Feodor2
/
Mypal
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[media] Only include source error details in debugging scenarios.

master
Fedor 2020-09-09 17:29:46 +03:00
parent f9bd1dc92c
commit 855a412394
2 changed files with 22 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
dom/html/HTMLMediaElement.cpp
View File

@ -9,6 +9,7 @@
#include "mozilla/dom/HTMLSourceElement.h"
#include "mozilla/dom/ElementInlines.h"
#include "mozilla/dom/Promise.h"
#include "mozilla/Preferences.h"
#include "mozilla/ArrayUtils.h"
#include "mozilla/MathAlgorithms.h"
#include "mozilla/AsyncEventDispatcher.h"
@ -1245,7 +1246,18 @@ void HTMLMediaElement::NoSupportedMediaSourceError(const nsACString& aErrorDetai
if (mDecoder) {
ShutdownDecoder();
}
mErrorSink->SetError(MEDIA_ERR_SRC_NOT_SUPPORTED, aErrorDetails);
// aErrorDetails can include sensitive details like MimeType or HTTP Status
// Code. We should not leak this and pass a Generic Error Message unless the
// user has explicitly enabled error reporting for debugging purposes.
bool reportDetails = Preferences::GetBool("media.sourceErrorDetails.enabled", false);
if (reportDetails) {
mErrorSink->SetError(MEDIA_ERR_SRC_NOT_SUPPORTED, aErrorDetails);
} else {
mErrorSink->SetError(MEDIA_ERR_SRC_NOT_SUPPORTED,
NS_LITERAL_CSTRING("Failed to open media"));
}
ChangeDelayLoadStatus(false);
UpdateAudioChannelPlayingState();
RejectPromises(TakePendingPlayPromises(), NS_ERROR_DOM_MEDIA_NOT_SUPPORTED_ERR);

9
modules/libpref/init/all.js
View File

@ -5432,3 +5432,12 @@ pref("prompts.authentication_dialog_abuse_limit", 0);
// Whether module scripts (<script type="module">) are enabled for content.
pref("dom.moduleScripts.enabled", true);
// Report details when a media source error occurs?
// Enabled by default in debug builds, otherwise should be explicitly enabled
// by the user to prevent XO leaking of the response status (CVE-2020-15666)
#ifdef DEBUG
pref("media.sourceErrorDetails.enabled", true);
#else
pref("media.sourceErrorDetails.enabled", false);
#endif