Closed Bug 1605978 Opened 6 years ago Closed 6 years ago

The setCharPref method does not check the value and causes the limit to be exceeded

Categories

(Firefox :: Untriaged, defect)

Product:
Firefox
Component:
Untriaged
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1605982

People

(Reporter: dezhuangkong, Unassigned)

Details

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Steps to reproduce:

payload：
var prefs = Components.classes["@mozilla.org/preferences-service;1"]
.getService(Components.interfaces.nsIPrefService);
prefs.setCharPref('general.useragent.override','sectest\nNewHeader: test');

Explanation：
Since no special characters are checked, here I use “\n” to add a new http request header，

Actual results:

After executing the payload code, send requests and use Burpsuit proxy, you can see that a new request header was successfully inserted

Expected results:

Check special characters

Status: UNCONFIRMED → RESOLVED
Closed: 6 years ago
Resolution: --- → DUPLICATE
Group: firefox-core-security
You need to log in before you can comment on or make changes to this bug.