CINXE.COM

<!doctype html> <html class="writer-html5" lang="en" data-content_root="../../"> <head> <base href="https://firefox-source-docs.mozilla.org/bug-mgmt/processes/fixing-security-bugs.html"> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Fixing Security Bugs — Firefox Source Docs documentation</title> <link rel="stylesheet" type="text/css" href="../../_static/pygments.css?v=fa44fd50"> <link rel="stylesheet" type="text/css" href="../../_static/css/theme.css?v=19f00094"> <link rel="stylesheet" type="text/css" href="../../_static/graphviz.css?v=fd3f3429"> <link rel="stylesheet" type="text/css" href="../../_static/copybutton.css?v=76b2166b"> <link rel="stylesheet" type="text/css" href="../../_static/custom_theme.css?v=a7d3e023"> <link rel="stylesheet" type="text/css" href="../../_static/design-style.1e8bd061cd6da7fc9cf755528e8ffc24.min.css?v=0a3b3ea7"> <link rel="shortcut icon" href="../../_static/firefox.ico"> <script src="../../_static/jquery.js?v=5d32c60e"></script> <script src="../../_static/_sphinx_javascript_frameworks_compat.js?v=2cd50e6c"></script> <script src="../../_static/documentation_options.js?v=5929fcd5"></script> <script src="../../_static/doctools.js?v=9a2dae69"></script> <script src="../../_static/sphinx_highlight.js?v=dc90522c"></script> <script src="../../_static/clipboard.min.js?v=a7894cd8"></script> <script src="../../_static/copybutton.js?v=30646c52"></script> <script src="../../_static/design-tabs.js?v=36754332"></script> <script src="../../_static/js/theme.js"></script> <link rel="index" title="Index" href="../../genindex.html"> <link rel="search" title="Search" href="../../search.html"> <link rel="next" title="GitHub Metadata Recommendations" href="labels.html"> <link rel="prev" title="User documentation requests" href="doc-requests.html"> <meta http-equiv="X-Translated-By" content="Google"> <meta http-equiv="X-Translated-To" content="iw"> <script type="text/javascript" src="https://www.gstatic.com/_/translate_http/_/js/k=translate_http.tr.en_GB.1hbgkFx4Qn8.O/am=DgY/d=1/rs=AN8SPfqlmAPxwfG457BPbRXwNq39oSMGHg/m=corsproxy" data-sourceurl="https://firefox-source-docs.mozilla.org/bug-mgmt/processes/fixing-security-bugs.html"></script> <link href="https://fonts.googleapis.com/css2?family=Material+Symbols+Outlined:opsz,wght,FILL,GRAD@20..48,100..700,0..1,-50..200" rel="stylesheet"> <script type="text/javascript" src="https://www.gstatic.com/_/translate_http/_/js/k=translate_http.tr.en_GB.1hbgkFx4Qn8.O/am=DgY/d=1/exm=corsproxy/ed=1/rs=AN8SPfqlmAPxwfG457BPbRXwNq39oSMGHg/m=phishing_protection" data-phishing-protection-enabled="false" data-forms-warning-enabled="true" data-source-url="https://firefox-source-docs.mozilla.org/bug-mgmt/processes/fixing-security-bugs.html"></script> <meta name="robots" content="none"> </head> <body class="wy-body-for-nav"> <script type="text/javascript" src="https://www.gstatic.com/_/translate_http/_/js/k=translate_http.tr.en_GB.1hbgkFx4Qn8.O/am=DgY/d=1/exm=corsproxy,phishing_protection/ed=1/rs=AN8SPfqlmAPxwfG457BPbRXwNq39oSMGHg/m=navigationui" data-environment="prod" data-proxy-url="https://firefox--source--docs-mozilla-org.translate.goog" data-proxy-full-url="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/fixing-security-bugs.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB" data-source-url="https://firefox-source-docs.mozilla.org/bug-mgmt/processes/fixing-security-bugs.html" data-source-language="pl" data-target-language="iw" data-display-language="en-GB" data-detected-source-language="" data-is-source-untranslated="false" data-source-untranslated-url="https://translate.google.com/website?sl=pl&tl=iw&hl=en-GB&u=https://firefox-source-docs.mozilla.org/bug-mgmt/processes/fixing-security-bugs.html&anno=2" data-client="tr"></script> <div class="wy-grid-for-nav"> <nav data-toggle="wy-nav-shift" class="wy-nav-side"> <div class="wy-side-scroll"> <div class="wy-side-nav-search"><a href="https://firefox--source--docs-mozilla-org.translate.goog/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB" class="icon icon-home"> Firefox Source Docs <img src="../../_static/firefox-wordmark.svg" class="logo" alt="Logo"> </a> <div> <h3>Quick search</h3> <script> (function () { var cx = "dd12886298f75dbef"; var gcse = document.createElement("script"); gcse.async = true; gcse.src = "https://cse.google.com/cse.js?cx=" + cx; var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(gcse, s); })(); </script><gcse:search></gcse:search> </div> </div> <div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu"> <p class="caption" role="heading"><span class="caption-text">Overview</span></p> <ul> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/glossary/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">A Glossary of Common Terms</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/overview/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">A Quick Guide to Mozilla Applications</a></li> </ul> <p class="caption" role="heading"><span class="caption-text">Getting Started</span></p> <ul> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/setup/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Getting Set Up To Work On The Firefox Codebase</a></li> </ul> <p class="caption" role="heading"><span class="caption-text">Working On Firefox</span></p> <ul class="current"> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/contributing/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Working on Firefox</a></li> <li class="toctree-l1 current"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Bug Handling</a> <ul class="current"> <li class="toctree-l2"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#guides">Guides</a></li> <li class="toctree-l2"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#policies">Policies</a></li> <li class="toctree-l2 current"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#processes">Processes</a> <ul class="current"> <li class="toctree-l3"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/accessibility-review.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Accessibility Review</a></li> <li class="toctree-l3"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/doc-requests.