1970082 - Potential local code execution in “Copy as cURL (Windows)” command

Status: RESOLVED DUPLICATE of bug 1976589

(DevTools :: Netmonitor, defect, P2)

Description

[paul46275]

Attachment: command-prompt.txt

The changes to Copy as cURL in Firefox ESR 115.24 (Bug 1950001 and/or Bug 1962301) seem to be causing the problem they are trying to fix. The same changes are included in Firefox 139.0.
Using Windows 7 and Firefox ESR 115.24:

1. Open a Command Prompt window.
2. Copy %windir%\system32\calc.exe to PageSize.exe somewhere in the path.
3. Browse https://www.trustnet.com/fund/price-performance/t/investment-trusts?norisk=true&PageSize=25
4. Open the Network Monitor.
5. Select page 2 of the web page (at the bottom of the page).
6. Copy as cURL (Windows) on the html item.
7. Paste this into the Command Prompt window and press Return.
8. Observe that two Calculator windows appear.
   I suspect that the same thing would happen using Windows 11 and Firefox 139.0 (but I don't have Windows 11).

Comment 1

[paul46275]

I've written a little program to see what Windows does with various command lines:

// gcc -o report_cmd_line.exe report_cmd_line.c

#include <windows.h>
#include <stdio.h>

int WINAPI WinMain (HINSTANCE hInstance, HINSTANCE hPrevInstance, 
                    LPSTR pCmdLine, int nCmdShow)
{
   printf ("report_cmd_line %s\n", pCmdLine);
}

I didn't understand why quote characters needed to be escaped until I tried to prevent environment variables being expanded:

>report_cmd_line "aaaa%temp%bbbb"
report_cmd_line "aaaaC:\Users\Paul2\AppData\Local\Tempbbbb"

>report_cmd_line "aaaa^%temp^%bbbb"
report_cmd_line "aaaa^%temp^%bbbb"

>report_cmd_line ^"aaaa^%temp^%bbbb^"
report_cmd_line "aaaa%temp%bbbb"

So just escaping the % characters worked, but the escape characters were passed to the report_cmd_line program. Escaping the quote characters solves this problem, but means that more characters need to be escaped. For example:

>report_cmd_line "aaaa&bbbb"
report_cmd_line "aaaa&bbbb"

>report_cmd_line ^"aaaa&bbbb^"
report_cmd_line "aaaa
'bbbb"' is not recognized as an internal or external command,
operable program or batch file.

>report_cmd_line ^"aaaa^&bbbb^"
report_cmd_line "aaaa&bbbb"

So '&' characters need to be escaped if the quote characters are escaped. If bbbb is changed to calc, the error message does not appear but a calculator window opens. This is basically what happened with cURL in my description of this bug. But isn't this what Bug 1962301 was supposed to be fixing?
I've found a few more characters which need to be escaped. Control-Z could be a problem, but I can't get consistent results. Redirecting input or output using '<' or '>' should be prevented:

>report_cmd_line ^"aaaa<bbbb^"
The system cannot find the file specified.

>report_cmd_line ^"aaaa^<bbbb^"
report_cmd_line "aaaa<bbbb"

>report_cmd_line ^"aaaa>bbbb^"

>type bbbb
report_cmd_line "aaaa

>report_cmd_line ^"aaaa^>bbbb^"
report_cmd_line "aaaa>bbbb"

Redirecting output is particularly bad because it could overwrite an arbitrary file.

Comment 2

[paul46275]

Attachment: command-prompt2.txt (with edited cURL command making it work)

It is possible to edit the cURL command to make it work.
Using Windows 7 and Firefox ESR 115.24:

1. Open a Command Prompt window.
2. Browse https://www.trustnet.com/fund/price-performance/t/investment-trusts?norisk=true&PageSize=25
3. Open the Network Monitor.
4. Select page 2 of the web page (at the bottom of the page).
5. Copy Response on the html item and save as response.htm.
6. Copy as cURL (Windows) on the html item.
7. Paste this into an editor, change "&" to "^&", change "\n" to "\r\n" and add --output curl-out.htm.
8. Copy the edited command, paste this into the Command Prompt window and press Return.
9. curl-out.htm should be virtually identical to response.htm

The result is that it works and the files are virtually identical (one line out of the 1096 lines is different). Note that using Windows 11 it may not be necessary to change "\n" to "\r\n" (but I don't have Windows 11).

Comment 3

[Hubert Boma Manilla (:bomsy)]

Thanks for filing. In Bug 1950001 we change the escape pattern to also cover using Copy as cURL (Windows) on linux machines.
Likely missed escaping certain special characters for Windows i.e &, >, <, \n etc

Comment 4

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:Honza, could you have a look please?

For more information, please visit BugBot documentation.

Comment 5

[Jan Honza Odvarko [:Honza] (always need-info? me)]

Severity needed.

Comment 6

[Hubert Boma Manilla (:bomsy)]

Bug 1974973 will be reverting all the work that was done in Bug 1950001 and Bug 1962301. This should fix this issue

Comment 7

[Hubert Boma Manilla (:bomsy)]

This should be fixed by Bug 1976589

Comment 8

[paul46275]

Using Windows 11 and Firefox Nightly 143.0a1 (2025-07-22), I can confirm that this bug has been fixed.