forked from mirrors/gecko-dev
The issue in the bug is that we were returning a `DebugEnvironmentProxy` to JS through `findPath`/`UbiNode`, and this object isn't safe to use from arbitrary JS. This patch also changes `findPath` to not define the `node` property with `--fuzzing-safe`, to fix similar issues elsewhere. This `DebugEnvironmentProxy` case is easy to fix, but the engine also uses plain objects and arrays internally in some places and the `JSClass` checks won't be sufficient for that. Differential Revision: https://phabricator.services.mozilla.com/D169912 |
||
|---|---|---|
| .. | ||
| examples | ||
| loader | ||
| public | ||
| src | ||
| xpconnect | ||
| app.mozbuild | ||
| ffi.configure | ||
| moz.build | ||
| moz.configure | ||
| sub.configure | ||