diff --git a/netwerk/streamconv/converters/nsMultiMixedConv.cpp b/netwerk/streamconv/converters/nsMultiMixedConv.cpp index 4ebd61d9c2..44a0dfd705 100644 --- a/netwerk/streamconv/converters/nsMultiMixedConv.cpp +++ b/netwerk/streamconv/converters/nsMultiMixedConv.cpp @@ -1018,11 +1018,14 @@ nsMultiMixedConv::ParseHeaders(nsIChannel *aChannel, char *&aPtr, } else if (headerStr.LowerCaseEqualsLiteral("content-disposition")) { mContentDisposition = headerVal; } else if (headerStr.LowerCaseEqualsLiteral("set-cookie")) { + // Do not allow cookies to be set from multipart/mixed content parts + // as a mitigation to CVE-2024-1551 + /* nsCOMPtr httpInternal = do_QueryInterface(aChannel); if (httpInternal) { httpInternal->SetCookie(headerVal.get()); - } + }*/ } else if (headerStr.LowerCaseEqualsLiteral("content-range") || headerStr.LowerCaseEqualsLiteral("range") ) { // something like: Content-range: bytes 7000-7999/8000