Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 0748de3348707dfdfb3bb4c2c295979833a654ab
https://github.com/WebKit/WebKit/commit/0748de3348707dfdfb3bb4c2c295979833a654ab
Author: Youenn Fablet <[email protected]>
Date: 2026-08-26 (Wed, 26 Aug 2026)
Changed paths:
M Source/WebCore/html/FileInputType.cpp
M Source/WebCore/page/Chrome.cpp
M Source/WebCore/page/Chrome.h
M Source/WebCore/page/ChromeClient.cpp
M Source/WebCore/page/ChromeClient.h
M Source/WebCore/platform/graphics/ImageUtilities.h
M Source/WebCore/platform/graphics/cg/ImageUtilitiesCG.cpp
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/UIProcess/WebPageProxy.h
M Source/WebKit/UIProcess/WebPageProxy.messages.in
M Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp
M Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.h
Log Message:
-----------
Incomplete replacementPath validation in
NetworkConnectionToWebProcess::registerInternalFileBlobURL
rdar://176890926
Reviewed by Chris Dumez.
We cannot easily validate that a sandbox extension is valid or related to a
specific file.
We thus stop validating the sandbox extension and only rely on the allowed file
path check.
This ensures that a web process can only create blobs from a file that the
UIProcess deemed appropriate (via direct UIProcess/NetworkProcess IPC).
Two code paths need to be updated to not break existing functionality:
1. Image transcoding for files dropped on <input type=file> was previoulsy done
in WebProcess.
We move this to UIProcess via ChromeClient::transcodeChosenFiles, with a
default implementation
that preserves the previous in-WebProcess behavior by dispatching to the
shared transcoding queue.
WebChromeClient is implementing out-of-process transcoding by asking
WebPageProxy via IPC to do the work.
WebPageProxy does this and makes sure to notify network process that the
transcoded files can be accessed.
2. WebPageProxy::didChooseFilesForOpenPanelWithImageTranscoding needs to make
sure to allow access of these files
from the network process. Once this is done, it notifies the WebProcess of
the result as before.
We do a small refactoring by factoring the queue dispatch + main-thread hop
into transcodeImagesInBackgroundQueue.
Call sites like the default ChromeClient implementation and
WebPageProxy::transcodeChosenFiles no longer manage cross-thread copies.
Manually tested.
* Source/WebCore/html/FileInputType.cpp:
(WebCore::FileInputType::receiveDroppedFilesWithImageTranscoding):
* Source/WebCore/page/Chrome.cpp:
(WebCore::Chrome::transcodeChosenFiles):
* Source/WebCore/page/Chrome.h:
* Source/WebCore/page/ChromeClient.cpp:
(WebCore::ChromeClient::transcodeChosenFiles):
* Source/WebCore/page/ChromeClient.h:
* Source/WebCore/platform/graphics/ImageUtilities.h:
* Source/WebCore/platform/graphics/cg/ImageUtilitiesCG.cpp:
(WebCore::transcodeImages):
(WebCore::transcodeImagesInBackgroundQueue):
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::registerInternalFileBlobURL):
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::didChooseFilesForOpenPanelWithImageTranscoding):
(WebKit::WebPageProxy::transcodeChosenFiles):
* Source/WebKit/UIProcess/WebPageProxy.h:
* Source/WebKit/UIProcess/WebPageProxy.messages.in:
* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp:
(WebKit::WebChromeClient::transcodeChosenFiles):
* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.h:
Originally-landed-as: [email protected] (1c3f0755c46a).
rdar://185369553
Canonical link: https://commits.webkit.org/319864@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
