From 7d6032bb76742352eba459fa2616f91f8c59b51c Mon Sep 17 00:00:00 2001 From: Sebastian Streich Date: Tue, 14 Jul 2020 11:16:24 +0000 Subject: [PATCH] Bug 1450853 - Use Generic Error for 3rdparty MediaElement r=ckerschb,smaug *** Add test Differential Revision: https://phabricator.services.mozilla.com/D80080 --- dom/html/HTMLMediaElement.cpp | 15 ++++- dom/security/test/general/mochitest.ini | 1 + .../test/general/test_bug1450853.html | 58 +++++++++++++++++++ 3 files changed, 73 insertions(+), 1 deletion(-) create mode 100644 dom/security/test/general/test_bug1450853.html diff --git a/dom/html/HTMLMediaElement.cpp b/dom/html/HTMLMediaElement.cpp index 4ff63f47c815..3a1e0a55acc7 100644 --- a/dom/html/HTMLMediaElement.cpp +++ b/dom/html/HTMLMediaElement.cpp @@ -2351,7 +2351,20 @@ void HTMLMediaElement::NoSupportedMediaSourceError( if (mDecoder) { ShutdownDecoder(); } - mErrorSink->SetError(MEDIA_ERR_SRC_NOT_SUPPORTED, aErrorDetails); + + bool isThirdPartyLoad = false; + nsresult rv = mSrcAttrTriggeringPrincipal->IsThirdPartyURI(mLoadingSrc, + &isThirdPartyLoad); + if (NS_SUCCEEDED(rv) && isThirdPartyLoad) { + // aErrorDetails can include sensitive details like MimeType or HTTP Status + // Code. In case we're loading a 3rd party resource we should not leak this + // and pass a Generic Error Message + mErrorSink->SetError(MEDIA_ERR_SRC_NOT_SUPPORTED, + "Failed to open media"_ns); + } else { + mErrorSink->SetError(MEDIA_ERR_SRC_NOT_SUPPORTED, aErrorDetails); + } + RemoveMediaTracks(); ChangeDelayLoadStatus(false); UpdateAudioChannelPlayingState(); diff --git a/dom/security/test/general/mochitest.ini b/dom/security/test/general/mochitest.ini index ecd25146274c..b6ebeae1484e 100644 --- a/dom/security/test/general/mochitest.ini +++ b/dom/security/test/general/mochitest.ini @@ -63,3 +63,4 @@ support-files = file_xfo_error_page.sjs [test_sec_fetch_websocket.html] skip-if = toolkit == 'android' # no websocket support Bug 982828 support-files = file_sec_fetch_websocket_wsh.py +[test_bug1450853.html] \ No newline at end of file diff --git a/dom/security/test/general/test_bug1450853.html b/dom/security/test/general/test_bug1450853.html new file mode 100644 index 000000000000..ffbc654d8fca --- /dev/null +++ b/dom/security/test/general/test_bug1450853.html @@ -0,0 +1,58 @@ + + + + + +Test for Cross-origin resouce status leak via MediaError + + + + + + + + + + + Mozilla Bug 1450853 + + +