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">User documentation requests</a></li> <li class="toctree-l3 current"><a class="current reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/fixing-security-bugs.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#">Fixing Security Bugs</a> <ul> <li class="toctree-l4"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/fixing-security-bugs.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#keeping-private-information-private">Keeping private information private</a></li> <li class="toctree-l4"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/fixing-security-bugs.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#during-development">During Development</a></li> <li class="toctree-l4"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/fixing-security-bugs.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#essentials">Essentials</a></li> <li class="toctree-l4"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/fixing-security-bugs.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#documentation-contacts">Documentation & Contacts</a></li> </ul></li> <li class="toctree-l3"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/labels.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">GitHub Metadata Recommendations</a></li> <li class="toctree-l3"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/regressions.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">How to Mark Regressions</a></li> <li class="toctree-l3"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/security-approval.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Security Bug Approval Process</a></li> <li class="toctree-l3"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/shared-bug-queues.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Shared Bug Queues</a></li> </ul></li> <li class="toctree-l2"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#related-documentation">Related documentation</a></li> </ul></li> </ul> <p class="caption" role="heading"><span class="caption-text">Firefox User Guide</span></p> <ul> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/devtools-user/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Firefox DevTools User Docs</a></li> </ul> <p class="caption" role="heading"><span class="caption-text">Source Code Documentation</span></p> <ul> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/mots/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Governance</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/browser/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Firefox Front-end</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/dom/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">DOM</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/editor/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Editor</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/layout/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Style system (CSS) & Layout</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/gfx/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Graphics</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/ipc/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Processes, Threads and IPC</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/devtools/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Firefox DevTools Contributor Docs</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/toolkit/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Toolkit</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/js/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">SpiderMonkey</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/mobile/android/geckoview/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">GeckoView</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/mobile/android/fenix/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Fenix</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/mobile/android/focus-android/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Focus for Android</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/dom/bindings/webidl/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">WebIDL</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/modules/libpref/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">libpref</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/networking/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Networking</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/remote/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Remote Protocols</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/services/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Services</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/uriloader/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">File Handling</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/widget/cocoa/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Firefox on macOS</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/widget/windows/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Firefox on Windows</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/toolkit/components/ml/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Firefox AI Platform</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/accessible/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Accessibility</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/code-quality/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Code quality</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/writing-rust-code/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Writing Rust Code</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/rust-components/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Rust Components</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/tools/profiler/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Gecko