Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: 3e7b8c6d77554a6bc6990bc227b60096d9497412
https://github.com/WebKit/WebKit/commit/3e7b8c6d77554a6bc6990bc227b60096d9497412
Author: Sihui Liu <[email protected]>
Date: 2026-08-21 (Fri, 21 Aug 2026)
Changed paths:
M Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp
M Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.h
Log Message:
-----------
Cherry-pick b2b34862739c. https://bugs.webkit.org/show_bug.cgi?id=316594
Enable storage site validation
rdar://172706201
Reviewed by Chris Dumez.
Enable WebsiteDataStore::m_storageSiteValidationEnabled by default so
NetworkStorageManager validates the site on
messages it receives.
Replace MESSAGE_CHECK with STORAGE_MESSAGE_CHECK for site validation
checks. STORAGE_MESSAGE_CHECK generates a simulated
crash and returns an error
instead
of
terminating
the
sender
process. This blocks storage access from compromised
processes while allowing us to monitor for false positives before upgrading
to MESSAGE_CHECK.
* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp:
(WebKit::NetworkStorageManager::persisted):
(WebKit::NetworkStorageManager::persist):
(WebKit::NetworkStorageManager::estimate):
(WebKit::NetworkStorageManager::fileSystemGetDirectory):
(WebKit::NetworkStorageManager::connectToStorageArea):
(WebKit::NetworkStorageManager::cancelConnectToStorageArea):
(WebKit::NetworkStorageManager::disconnectFromStorageArea):
(WebKit::NetworkStorageManager::setItem):
(WebKit::NetworkStorageManager::removeItem):
(WebKit::NetworkStorageManager::clear):
(WebKit::NetworkStorageManager::openDBRequestCancelled):
(WebKit::NetworkStorageManager::deleteDatabase):
(WebKit::NetworkStorageManager::databaseConnectionClosed):
(WebKit::NetworkStorageManager::getAllDatabaseNamesAndVersions):
(WebKit::NetworkStorageManager::cacheStorageOpenCache):
(WebKit::NetworkStorageManager::cacheStorageRemoveCache):
(WebKit::NetworkStorageManager::cacheStorageAllCaches):
(WebKit::NetworkStorageManager::cacheStorageReference):
(WebKit::NetworkStorageManager::cacheStorageDereference):
(WebKit::NetworkStorageManager::lockCacheStorage):
(WebKit::NetworkStorageManager::unlockCacheStorage):
(WebKit::NetworkStorageManager::cacheStorageRetrieveRecords):
(WebKit::NetworkStorageManager::cacheStorageRemoveRecords):
(WebKit::NetworkStorageManager::cacheStoragePutRecords):
(WebKit::NetworkStorageManager::cacheStorageClearMemoryRepresentation):
* Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.h:
Identifier: 305413.905@safari-7624-branch
Identifier:
[email protected]
Canonical
link:
https://flagged.apple.com:443/proxy?t2=DB4k8y5bC1&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3Njk1LjEyOUB3ZWJraXRnbGliLzIuNTQ=&emid=00d693a2-578b-4da0-8eb5-31b1b24b25ae&c=11
Commit: 6d6c471913c4564ad2b04f53456beb2ef614879c
https://github.com/WebKit/WebKit/commit/6d6c471913c4564ad2b04f53456beb2ef614879c
Author: Sihui Liu <[email protected]>
Date: 2026-08-21 (Fri, 21 Aug 2026)
Changed paths:
M Source/WebKit/NetworkProcess/storage/FileSystemStorageHandle.cpp
M Source/WebKit/NetworkProcess/storage/FileSystemStorageHandle.h
M Source/WebKit/NetworkProcess/storage/FileSystemStorageManager.cpp
M Source/WebKit/NetworkProcess/storage/FileSystemStorageManager.h
M Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp
M Source/WebKit/NetworkProcess/storage/NetworkStorageManager.h
M Source/WebKit/NetworkProcess/storage/OriginStorageManager.cpp
M
Source/WebKit/NetworkProcess/storage/OriginStorageManager.h
M
Tools/TestWebKitAPI/Tests/WebKit/WKWebView/IPCTestingAPI.mm
Log Message:
-----------
Cherry-pick [email protected] (9945ade1f70a).
https://bugs.webkit.org/show_bug.cgi?id=316594
Validate connection access to FileSystem storage with
FileSystemHandleIdentifier
rdar://176773267
Reviewed by Chris Dumez.
