. --- xpcom/glue/nsTArray.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/xpcom/glue/nsTArray.h b/xpcom/glue/nsTArray.h index 22d6ab7b39..03913a3765 100644 --- a/xpcom/glue/nsTArray.h +++ b/xpcom/glue/nsTArray.h @@ -2018,6 +2018,12 @@ auto nsTArray_Impl::ReplaceElementsAt(index_type aStart, size_type aCount, const Item* aArray, size_type aArrayLen) -> elem_type* { + if (MOZ_UNLIKELY(aStart > Length())) { + InvalidArrayIndex_CRASH(aStart, Length()); + } + if (MOZ_UNLIKELY(aCount > Length() - aStart)) { + InvalidArrayIndex_CRASH(aStart + aCount, Length()); + } // Adjust memory allocation up-front to catch errors. if (!ActualAlloc::Successful(this->template EnsureCapacity( Length() + aArrayLen - aCount, sizeof(elem_type)))) {