Profiler</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/performance/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Performance</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/storage/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Database bindings (SQLite, KV, …)</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/xpcom/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">XPCOM</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/nspr/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">NSPR</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/security/nss/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Network Security Services (NSS)</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/content-security/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Web Security Checks in Gecko</a></li> </ul> <p class="caption" role="heading"><span class="caption-text">The Firefox Build System</span></p> <ul> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/mach/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Mach</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/tools/try/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Pushing to Try</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/build/buildsystem/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Build System</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/taskcluster/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Firefox CI and Taskgraph</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/tools/moztreedocs/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Managing Documentation</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/mozbuild/vendor/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Vendoring Third Party Components</a></li> </ul> <p class="caption" role="heading"><span class="caption-text">Testing & Test Infrastructure</span></p> <ul> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/testing/automated-testing/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Automated Testing</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/testing/treeherder-try/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Understanding Treeherder Results</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/testing/sheriffed-intermittents/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Sheriffed intermittent failures</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/testing/tests-for-new-config/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Turning on Firefox tests for a new configuration</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/testing/intermittent/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Avoiding intermittent tests</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/testing/testing-policy/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Testing Policy</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/testing/ci-configs/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Configuration Changes</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/testing/browser-chrome/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Browser chrome mochitests</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/testing/chrome-tests/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Chrome Tests</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/testing/marionette/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Marionette</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/testing/geckodriver/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">geckodriver</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/testing/test-verification/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Test Verification</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/testing/webrender/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">WebRender Tests</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/testing/mochitest-plain/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Mochitest</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/testing/xpcshell/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">XPCShell tests</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/testing/tps/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">TPS</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/web-platform/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">web-platform-tests</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/gtest/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">GTest</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/tools/fuzzing/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Fuzzing</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/tools/sanitizer/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Sanitizer</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/testing/perfdocs/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Performance Testing</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/tools/code-coverage/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Code coverage</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/testing-rust-code/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Testing & Debugging Rust Code</a></li> </ul> <p class="caption" role="heading"><span class="caption-text">Releases & Updates</span></p> <ul> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/update-infrastructure/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Mozilla Update Infrastructure</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/update-infrastructure/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#watershed-updates">Watershed Updates</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/update-infrastructure/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#desupport-updates">Desupport Updates</a></li> </ul> <p class="caption" role="heading"><span class="caption-text">Localization & Internationalization</span></p> <ul> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/intl/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Internationalization</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/l10n/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Localization</a></li> </ul> <p