Many FileSystem-related messages sent to NetworkStorageManager only carries
FileSystemHandleIdentifier when asking to
operate on FileSystem storage, and NetworkStorageManager does not check
whether the sender process actually has access
to requested handle. This lets a compromised process forge
FileSystemHandleIdentifier and access data from other
origins. To fix it, this patch stores the origin in
FileSystemStorageManager and adding an origin accessor to
FileSystemStorageHandle, so that NetworkStorageManager can
run
isSiteAllowedForConnection
in
FileSystem-related message
handlers.
API
test:
IPCTestingAPI.FileSystemForgedHandleIdentifierRejected
* Source/WebKit/NetworkProcess/storage/FileSystemStorageHandle.cpp:
(WebKit::FileSystemStorageHandle::origin const):
* Source/WebKit/NetworkProcess/storage/FileSystemStorageHandle.h:
* Source/WebKit/NetworkProcess/storage/FileSystemStorageManager.cpp:
(WebKit::FileSystemStorageManager::create):
(WebKit::FileSystemStorageManager::FileSystemStorageManager):
* Source/WebKit/NetworkProcess/storage/FileSystemStorageManager.h:
* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp:
(WebKit::NetworkStorageManager::fileSystemGetDirectory):
(WebKit::NetworkStorageManager::closeHandle):
(WebKit::NetworkStorageManager::isSameEntry):
(WebKit::NetworkStorageManager::move):
(WebKit::NetworkStorageManager::getFileHandle):
(WebKit::NetworkStorageManager::getDirectoryHandle):
(WebKit::NetworkStorageManager::removeEntry):
(WebKit::NetworkStorageManager::resolve):
(WebKit::NetworkStorageManager::getFile):
(WebKit::NetworkStorageManager::createSyncAccessHandle):
(WebKit::NetworkStorageManager::closeSyncAccessHandle):
(WebKit::NetworkStorageManager::requestNewCapacityForSyncAccessHandle):
(WebKit::NetworkStorageManager::createWritable):
(WebKit::NetworkStorageManager::closeWritable):
(WebKit::NetworkStorageManager::executeCommandForWritable):
(WebKit::NetworkStorageManager::getHandleNames):
(WebKit::NetworkStorageManager::getHandle):
(WebKit::NetworkStorageManager::canConnectionAccessFileSystemHandle const):
* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.h:
* Source/WebKit/NetworkProcess/storage/OriginStorageManager.cpp:
(WebKit::OriginStorageManager::StorageBucket::fileSystemStorageManager):
(WebKit::OriginStorageManager::fileSystemStorageManager):
*
Source/WebKit/NetworkProcess/storage/OriginStorageManager.h:
*
Tools/TestWebKitAPI/Tests/WebKitCocoa/IPCTestingAPI.mm:
(function):
((IPCTestingAPI, FileSystemForgedHandleIdentifierRejected)):
(CGColorInNSSecureCoding)): Deleted.
(NSURLWithBaseURLInNSSecureCoding)): Deleted.
Identifier: [email protected]
Canonical link:
https://flagged.apple.com:443/proxy?t2=DC2v3z2Yo3&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3Njk1LjEzMEB3ZWJraXRnbGliLzIuNTQ=&emid=00d693a2-578b-4da0-8eb5-31b1b24b25ae&c=11
Commit: c9fb501a20562f557d23b027fa892c161d835f5b
https://github.com/WebKit/WebKit/commit/c9fb501a20562f557d23b027fa892c161d835f5b
Author: Sihui Liu <[email protected]>
Date: 2026-08-21 (Fri, 21 Aug 2026)
Changed paths:
M Source/WebKit/NetworkProcess/storage/CacheStorageCache.cpp
M Source/WebKit/NetworkProcess/storage/CacheStorageCache.h
M
Source/WebKit/NetworkProcess/storage/CacheStorageManager.cpp
M Source/WebKit/NetworkProcess/storage/CacheStorageManager.h
M Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp
M
Source/WebKit/NetworkProcess/storage/NetworkStorageManager.h
M
Source/WebKit/NetworkProcess/storage/OriginStorageManager.cpp
Log Message:
-----------
Cherry-pick 319138@main (5d1be2cedef6).
https://bugs.webkit.org/show_bug.cgi?id=316594
Validate connection access to DOMCache with DOMCacheIdentifier
rdar://176470206
Reviewed by Chris Dumez.
