From 4358ff62a563938549c79684044cd423e94737c1 Mon Sep 17 00:00:00 2001
From: Moonchild <moonchild@palemoon.org>
Date: Fri, 28 Aug 2020 06:46:12 +0000
Subject: [media] Only include source error details in debugging scenarios.

Unless a user is debugging media errors, this detail is unnecessary to report
and could include sensitive data which could be abused by third-party
requesters. This aligns it with the standard success/error paradigms in normal
browsing situations.
---
 modules/libpref/init/all.js | 8 ++++++++
 1 file changed, 8 insertions(+)

(limited to 'modules')

diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index 2a50d3704..5eed08f86 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -5440,3 +5440,11 @@ pref("prompts.authentication_dialog_abuse_limit", 0);
 // Whether module scripts (<script type="module">) are enabled for content.
 pref("dom.moduleScripts.enabled", true);
 
+// Report details when a media source error occurs?
+// Enabled by default in debug builds, otherwise should be explicitly enabled
+// by the user to prevent XO leaking of the response status (CVE-2020-15666)
+#ifdef DEBUG
+pref("media.sourceErrorDetails.enabled", true);
+#else
+pref("media.sourceErrorDetails.enabled", false);
+#endif
-- 
cgit v1.2.3