class="caption" role="heading"><span class="caption-text">Firefox and Python</span></p> <ul> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/mozbase/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">mozbase</a></li> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/python/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Using third-party Python packages</a></li> </ul> <p class="caption" role="heading"><span class="caption-text">Metrics Collected in Firefox</span></p> <ul> <li class="toctree-l1"><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/metrics/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Metrics</a></li> </ul> </div> </div> </nav> <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"> <nav class="wy-nav-top" aria-label="Mobile navigation menu"><i data-toggle="wy-nav-top" class="fa fa-bars"></i> <a href="https://firefox--source--docs-mozilla-org.translate.goog/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Firefox Source Docs</a> </nav> <div class="wy-nav-content"> <div class="rst-content"> <div role="navigation" aria-label="Page navigation"> <ul class="wy-breadcrumbs"> <li><a href="https://firefox--source--docs-mozilla-org.translate.goog/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB" class="icon icon-home" aria-label="Home"></a></li> <li class="breadcrumb-item"><a href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/index.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB">Bug Handling</a></li> <li class="breadcrumb-item active">Fixing Security Bugs</li> <li class="wy-breadcrumbs-aside"><a href="https://translate.google.com/website?sl=pl&tl=iw&hl=en-GB&u=https://bugzilla.mozilla.org/enter_bug.cgi?product%3DDeveloper%2BInfrastructure%26component%3DFirefox%2BSource%2BDocs%253A%2BContent%26short_desc%3DDocumentation%2Bissue%2Bon%2Bbug-mgmt/processes/fixing-security-bugs%26comment%3DURL%2B%3D%2Bhttps://firefox-source-docs.mozilla.org/bug-mgmt/processes/fixing-security-bugs.html%26bug_file_loc%3Dhttps://firefox-source-docs.mozilla.org/bug-mgmt/processes/fixing-security-bugs.html" rel="nofollow">Report an issue</a> / <a href="https://firefox--source--docs-mozilla-org.translate.goog/_sources/bug-mgmt/processes/fixing-security-bugs.rst.txt?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB" rel="nofollow"> View page source</a></li> </ul> <hr> </div> <div role="main" class="document" itemscope itemtype="http://schema.org/Article"> <div itemprop="articleBody"> <section id="fixing-security-bugs"> <h1>Fixing Security Bugs<a class="headerlink" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/fixing-security-bugs.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#fixing-security-bugs" title="Link to this heading">¶</a></h1> <p>A bug has been reported as security-sensitive in Bugzilla and received a security rating.</p> <p>If this bug is private - which is most likely for a reported security bug - <strong>the process for patching is slightly different than the usual process for fixing a bug</strong>.</p> <p>Here are security guidelines to follow if you’re involved in reviewing, testing and landing a security patch. See <a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/security-approval.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#security-bug-approval-process"><span class="std std-ref">Security Bug Approval Process</span></a> for more details about how to request sec-approval and land the patch.</p> <section id="keeping-private-information-private"> <h2>Keeping private information private<a class="headerlink" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/fixing-security-bugs.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#keeping-private-information-private" title="Link to this heading">¶</a></h2> <p>A security-sensitive bug in Bugzilla means that all information about the bug except its ID number are hidden. This includes the title, comments, reporter, assignee and CC’d people.</p> <p>A security-sensitive bug usually remains private until a fix is shipped in a new release, <strong>and after a certain amount of time to ensure that a maximum number of users updated their version of Firefox</strong>. Bugs are usually made public after 6 months and a couple of releases.</p> <p>From the moment a security bug has been privately reported to the moment a fix is shipped and the bug is set public, all information about that bug needs to be handled carefully in order to avoid an unmitigated vulnerability becoming known and exploited before we release a fix (0-day).</p> <p>During a normal process, information about the nature of bug can be accessed through:</p> <ul class="simple"> <li><p>Bug comments (Bugzilla, GitHub issue)</p></li> <li><p>Commit message (visible on Bugzilla, tree check-ins and test servers)</p></li> <li><p>Code comments</p></li> <li><p>Test cases</p></li> <li><p>Bug content can potentially be discussed on public IRC/Slack channels and mailing list emails.</p></li> </ul> <p>When patching for a security bug, you’ll need to be mindful about what type of information you share and where.</p> <section id="in-commit-messages"> <h3>In commit messages<a class="headerlink" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/fixing-security-bugs.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#in-commit-messages" title="Link to this heading">¶</a></h3> <p>People are watching code check-ins, so we want to avoid sharing information which would disclose or help finding a vulnerability too easily before we shipped the fix to our users. This includes:</p> <ul class="simple"> <li><p>The <strong>nature of the vulnerability</strong> (overflow, use-after-free, XSS, CSP bypass…)</p></li> <li><p><strong>Ways to trigger and exploit that vulnerability</strong> - In commit messages, code comments and test cases.</p></li> <li><p>The fact that a bug / commit is security-related:</p> <ul> <li><p><strong>Trigger words</strong> in the commit message or code comments such as “security”, “exploitable”, or the nature of a security vulnerability (overflow, use-after-free…)</p></li> <li><p><strong>Security approver’s name</strong> in a commit message.