Many CacheStorage-related messages sent to NetworkStorageManager only
carries DOMCacheIdentifier when asking to operate
on DOMCache storage, and NetworkStorageManager does not check whether the
sender process actually has access to
requested cache. This lets a compromised process forge DOMCacheIdentifier
and access data from other origins. To fix it,
this patch stores the origin in
CacheStorageManager and adding an origin accessor to CacheStorageCache, so that
NetworkStorageManager can run isSiteAllowedForConnection in
CacheStorage-related message handlers.
*
Source/WebKit/NetworkProcess/storage/CacheStorageCache.cpp:
(WebKit::CacheStorageCache::origin const):
* Source/WebKit/NetworkProcess/storage/CacheStorageCache.h:
* Source/WebKit/NetworkProcess/storage/CacheStorageManager.cpp:
(WebKit::CacheStorageManager::create):
(WebKit::CacheStorageManager::CacheStorageManager):
* Source/WebKit/NetworkProcess/storage/CacheStorageManager.h:
(WebKit::CacheStorageManager::origin const):
* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp:
(WebKit::NetworkStorageManager::cacheStorageRemoveCache):
(WebKit::NetworkStorageManager::cacheStorageReference):
(WebKit::NetworkStorageManager::cacheStorageDereference):
(WebKit::NetworkStorageManager::cacheStorageRetrieveRecords):
(WebKit::NetworkStorageManager::cacheStorageRemoveRecords):
(WebKit::NetworkStorageManager::cacheStoragePutRecords):
* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.h:
*
Source/WebKit/NetworkProcess/storage/OriginStorageManager.cpp:
(WebKit::OriginStorageManager::StorageBucket::cacheStorageManager):
Originally-landed-as: 305413.900@safari-7624-branch (1ab57a04be24).
rdar://184745108
Canonical link: https://commits.webkit.org/319138@main
Canonical link:
https://flagged.apple.com:443/proxy?t2=DX3P0X3Zp0&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3Njk1LjEzMUB3ZWJraXRnbGliLzIuNTQ=&emid=00d693a2-578b-4da0-8eb5-31b1b24b25ae&c=11
Commit: efd87ed594c8db5a9e251e074fb1cf0aaac72673
https://github.com/WebKit/WebKit/commit/efd87ed594c8db5a9e251e074fb1cf0aaac72673
Author: David Kilzer <[email protected]>
Date: 2026-08-21 (Fri, 21 Aug 2026)
Changed paths:
M
Source/WebKit/WebProcess/WebStorage/WebStorageNamespaceProvider.cpp
Log Message:
-----------
Cherry-pick [email protected] (6254fe9499a7).
https://bugs.webkit.org/show_bug.cgi?id=317082
REGRESSION (259876@main): Check
for
end
iterator in WebStorageNamespaceProvider::decrementUseCount()
<https://bugs.webkit.org/show_bug.cgi?id=317082>
<rdar://179209792>
Reviewed by Zak Ridouh.
Guard against a missing
entry
before dereferencing the result of
`HashMap::find()` in `decrementUseCount()`. The function relies on
`ASSERT(iterator != ...end())`, which compiles to nothing in release
builds, then reads `iterator->value` unconditionally. When the
identifier is absent, `find()` returns `end()`, and reading
`end()->value` accesses memory one entry past the table's backing
buffer.
The absent-entry case became reachable in 259876@main, which replaced
the page-group-keyed owning map of providers with a
single weakly-held
provider (`existingStorageNameSpaceProvider()`). The provider is now
destroyed when the last page in a Web Content process goes away and
recreated empty for the next page, so a `WebPage` torn down after that
point
decrements against a provider that never held its identifier.
