1912587 - Calling Document.parseHTMLUnsafe() in a browser extension content script crashes the tab

Status: VERIFIED FIXED

(WebExtensions :: General, defect, P2)

Description

[Jakub Czerny]

Attachment: extention.zip

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0

Steps to reproduce:

Use Document.parseHTMLUnsafe() in a content script of a Firefox browser extension.

Steps to reproduce:

1. load the extension.zip browser extension attached as a temporary extension (about:debugging#/runtime/this-firefox)
2. open any regular page, e.g. https://developer.mozilla.org
3. select "Crush tab" from the context menu

Actual results:

"Gah. Your tab just crashed." crushed tab form is shown.

Console dump of the Browser Toolbox is attached.

Expected results:

The tab shouldn't crush

Comment 1

[Jakub Czerny]

Attachment: console-export.txt

Browser toolbox console dump

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'WebExtensions::Untriaged' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 3

[Alex Cornestean]

Hello,

I reproduced the issue on the latest Nightly (131.0a1/20240811212519) and Beta (130.0b3/20240809091641) under Windows 10 x64 and Ubuntu 22.04 LTS. The issue does NOT reproduce on the latest Release (129.0/20240801122119).

Since Release 129 does not seem to be affected by the issue, I performed a mozregression but did not find a regressor. All the tested builds (from 128 to 130) were bad.

Comment 4

[Andrea Marchesini [:baku]]

Attachment: Bug 1912587 - Document.parseHTMLUnsafe() should use source document's principal when called by a content script

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:zombie, could you have a look please?

For more information, please visit BugBot documentation.

Comment 6

[Luca Greco [:rpl] [:luca] [:lgreco]]

I'm linking the eslint no-unsanitized pugin PR to also have linting warnings on usage of the Document.parseHTMLUnsafe static method:

• https://github.com/mozilla/eslint-plugin-no-unsanitized/pull/244

Comment 7

[Adam Vandolder [:avandolder]]

Hi, there has recently been a spike in crashes related to this issue (see bug 1937488). The patch on this bug appears to be the correct solution; what all would need to be done in order to get it landed? I'm willing to take it over if needed.

Comment 8

[Rob Wu [:robwu]]

I have updated the patch, it is ready for review. Thanks for flagging the other bug.

I'm going to mark this as a blocker to bug 1937488 instead of "See also" because I expect the fix here to resolve the crashes in bug 1937488.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/924fafc1962f
https://hg.mozilla.org/integration/autoland/rev/956b68964441
Document.parseHTMLUnsafe() should use source document's principal when called by a content script r=rpl,smaug

Comment 10

[pstanciu]

https://hg.mozilla.org/mozilla-central/rev/956b68964441

Comment 11

[Alex Cornestean]

Verified as Fixed. Tested on the latest Nightly (150.0a1/20260305002319) under Windows 11 and Ubuntu 24.10.

Using the extension and STR from Comment 0, the tab no longer crashes.