</p></li> </ul></li> <li><p>The Firefox versions and components affected by the vulnerability.</p></li> <li><p>Patches with an obvious fix.</p></li> </ul> </section> <section id="in-bugzilla-and-other-public-channels"> <h3>In Bugzilla and other public channels<a class="headerlink" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/fixing-security-bugs.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#in-bugzilla-and-other-public-channels" title="Link to this heading">¶</a></h3> <p>In addition to commits, you’ll need to be mindful of not disclosing sensitive information about the bug in public places, such as Bugzilla:</p> <ul class="simple"> <li><p>Mention the bugs in comment of the private bug instead.</p></li> <li><p>Do not comment sensitive information in public related bugs.</p></li> <li><p>Also be careful about who you give bug access to: <strong>double check before CC’ing the wrong person or alias</strong>.</p></li> <li><p>As of recently, you may now add public bugs in the “duplicate”, “depends on”, “blocks”, “regression”, “regressed by”, or “see also” section. Bugzilla will only reveal those relationships to people with <code class="docutils literal notranslate"><span class="pre">editbugs</span></code> permission or access to the security bug.</p></li> </ul> <p>On IRC, Slack channels, GitHub issues, mailing lists: If you need to discuss about a security bug, use a private channel (protected with a password or with proper right access management)</p> </section> </section> <section id="during-development"> <h2>During Development<a class="headerlink" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/fixing-security-bugs.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#during-development" title="Link to this heading">¶</a></h2> <section id="testing-security-bugs"> <h3>Testing security bugs<a class="headerlink" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/fixing-security-bugs.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#testing-security-bugs" title="Link to this heading">¶</a></h3> <p>Pushing to Try servers requires Level 1 Commit access but <strong>content viewing is publicly accessible</strong>.</p> <p>As much as possible, <strong>do not push to Try servers</strong>. Testing should be done locally before checkin in order to prevent public disclosing of the bug.</p> <p>Because of the public visibility, pushing to Try has all the same concerns as committing the patch. Please heed the concerns in the <a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/fixing-security-bugs.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#landing-your-patch"><span class="std std-ref">Landing your patch (with or without sec-approval)</span></a> section before thinking about it, and check with the security team for an informal “sec-approval” before doing so.</p> <p><strong>Do not push the bug’s own vulnerability testcase to Try.</strong></p> <p>If you need to push to Try servers, make sure your tests don’t disclose what the vulnerability is about or how to trigger it. Do not mention anywhere it is security related.</p> </section> <section id="obfuscating-a-security-patch"> <h3>Obfuscating a security patch<a class="headerlink" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/fixing-security-bugs.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#obfuscating-a-security-patch" title="Link to this heading">¶</a></h3> <p>If your security patch looks obvious because of the code it contains (e.g. a one-line fix), or if you really need to push to Try servers, <strong>consider integrating your security-related patch to non-security work in the same area</strong>. And/or pretend it is related to something else, like some performance improvement or a correctness fix. <strong>Definitely don’t include the bug number in the commit message.</strong> This will help making the security issue less easily identifiable. (The absolute ban against “Security through Obscurity” is in relation to cryptographic systems. In other situations you still can’t <em>rely</em> on obscurity but it can sometimes buy you a little time. In this context we need to get the fixes into the hands of our users faster than attackers can weaponize and deploy attacks and a little extra time can help.)</p> </section> <section id="requesting-sec-approval"> <h3>Requesting sec-approval<a class="headerlink" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/fixing-security-bugs.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#requesting-sec-approval" title="Link to this heading">¶</a></h3> <p>See <a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/security-approval.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#security-bug-approval-process"><span class="std std-ref">Security Bug Approval Process</span></a> for more details</p> </section> <section id="landing-your-patch-with-or-without-sec-approval"><span id="landing-your-patch"></span> <h3>Landing your patch (with or without sec-approval)<a class="headerlink" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/fixing-security-bugs.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#landing-your-patch-with-or-without-sec-approval" title="Link to this heading">¶</a></h3> <p>Before asking for sec-approval or landing, ensure your patch does not disclose information about the security vulnerability unnecessarily. Specifically:</p> <ol class="arabic"> <li><p>The patch commit message and its contents should not mention security, security bugs, or sec-approvers. Note that you can alter the commit message directly in phabricator, if that’s the only thing you need to do - you don’t need to amend your local commit and re-push it. While comprehensive commit messages are generally encouraged; they should be omitted for security bugs and instead be posted in the bug (which will eventually become public.)</p></li> <li><p>Separate out tests into a separate commit. <strong>Do not land tests when landing the patch. Remember we don’t want to 0-day ourselves!</strong> This includes when pushing to try.