wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-06 07:48:38 +09:00
Code Issues Projects Releases Packages Wiki Activity

[network] Block set-cookie from multipart/x-mixed-replace

Browse source
This commit is contained in:
Moonchild 2024-02-22 22:08:23 +01:00 • committed by roytam1
commit 9d320dac80
1 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
netwerk/streamconv/converters/nsMultiMixedConv.cpp
View file

@ -1018,11 +1018,14 @@ nsMultiMixedConv::ParseHeaders(nsIChannel *aChannel, char *&aPtr,
} else if (headerStr.LowerCaseEqualsLiteral("content-disposition")) {
mContentDisposition = headerVal;
} else if (headerStr.LowerCaseEqualsLiteral("set-cookie")) {
// Do not allow cookies to be set from multipart/mixed content parts
// as a mitigation to CVE-2024-1551
/*
nsCOMPtr<nsIHttpChannelInternal> httpInternal =
do_QueryInterface(aChannel);
if (httpInternal) {
httpInternal->SetCookie(headerVal.get());
}
}*/
} else if (headerStr.LowerCaseEqualsLiteral("content-range") ||
headerStr.LowerCaseEqualsLiteral("range") ) {
// something like: Content-range: bytes 7000-7999/8000