Return early when the iterator is `end()`, matching the existing guard
in the sibling accessor `sessionStorageNamespace()`. The
`ASSERT(sessionStorageNamespaces.useCount)` is retained so debug builds
still flag a use-count imbalance.
No new tests since this path is reached only during web page teardown
when the session storage namespace entry has already been removed, and
is not directly testable through public API.
* Source/WebKit/WebProcess/WebStorage/WebStorageNamespaceProvider.cpp:
(WebKit::WebStorageNamespaceProvider::decrementUseCount):
Identifier: [email protected]
Canonical link:
https://flagged.apple.com:443/proxy?t2=DB1y2y5FR6&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3Njk1LjEzMkB3ZWJraXRnbGliLzIuNTQ=&emid=00d693a2-578b-4da0-8eb5-31b1b24b25ae&c=11
Commit: 3b7e98422550d43858b512d34946db54bd00271f
https://github.com/WebKit/WebKit/commit/3b7e98422550d43858b512d34946db54bd00271f
Author: Aditya Keerthi <[email protected]>
Date: 2026-08-21 (Fri, 21 Aug
2026)
Changed paths:
A
LayoutTests/fast/forms/datalist/datalist-button-change-input-type-on-click-crash-expected.txt
A
LayoutTests/fast/forms/datalist/datalist-button-change-input-type-on-click-crash.html
M Source/WebCore/html/TextFieldInputType.cpp
M Source/WebCore/html/shadow/DataListButtonElement.cpp
M Source/WebCore/html/shadow/DataListButtonElement.h
Log Message:
-----------
Cherry-pick 1207b71f0518. https://bugs.webkit.org/show_bug.cgi?id=313521
[WebCore] Use-after-free in `DataListButtonElement::defaultEventHandler`
https://bugs.webkit.org/show_bug.cgi?id=313521
rdar://175672489
Reviewed by Ryosuke Niwa.
`DataListButtonElement` stores its owner as a raw `DataListButtonOwner&
m_owner`.
The only `DataListButtonOwner` is
`TextFieldInputType`.
When the type of the
owning input element is changed, `HTMLInputElement::updateType()` calls
`removeShadowSubtree()`. This will null out
`m_dataListDropdownIndicator` but
does not clear the owner member in `DataListButtonElement`. Changing the
type
inside a `click`
listener
results in the `TextFieldInputType` being freed while
event dispatch is in progress. Eventually,
`DataListButtonElement::defaultEventHandler()`
is called, calling `m_owner.dataListButtonElementWasClicked()` after
`m_owner`
was already freed.
Fix storing the owner as a `WeakPtr` and by clearing it out in
`removeShadowSubtree()`. This matches the implementation of
`SpinButtonElement`.
*
LayoutTests/fast/forms/datalist/datalist-button-change-input-type-on-click-crash-expected.txt:
Added.
*
LayoutTests/fast/forms/datalist/datalist-button-change-input-type-on-click-crash.html:
Added.
* Source/WebCore/html/TextFieldInputType.cpp:
(WebCore::TextFieldInputType::removeShadowSubtree):
* Source/WebCore/html/shadow/DataListButtonElement.cpp:
(WebCore::DataListButtonElement::defaultEventHandler):
* Source/WebCore/html/shadow/DataListButtonElement.h:
Identifier: [email protected]
Canonical
link:
https://flagged.apple.com:443/proxy?t2=DS3a7X3ga2&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzA1NDEzLjEwNTJAc2FmYXJpLTc2MjQuNC41LjEwLWJyYW5jaA==&emid=00d693a2-578b-4da0-8eb5-31b1b24b25ae&c=11
Canonical link:
https://flagged.apple.com:443/proxy?t2=dB0i9X2Gn4&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3Njk1LjEzM0B3ZWJraXRnbGliLzIuNTQ=&emid=00d693a2-578b-4da0-8eb5-31b1b24b25ae&c=11
Compare:
https://github.com/WebKit/WebKit/compare/c1ee68118609...3b7e98422550
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
