From aadb6beb079df79934d10d941b094c012dc14b26 Mon Sep 17 00:00:00 2001
From: Moonchild <moonchild@palemoon.org>
Date: Sun, 24 May 2026 10:51:21 +0200
Subject: [PATCH] [libjar] Check Jar entry names for nulls.

---
 modules/libjar/nsJARChannel.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/modules/libjar/nsJARChannel.cpp b/modules/libjar/nsJARChannel.cpp
index 195cd4b716..ea90db4873 100644
--- a/modules/libjar/nsJARChannel.cpp
+++ b/modules/libjar/nsJARChannel.cpp
@@ -344,6 +344,11 @@ nsJARChannel::LookupFile(bool aAllowAsync)
     // have e.g. spaces in their filenames.
     NS_UnescapeURL(mJarEntry);
 
+    if (mJarEntry.FindChar('\0') != -1) {
+        // Refuse any entries with NULL in them.
+        return NS_ERROR_MALFORMED_URI;
+    }
+
     // try to get a nsIFile directly from the url, which will often succeed.
     {
         nsCOMPtr<nsIFileURL> fileURL = do_QueryInterface(mJarBaseURI);