</p> <ul> <li><p>Tests should only be checked in later, after an official Firefox release that contains the fix has been live for at least four weeks. For example, if Firefox 53 contains a security issue that affects the world and that issue is fixed in 54, tests for this fix should not be checked in until four weeks after 54 goes live.</p><p>The exception to this is if there is a security issue that doesn’t affect any release branches, only mozilla-central and/or other development branches. Since the security problem was never released to the world, once the bug is fixed in all affected places, tests can be checked in to the various branches.</p></li> <li><p>There are two main techniques for remembering to check in the tests later:</p></li> </ul> <blockquote> <div> <ol class="loweralpha"> <li><p>clone the sec bug into a separate “task” bug <strong>that is also in a security-sensitive group to ensure it’s not publicly visible</strong> called something like “land tests for bug xxxxx” and assign to yourself. It should get a “sec-other” keyword rating.</p><p>Tip: In phabricator, you can change the bug linked to a commit with tests if the tests were already separate, while keeping the previously granted review, meaning you can just land the patch when ready, rather than having your reviewer and you have to remember what this was about a month or two down the line.</p></li> <li><p>Or, set the “in-testsuite” flag to “?”, and later set it to “+” when the tests get checked in.</p></li> </ol> </div> </blockquote></li> </ol> </section> <section id="landing-tests"> <h3>Landing tests<a class="headerlink" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/fixing-security-bugs.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#landing-tests" title="Link to this heading">¶</a></h3> <p>Tests can be landed <strong>once the release containing fixes has been live at least 4 weeks</strong>.</p> <p>The exception is if a security issue has never been shipped in a release build and has been fixed in all development branches.</p> </section> <section id="making-a-security-bug-public"> <h3>Making a security bug public<a class="headerlink" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/fixing-security-bugs.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#making-a-security-bug-public" title="Link to this heading">¶</a></h3> <p>This is the responsibility of the security management team.</p> </section> </section> <section id="essentials"> <h2>Essentials<a class="headerlink" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/fixing-security-bugs.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#essentials" title="Link to this heading">¶</a></h2> <ul class="simple"> <li><p><strong>Do not disclose any information about the vulnerability before a release with a fix has gone live for enough time for users to update their software</strong>.</p> <ul> <li><p>This includes code comments, commit messages, tests, public communication channels.</p></li> </ul></li> <li><p>If any doubt: ‘’’request sec-approval? ‘’’</p></li> <li><p>If any doubt: <strong>needinfo security folks</strong>.</p></li> <li><p><strong>If there’s no rating, assume the worst and treat the bug as sec-critical</strong>.</p></li> </ul> </section> <section id="documentation-contacts"> <h2>Documentation & Contacts<a class="headerlink" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/fixing-security-bugs.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#documentation-contacts" title="Link to this heading">¶</a></h2> <ul class="simple"> <li><p><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/contributing/how_to_submit_a_patch.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#how-to-submit-a-patch"><span class="std std-ref">Normal process for submitting a patch</span></a></p></li> <li><p><a class="reference external" href="https://translate.google.com/website?sl=pl&tl=iw&hl=en-GB&u=https://wiki.mozilla.org/Security/Fileabug">How to file a security bug</a></p></li> <li><p><a class="reference external" href="https://translate.google.com/website?sl=pl&tl=iw&hl=en-GB&u=https://www.mozilla.org/en-US/about/governance/policies/security-group/bugs/">Handling Mozilla security bugs (policy)</a></p></li> <li><p><a class="reference internal" href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/security-approval.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB#security-bug-approval-process"><span class="std std-ref">Security Bug Approval Process</span></a></p></li> <li><p><a class="reference external" href="https://translate.google.com/website?sl=pl&tl=iw&hl=en-GB&u=https://wiki.mozilla.org/Security">Contacting the Security team(s) at Mozilla:</a></p></li> </ul> </section> </section> </div> </div> <footer> <div class="rst-footer-buttons" role="navigation" aria-label="Footer"><a href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/doc-requests.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB" class="btn btn-neutral float-left" title="User documentation requests" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a> <a href="https://firefox--source--docs-mozilla-org.translate.goog/bug-mgmt/processes/labels.html?_x_tr_sl=pl&_x_tr_tl=iw&_x_tr_hl=en-GB" class="btn btn-neutral float-right" title="GitHub Metadata Recommendations" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a> </div> <hr> <div role="contentinfo"> <p></p> </div> Built with <a href="https://translate.google.com/website?sl=pl&tl=iw&hl=en-GB&u=https://www.sphinx-doc.org/">Sphinx</a> using a <a href="https://translate.google.com/website?sl=pl&tl=iw&hl=en-GB&u=https://github.com/readthedocs/sphinx_rtd_theme">theme</a> provided by <a href="https://translate.google.com/website?sl=pl&tl=iw&hl=en-GB&u=https://readthedocs.org">Read the Docs</a>. </footer> </div> </div> </section> </div> <script> jQuery(function () { SphinxRtdTheme.Navigation.enable(true); }); </script> <script>function gtElInit() {var lib = new google.translate.TranslateService();lib.translatePage('pl', 'iw', function () {});}</script> <script src="https://translate.google.com/translate_a/element.js?cb=gtElInit&hl=en-GB&client=wt" type="text/javascript"></script> </body> </html>