Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: 68fa8947a81b6a6bcd823ca4fca0282bd1660049
https://github.com/WebKit/WebKit/commit/68fa8947a81b6a6bcd823ca4fca0282bd1660049
Author: Sabith Saheb <[email protected]>
Date: 2026-08-20 (Thu, 20 Aug 2026)
Changed paths:
M Source/WebCore/platform/graphics/opentype/OpenTypeVerticalData.cpp
Log Message:
-----------
Cherry-pick 319036@main (2196077a54c4). <bug>
Out-of-bounds read in OpenType vertical GSUB coverage range fill
https://bugs.webkit.org/show_bug.cgi?id=
Reviewed by Michael Catanzaro.
OpenTypeVerticalData loads vertical glyph substitutions from a
downloaded font's GSUB table, which is attacker controlled.
LookupTable::getSubstitutions() fills the substitution map one Coverage
Format 2 range at a time. from and fromEnd were uint16_t with fromEnd
set to end + 1, so a range whose end is 0xffff wraps fromEnd to 0. The
guard indexTo + (fromEnd - from) > countTo then underflows on the
truncated value and passes, and the inner loop walks from start through
0xffff before from wraps back to 0, reading
singleSubstitution2->substitute[indexTo] far past its validated
glyphCount entries. substitute is a raw pointer into the GSUB buffer, so
this is an unchecked heap read past the table. A reversed range with
start greater than end underflows the same guard.
Widen from and fromEnd to unsigned so end + 1 stays exact, and reject
fromEnd <= from to drop reversed and empty ranges before the copy. Valid
ranges map the same glyphs as before.
* Source/WebCore/platform/graphics/opentype/OpenTypeVerticalData.cpp:
(WebCore::OpenType::LookupTable::getSubstitutions):
Canonical link: https://commits.webkit.org/319036@main
Canonical link: https://commits.webkit.org/317695.112@webkitglib/2.54
Commit: 05ce0ecaa57fbcaf58a79dcb241d64bca584d387
https://github.com/WebKit/WebKit/commit/05ce0ecaa57fbcaf58a79dcb241d64bca584d387
Author: Patrick Griffis <[email protected]>
Date: 2026-08-20 (Thu, 20 Aug 2026)
Changed paths:
M Source/WebKit/UIProcess/API/glib/WebKitWebExtension.cpp
M Source/WebKit/UIProcess/API/wpe/WebKitWebViewWPE.cpp
M Source/WebKit/WPEPlatform/docs/overview.md
Log Message:
-----------
Cherry-pick 318988@main (bf034981129c).
https://bugs.webkit.org/show_bug.cgi?id=321516
[GLib] Fix documentation warnings
https://bugs.webkit.org/show_bug.cgi?id=321516
Reviewed by Adrian Perez de Castro.
This fixes some simple warnings.
* Source/WebKit/UIProcess/API/glib/WebKitWebExtension.cpp:
This required an upstream fix:
https://gitlab.gnome.org/GNOME/gi-docgen/-/merge_requests/272
* Source/WebKit/UIProcess/API/wpe/WebKitWebViewWPE.cpp:
* Source/WebKit/WPEPlatform/docs/overview.md:
WPEPlatform can't link to WebKit easily, since the dependency is
the reverse of that.
Canonical link: https://commits.webkit.org/318988@main
Canonical link: https://commits.webkit.org/317695.113@webkitglib/2.54
Commit: 7902ef28ba5376e186e22936f4f814046830b417
https://github.com/WebKit/WebKit/commit/7902ef28ba5376e186e22936f4f814046830b417
Author: Mike Gorse <[email protected]>
Date: 2026-08-20 (Thu, 20 Aug 2026)
Changed paths:
A LayoutTests/accessibility/gtk/text-at-offset-user-select-none-expected.txt
A LayoutTests/accessibility/gtk/text-at-offset-user-select-none.html
M Source/WebCore/accessibility/AccessibilityNodeObject.cpp
M Source/WebCore/accessibility/atspi/AccessibilityObjectTextAtspi.cpp
M Source/WebCore/dom/Position.cpp
M Source/WebCore/dom/Position.h
M Source/WebCore/dom/PositionIterator.cpp
M Source/WebCore/dom/PositionIterator.h
M Source/WebCore/editing/Editing.cpp
M Source/WebCore/editing/Editing.h
M Source/WebCore/editing/VisiblePosition.cpp
M Source/WebCore/editing/VisiblePosition.h
M Source/WebCore/editing/VisibleUnits.cpp
M Source/WebCore/rendering/RenderObject.cpp
M Source/WebCore/rendering/RenderObject.h
Log Message:
-----------
Cherry-pick 318359@main (291c3ca40cf8).
https://bugs.webkit.org/show_bug.cgi?id=318228
AX: AT-SPI implementation computes offsets incorrectly when
user-select:none is set
https://bugs.webkit.org/show_bug.cgi?id=318228
Reviewed by Tyler Wilcock.
When GetStringAtOffset is called, the code currently uses VisiblePositions
to calculate text boundaries. The VisiblePosition code skips over text
when user-select:none is set, causing the resulting positions to be
canonicalized to point outside of the node, resulting in offsets that
are out of synch with the text that is being exposed for accessibility
purposes. This later causes a crash when the code tries to convert
the offsets to UTF-8, but the offsets can be larger than the length of
the text.
VisiblePositions now optionally consider positions inside user-select:none
to be valid, and the setting is propagated when new VisiblePositions
are constructed based on existing ones.
*
LayoutTests/accessibility/gtk/text-at-offset-user-select-none-expected.txt:
Added.
* LayoutTests/accessibility/gtk/text-at-offset-user-select-none.html: Added.
* Source/WebCore/accessibility/AccessibilityNodeObject.cpp:
(WebCore::AccessibilityNodeObject::visiblePositionForIndex const):
* Source/WebCore/accessibility/atspi/AccessibilityObjectTextAtspi.cpp:
(WebCore::AccessibilityObjectAtspi::textAttributes const):
* Source/WebCore/dom/Position.cpp:
(WebCore::Position::isCandidate const):
* Source/WebCore/dom/Position.h:
* Source/WebCore/dom/PositionIterator.cpp:
(WebCore::PositionIterator::isCandidate const):
* Source/WebCore/dom/PositionIterator.h:
* Source/WebCore/editing/Editing.cpp:
(WebCore::nextCandidate):
(WebCore::previousCandidate):
(WebCore::visiblePositionForIndex):
* Source/WebCore/editing/Editing.h:
* Source/WebCore/editing/VisiblePosition.cpp:
(WebCore::VisiblePosition::VisiblePosition):
(WebCore::VisiblePosition::honorEditingBoundaryAtOrBefore const):
(WebCore::VisiblePosition::honorEditingBoundaryAtOrAfter const):
(WebCore::canonicalizeCandidate):
(WebCore::VisiblePosition::canonicalPosition):
* Source/WebCore/editing/VisiblePosition.h:
(WebCore::VisiblePosition::allowUserSelectNone const):
* Source/WebCore/editing/VisibleUnits.cpp:
(WebCore::previousLineCandidatePosition):
(WebCore::nextLineCandidatePosition):
(WebCore::previousBoundary):
(WebCore::nextBoundary):
(WebCore::startPositionForLine):
(WebCore::endPositionForLine):
(WebCore::nextLinePosition):
(WebCore::startOfParagraph):
(WebCore::endOfParagraph):
(WebCore::startOfBlock):
(WebCore::endOfBlock):
* Source/WebCore/rendering/RenderObject.cpp:
(WebCore::RenderObject::visiblePositionForPoint):
* Source/WebCore/rendering/RenderObject.h:
Canonical link: https://commits.webkit.org/318359@main
Canonical link: https://commits.webkit.org/317695.114@webkitglib/2.54
Commit: 189f1c29ba3a6be1caea28238835520b738f69a9
https://github.com/WebKit/WebKit/commit/189f1c29ba3a6be1caea28238835520b738f69a9
Author: Yury Semikhatsky <[email protected]>
Date: 2026-08-20 (Thu, 20 Aug 2026)
Changed paths:
M Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.cpp
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestAuthentication.cpp
Log Message:
-----------
Cherry-pick 319424@main (f76f30efcb68).
https://bugs.webkit.org/show_bug.cgi?id=322068
[SOUP] An Authorization header set by the page is replaced by cached
credentials
https://bugs.webkit.org/show_bug.cgi?id=322068
Reviewed by Michael Catanzaro.
nce an authentication challenge has been answered for a host, libsoup's
SoupAuthManager stamps the cached credentials onto every later request in
that
protection space, replacing an Authorization header the page had set itself.
The Fetch standard uses the cached credential only "If httpRequest's header
list does not contain `Authorization`", and the Cocoa and curl ports already
behave that way.
Set SOUP_MESSAGE_DO_NOT_USE_AUTH_CACHE, libsoup's per-message opt-out, when
the
request already carries an Authorization header. A challenge still reaches
the
authentication handler and the retry authenticates as before.
Test: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestAuthentication.cpp
* Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.cpp:
(WebKit::NetworkDataTaskSoup::createRequest):
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestAuthentication.cpp:
(testWebViewAuthenticationPageProvidedAuthorizationHeader):
(serverCallback):
(beforeAll):
Canonical link: https://commits.webkit.org/319424@main
Canonical link: https://commits.webkit.org/317695.115@webkitglib/2.54
Compare: https://github.com/WebKit/WebKit/compare/8777a0bd938d...189f1c29ba3a
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
