Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: 7fca8f00f4662c3ba5c4eaeb375f45db03051b1d
https://github.com/WebKit/WebKit/commit/7fca8f00f4662c3ba5c4eaeb375f45db03051b1d
Author: Brent Fulgham <[email protected]>
Date: 2026-08-20 (Thu, 20 Aug 2026)
Changed paths:
M Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml
Log Message:
-----------
Cherry-pick [email protected] (2f7b2e8b7f9f).
https://bugs.webkit.org/show_bug.cgi?id=311660
Escape key no longer guarantees cancelling fullscreen (with keyboard lock)
(311660)
https://bugs.webkit.org/show_bug.cgi?id=311660
rdar://problem/174251766
Reviewed by Brandon Stewart.
Revert 303093@main since the User Interface information to instruct the
user to hold
the ESC key for 1.5 seconds (or longer) was not completed. This can lead to
confusion
and the possibility of spoofing users. We will reland the enablement when
the UI portion
is available.
* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:
Identifier: [email protected]
Canonical link: https://commits.webkit.org/317695.121@webkitglib/2.54
Commit: 6628d310c1a939e9c06699d68de0c7b70d0eaf2e
https://github.com/WebKit/WebKit/commit/6628d310c1a939e9c06699d68de0c7b70d0eaf2e
Author: Brady Eidson <[email protected]>
Date: 2026-08-20 (Thu, 20 Aug 2026)
Changed paths:
M Source/WebCore/loader/DocumentThreadableLoader.cpp
M Source/WebCore/loader/cache/CachedResourceLoader.cpp
M Source/WebCore/loader/cache/CachedResourceLoader.h
M Source/WebCore/platform/LegacySchemeRegistry.cpp
M Source/WebCore/platform/LegacySchemeRegistry.h
M Source/WebKit/NetworkProcess/NetworkProcess.h
M Source/WebKit/WebProcess/WebPage/WebPage.cpp
M Source/WebKit/WebProcess/WebProcess.cpp
M Source/WebKit/WebProcess/WebProcess.h
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/CreateWebArchive.mm
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKURLSchemeHandler-1.mm
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WebsitePolicies.mm
Log Message:
-----------
Cherry-pick 1011610c6800. https://bugs.webkit.org/show_bug.cgi?id=311660
WKWebView does not enforce CORS response header validation for apps' custom
schemes after registerURLSchemeAsCORSEnabled()
rdar://174287004
Reviewed by Chris Dumez.
We mean for app provided custom URL schemes to participate in CORS, but our
implementation had a few holes.
- The network process was never informed of the custom scheme registrations
- Some types of requests that would never hit the network process skipped
needed checks in the web process.
A lot of care was taken to make sure app-provided content still works with
custom schemes as it always had.
This patch makes those changes and tests them.
Tests: Tools/TestWebKitAPI/Tests/WebKitCocoa/CreateWebArchive.mm
Tools/TestWebKitAPI/Tests/WebKitCocoa/WKURLSchemeHandler-1.mm
Tools/TestWebKitAPI/Tests/WebKitCocoa/WebsitePolicies.mm
* Source/WebCore/loader/DocumentThreadableLoader.cpp:
(WebCore::DocumentThreadableLoader::loadRequest):
* Source/WebCore/loader/cache/CachedResourceLoader.cpp:
(WebCore::CachedResourceLoader::canRequest):
(WebCore::CachedResourceLoader::canRequestAfterRedirection const):
(WebCore::CachedResourceLoader::isNoCorsCrossOriginRequestToURLSchemeHandler
const):
* Source/WebCore/loader/cache/CachedResourceLoader.h:
* Source/WebCore/platform/LegacySchemeRegistry.cpp:
(WebCore::LegacySchemeRegistry::isBuiltInWebKitHandledScheme):
(WebCore::LegacySchemeRegistry::registerURLSchemeAsCORSEnabled):
* Source/WebCore/platform/LegacySchemeRegistry.h:
* Source/WebKit/NetworkProcess/NetworkProcess.h:
* Source/WebKit/WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::registerURLSchemeHandler):
* Source/WebKit/WebProcess/WebProcess.cpp:
(WebKit::WebProcess::registerURLSchemeAsCORSEnabled):
* Source/WebKit/WebProcess/WebProcess.h:
* Tools/TestWebKitAPI/Tests/WebKitCocoa/CreateWebArchive.mm:
(TestWebKitAPI::(WebArchive, CreateCustomScheme)):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/WKURLSchemeHandler-1.mm:
(TEST(URLSchemeHandler, BasicWithHTTPS)):
((URLSchemeHandler, DisableCORSCanvas)):
((URLSchemeHandler, SameSchemeSubresourcesAllowed)):
((URLSchemeHandler, CrossOriginNoCorsSubresourcesBlocked)):
((URLSchemeHandler, CrossOriginIframeCORSEnforcementForCustomScheme)):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/WebsitePolicies.mm:
Identifier: 305413.959@safari-7624-branch
Canonical link: https://commits.webkit.org/[email protected]
Canonical link: https://commits.webkit.org/317695.122@webkitglib/2.54
Commit: 09cafca4f96b4ff959a719da992347fc43d250ac
https://github.com/WebKit/WebKit/commit/09cafca4f96b4ff959a719da992347fc43d250ac
Author: Sihui Liu <[email protected]>
Date: 2026-08-20 (Thu, 20 Aug 2026)
Changed paths:
M Source/WebCore/Modules/indexeddb/client/IDBConnectionProxy.cpp
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/IndexedDBPersistence.mm
Log Message:
-----------
Cherry-pick 01cef20028da. https://bugs.webkit.org/show_bug.cgi?id=311660
indexedDB.databases() leaks database names across storage partitions due to
swapped ClientOrigin
rdar://176596477
Reviewed by Chris Dumez.
IDBConnectionProxy::getAllDatabaseNamesAndVersions constructs a
ClientOrigin with topOrigin and clientOrigin swapped.
ClientOrigin expects {topOrigin, clientOrigin}, but the code was passing
{securityOrigin (client), topOrigin} instead.
Test: IndexedDB.IndexedDBGetDatabasesFromCrossOriginIframe
* Source/WebCore/Modules/indexeddb/client/IDBConnectionProxy.cpp:
(WebCore::IDBClient::IDBConnectionProxy::getAllDatabaseNamesAndVersions):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/IndexedDBPersistence.mm:
((IndexedDB, IndexedDBGetDatabasesFromCrossOriginIframe)):
Identifier: 305413.871@safari-7624-branch
Canonical link: https://commits.webkit.org/[email protected]
Canonical link: https://commits.webkit.org/317695.123@webkitglib/2.54
Compare: https://github.com/WebKit/WebKit/compare/e5cd030eeefa...09cafca4f96b
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
