Closed Bug 1655994 Opened 4 years ago Closed 4 years ago

Process names include eTLD+1 when pref isn't enabled

Categories

(Core :: DOM: Navigation, defect)

defect

Tracking

()

RESOLVED FIXED
81 Branch
Tracking Status
firefox-esr68 --- unaffected
firefox-esr78 --- unaffected
firefox78 --- unaffected
firefox79 --- unaffected
firefox80 --- fixed
firefox81 --- fixed

People

(Reporter: jesup, Assigned: jesup)

References

(Regression)

Details

(Keywords: csectype-disclosure, regression, sec-moderate)

Attachments

(1 file)

The eTLD+1 is used for process names even when the pref isn't set; this can leak origin names

Group: core-security → dom-core-security
Group: dom-core-security → core-security-release
Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → 81 Branch

Comment on attachment 9166842 [details]
Bug 1655994: Clean up process name setting r=nika

Beta/Release Uplift Approval Request

  • User impact if declined: Disclosure of domains currently in use via task managers (on linux and mac)
  • Is this code covered by automated tests?: No
  • Has the fix been verified in Nightly?: Yes
  • Needs manual test from QE?: No
  • If yes, steps to reproduce:
  • List of other uplifts needed: None
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): Trivial change
  • String changes made/needed: None
Attachment #9166842 - Flags: approval-mozilla-beta?

Comment on attachment 9166842 [details]
Bug 1655994: Clean up process name setting r=nika

approved for 80.0b2

Attachment #9166842 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
Flags: qe-verify-
Has Regression Range: --- → yes
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: