Title: [260962] trunk
Revision
260962
Author
[email protected]
Date
2020-04-30 13:03:26 -0700 (Thu, 30 Apr 2020)

Log Message

Add SPI to change a WKWebView's CORS disabling pattern after initialization
https://bugs.webkit.org/show_bug.cgi?id=211211
<rdar://problem/61837474>

Patch by Alex Christensen <[email protected]> on 2020-04-30
Reviewed by Chris Dumez.

Source/WebCore:

* page/Page.h:
(WebCore::Page::setCORSDisablingPatterns):

Source/WebKit:

* UIProcess/API/Cocoa/WKWebView.mm:
(-[WKWebView _corsDisablingPatterns]):
(-[WKWebView _setCORSDisablingPatterns:]):
* UIProcess/API/Cocoa/WKWebViewPrivate.h:
* UIProcess/WebPageProxy.cpp:
* UIProcess/WebPageProxy.h:
(WebKit::WebPageProxy::corsDisablingPatterns const):
* WebProcess/WebPage/WebPage.cpp:
(WebKit::parseAndAllowAccessToCORSDisablingPatterns):
(WebKit::m_isNavigatingToAppBoundDomain):
(WebKit::WebPage::updateCORSDisablingPatterns):
* WebProcess/WebPage/WebPage.h:
* WebProcess/WebPage/WebPage.messages.in:

Tools:

* TestWebKitAPI/Tests/WebKitCocoa/WKURLSchemeHandler-1.mm:

Modified Paths

Diff

Modified: trunk/Source/WebCore/ChangeLog (260961 => 260962)


--- trunk/Source/WebCore/ChangeLog	2020-04-30 19:50:36 UTC (rev 260961)
+++ trunk/Source/WebCore/ChangeLog	2020-04-30 20:03:26 UTC (rev 260962)
@@ -1,3 +1,14 @@
+2020-04-30  Alex Christensen  <[email protected]>
+
+        Add SPI to change a WKWebView's CORS disabling pattern after initialization
+        https://bugs.webkit.org/show_bug.cgi?id=211211
+        <rdar://problem/61837474>
+
+        Reviewed by Chris Dumez.
+
+        * page/Page.h:
+        (WebCore::Page::setCORSDisablingPatterns):
+
 2020-04-30  Chris Dumez  <[email protected]>
 
         WebCore::systemHasBattery() is unnecessarily expensive on iOS

Modified: trunk/Source/WebCore/page/Page.h (260961 => 260962)


--- trunk/Source/WebCore/page/Page.h	2020-04-30 19:50:36 UTC (rev 260961)
+++ trunk/Source/WebCore/page/Page.h	2020-04-30 20:03:26 UTC (rev 260962)
@@ -521,6 +521,8 @@
     bool hasCustomHTMLTokenizerTimeDelay() const;
     double customHTMLTokenizerTimeDelay() const;
 
+    void setCORSDisablingPatterns(Vector<UserContentURLPattern>&& patterns) { m_corsDisablingPatterns = WTFMove(patterns); }
+
     WEBCORE_EXPORT void setMemoryCacheClientCallsEnabled(bool);
     bool areMemoryCacheClientCallsEnabled() const { return m_areMemoryCacheClientCallsEnabled; }
 

Modified: trunk/Source/WebKit/ChangeLog (260961 => 260962)


--- trunk/Source/WebKit/ChangeLog	2020-04-30 19:50:36 UTC (rev 260961)
+++ trunk/Source/WebKit/ChangeLog	2020-04-30 20:03:26 UTC (rev 260962)
@@ -1,3 +1,25 @@
+2020-04-30  Alex Christensen  <[email protected]>
+
+        Add SPI to change a WKWebView's CORS disabling pattern after initialization
+        https://bugs.webkit.org/show_bug.cgi?id=211211
+        <rdar://problem/61837474>
+
+        Reviewed by Chris Dumez.
+
+        * UIProcess/API/Cocoa/WKWebView.mm:
+        (-[WKWebView _corsDisablingPatterns]):
+        (-[WKWebView _setCORSDisablingPatterns:]):
+        * UIProcess/API/Cocoa/WKWebViewPrivate.h:
+        * UIProcess/WebPageProxy.cpp:
+        * UIProcess/WebPageProxy.h:
+        (WebKit::WebPageProxy::corsDisablingPatterns const):
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::parseAndAllowAccessToCORSDisablingPatterns):
+        (WebKit::m_isNavigatingToAppBoundDomain):
+        (WebKit::WebPage::updateCORSDisablingPatterns):
+        * WebProcess/WebPage/WebPage.h:
+        * WebProcess/WebPage/WebPage.messages.in:
+
 2020-04-30  Daniel Bates  <[email protected]>
 
         [iOS] Implement -markedTextRange

Modified: trunk/Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm (260961 => 260962)


--- trunk/Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm	2020-04-30 19:50:36 UTC (rev 260961)
+++ trunk/Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm	2020-04-30 20:03:26 UTC (rev 260962)
@@ -2812,6 +2812,16 @@
 #endif
 }
 
+- (NSArray<NSString *> *)_corsDisablingPatterns
+{
+    return createNSArray(_page->corsDisablingPatterns()).autorelease();
+}
+
+- (void)_setCORSDisablingPatterns:(NSArray<NSString *> *)patterns
+{
+    _page->setCORSDisablingPatterns(makeVector<String>(patterns));
+}
+
 - (void)_getProcessDisplayNameWithCompletionHandler:(void (^)(NSString *))completionHandler
 {
     _page->getProcessDisplayName([handler = makeBlockPtr(completionHandler)](auto&& name) {

Modified: trunk/Source/WebKit/UIProcess/API/Cocoa/WKWebViewPrivate.h (260961 => 260962)


--- trunk/Source/WebKit/UIProcess/API/Cocoa/WKWebViewPrivate.h	2020-04-30 19:50:36 UTC (rev 260961)
+++ trunk/Source/WebKit/UIProcess/API/Cocoa/WKWebViewPrivate.h	2020-04-30 20:03:26 UTC (rev 260962)
@@ -221,6 +221,8 @@
 
 @property (nonatomic, setter=_setViewScale:) CGFloat _viewScale WK_API_AVAILABLE(macos(10.11), ios(9.0));
 
+@property (nonatomic, copy, setter=_setCORSDisablingPatterns:) NSArray<NSString *> *_corsDisablingPatterns WK_API_AVAILABLE(macos(WK_MAC_TBA), ios(WK_IOS_TBA));
+
 @property (nonatomic, setter=_setMinimumEffectiveDeviceWidth:) CGFloat _minimumEffectiveDeviceWidth WK_API_AVAILABLE(macos(10.14.4), ios(12.2));
 
 @property (nonatomic, setter=_setBackgroundExtendsBeyondPage:) BOOL _backgroundExtendsBeyondPage WK_API_AVAILABLE(macos(10.13.4), ios(8.0));

Modified: trunk/Source/WebKit/UIProcess/WebPageProxy.cpp (260961 => 260962)


--- trunk/Source/WebKit/UIProcess/WebPageProxy.cpp	2020-04-30 19:50:36 UTC (rev 260961)
+++ trunk/Source/WebKit/UIProcess/WebPageProxy.cpp	2020-04-30 20:03:26 UTC (rev 260962)
@@ -483,6 +483,7 @@
 #endif
     , m_resetRecentCrashCountTimer(RunLoop::main(), this, &WebPageProxy::resetRecentCrashCount)
     , m_tryCloseTimeoutTimer(RunLoop::main(), this, &WebPageProxy::tryCloseTimedOut)
+    , m_corsDisablingPatterns(m_configuration->corsDisablingPatterns())
 #if PLATFORM(COCOA)
     , m_ignoresAppBoundDomains(m_configuration->ignoresAppBoundDomains() || WTF::processHasEntitlement("com.apple.private.applemediaservices"))
     , m_limitsNavigationsToAppBoundDomains(m_configuration->limitsNavigationsToAppBoundDomains())
@@ -7822,7 +7823,7 @@
     parameters.backgroundColor = m_backgroundColor;
 
     parameters.overriddenMediaType = m_overriddenMediaType;
-    parameters.corsDisablingPatterns = m_configuration->corsDisablingPatterns();
+    parameters.corsDisablingPatterns = corsDisablingPatterns();
     parameters.userScriptsShouldWaitUntilNotification = m_configuration->userScriptsShouldWaitUntilNotification();
     parameters.loadsFromNetwork = m_configuration->loadsFromNetwork();
     parameters.loadsSubresources = m_configuration->loadsSubresources();
@@ -10085,6 +10086,12 @@
     sendWithAsyncReply(Messages::WebPage::CompleteTextManipulation(items), WTFMove(completionHandler));
 }
 
+void WebPageProxy::setCORSDisablingPatterns(Vector<String>&& patterns)
+{
+    m_corsDisablingPatterns = WTFMove(patterns);
+    send(Messages::WebPage::UpdateCORSDisablingPatterns(m_corsDisablingPatterns));
+}
+
 void WebPageProxy::setOverriddenMediaType(const String& mediaType)
 {
     m_overriddenMediaType = mediaType;

Modified: trunk/Source/WebKit/UIProcess/WebPageProxy.h (260961 => 260962)


--- trunk/Source/WebKit/UIProcess/WebPageProxy.h	2020-04-30 19:50:36 UTC (rev 260961)
+++ trunk/Source/WebKit/UIProcess/WebPageProxy.h	2020-04-30 20:03:26 UTC (rev 260962)
@@ -1713,6 +1713,9 @@
     const String& overriddenMediaType() const { return m_overriddenMediaType; }
     void setOverriddenMediaType(const String&);
 
+    void setCORSDisablingPatterns(Vector<String>&&);
+    const Vector<String>& corsDisablingPatterns() const { return m_corsDisablingPatterns; }
+
     void getProcessDisplayName(CompletionHandler<void(String&&)>&&);
 
     void setOrientationForMediaCapture(uint64_t);
@@ -2790,6 +2793,8 @@
     
     String m_overriddenMediaType;
 
+    Vector<String> m_corsDisablingPatterns;
+
     struct InjectedBundleMessage {
         String messageName;
         RefPtr<API::Object> messageBody;

Modified: trunk/Source/WebKit/WebProcess/WebPage/WebPage.cpp (260961 => 260962)


--- trunk/Source/WebKit/WebProcess/WebPage/WebPage.cpp	2020-04-30 19:50:36 UTC (rev 260961)
+++ trunk/Source/WebKit/WebProcess/WebPage/WebPage.cpp	2020-04-30 20:03:26 UTC (rev 260962)
@@ -393,6 +393,21 @@
     return page;
 }
 
+static Vector<UserContentURLPattern> parseAndAllowAccessToCORSDisablingPatterns(Vector<String>&& input)
+{
+    Vector<UserContentURLPattern> parsedPatterns;
+    parsedPatterns.reserveInitialCapacity(input.size());
+    for (auto&& pattern : WTFMove(input)) {
+        UserContentURLPattern parsedPattern(WTFMove(pattern));
+        if (parsedPattern.isValid()) {
+            WebCore::SecurityPolicy::allowAccessTo(parsedPattern);
+            parsedPatterns.uncheckedAppend(WTFMove(parsedPattern));
+        }
+    }
+    parsedPatterns.shrinkToFit();
+    return parsedPatterns;
+}
+
 WebPage::WebPage(PageIdentifier pageID, WebPageCreationParameters&& parameters)
     : m_identifier(pageID)
     , m_mainFrame(WebFrame::create())
@@ -530,19 +545,8 @@
 #if PLATFORM(IOS_FAMILY) && ENABLE(DEVICE_ORIENTATION)
     pageConfiguration.deviceOrientationUpdateProvider = WebDeviceOrientationUpdateProvider::create(*this);
 #endif
-
-    Vector<UserContentURLPattern> parsedPatterns;
-    parsedPatterns.reserveInitialCapacity(parameters.corsDisablingPatterns.size());
-    for (auto&& pattern : WTFMove(parameters.corsDisablingPatterns)) {
-        UserContentURLPattern parsedPattern(WTFMove(pattern));
-        if (parsedPattern.isValid()) {
-            WebCore::SecurityPolicy::allowAccessTo(parsedPattern);
-            parsedPatterns.uncheckedAppend(WTFMove(parsedPattern));
-        }
-    }
-    parsedPatterns.shrinkToFit();
     
-    pageConfiguration.corsDisablingPatterns = WTFMove(parsedPatterns);
+    pageConfiguration.corsDisablingPatterns = parseAndAllowAccessToCORSDisablingPatterns(WTFMove(parameters.corsDisablingPatterns));
     pageConfiguration.userScriptsShouldWaitUntilNotification = parameters.userScriptsShouldWaitUntilNotification;
     pageConfiguration.loadsSubresources = parameters.loadsSubresources;
     pageConfiguration.loadsFromNetwork = parameters.loadsFromNetwork;
@@ -7050,6 +7054,12 @@
     m_page->setNeedsRecalcStyleInAllFrames();
 }
 
+void WebPage::updateCORSDisablingPatterns(Vector<String>&& patterns)
+{
+    if (m_page)
+        m_page->setCORSDisablingPatterns(parseAndAllowAccessToCORSDisablingPatterns(WTFMove(patterns)));
+}
+
 bool WebPage::shouldUseRemoteRenderingFor(RenderingPurpose purpose)
 {
 #if ENABLE(GPU_PROCESS)

Modified: trunk/Source/WebKit/WebProcess/WebPage/WebPage.h (260961 => 260962)


--- trunk/Source/WebKit/WebProcess/WebPage/WebPage.h	2020-04-30 19:50:36 UTC (rev 260961)
+++ trunk/Source/WebKit/WebProcess/WebPage/WebPage.h	2020-04-30 20:03:26 UTC (rev 260962)
@@ -1301,6 +1301,8 @@
     const String& overriddenMediaType() const { return m_overriddenMediaType; }
     void setOverriddenMediaType(const String&);
 
+    void updateCORSDisablingPatterns(Vector<String>&&);
+
     void getProcessDisplayName(CompletionHandler<void(String&&)>&&);
 
     WebCore::AllowsContentJavaScript allowsContentJavaScriptFromMostRecentNavigation() const { return m_allowsContentJavaScriptFromMostRecentNavigation; }

Modified: trunk/Source/WebKit/WebProcess/WebPage/WebPage.messages.in (260961 => 260962)


--- trunk/Source/WebKit/WebProcess/WebPage/WebPage.messages.in	2020-04-30 19:50:36 UTC (rev 260961)
+++ trunk/Source/WebKit/WebProcess/WebPage/WebPage.messages.in	2020-04-30 20:03:26 UTC (rev 260962)
@@ -601,6 +601,8 @@
     SetOverriddenMediaType(String mediaType)
     GetProcessDisplayName() -> (String displayName) Async
 
+    UpdateCORSDisablingPatterns(Vector<String> patterns)
+
     SetShouldFireEvents(bool shouldFireEvents)
     SetNeedsDOMWindowResizeEvent()
 

Modified: trunk/Tools/ChangeLog (260961 => 260962)


--- trunk/Tools/ChangeLog	2020-04-30 19:50:36 UTC (rev 260961)
+++ trunk/Tools/ChangeLog	2020-04-30 20:03:26 UTC (rev 260962)
@@ -1,5 +1,15 @@
 2020-04-30  Alex Christensen  <[email protected]>
 
+        Add SPI to change a WKWebView's CORS disabling pattern after initialization
+        https://bugs.webkit.org/show_bug.cgi?id=211211
+        <rdar://problem/61837474>
+
+        Reviewed by Chris Dumez.
+
+        * TestWebKitAPI/Tests/WebKitCocoa/WKURLSchemeHandler-1.mm:
+
+2020-04-30  Alex Christensen  <[email protected]>
+
         REGRESSION: [ iOS ] http/tests/resourceLoadStatistics/standalone-web-application-exempt-from-website-data-deletion tests are flaky crashing, failing an timing out.
         https://bugs.webkit.org/show_bug.cgi?id=211190
 

Modified: trunk/Tools/TestWebKitAPI/Tests/WebKitCocoa/WKURLSchemeHandler-1.mm (260961 => 260962)


--- trunk/Tools/TestWebKitAPI/Tests/WebKitCocoa/WKURLSchemeHandler-1.mm	2020-04-30 19:50:36 UTC (rev 260961)
+++ trunk/Tools/TestWebKitAPI/Tests/WebKitCocoa/WKURLSchemeHandler-1.mm	2020-04-30 20:03:26 UTC (rev 260962)
@@ -848,20 +848,22 @@
     WKWebViewConfiguration *configuration = [[[WKWebViewConfiguration alloc] init] autorelease];
     [configuration setURLSchemeHandler:handler.get() forURLScheme:@"cors"];
 
+    NSString *testJS = [NSString stringWithFormat:
+        @"fetch('http://127.0.0.1:%d/subresource').then(function(r){"
+            "r.json().then(function(object) {"
+                "if (object.testkey == 'testvalue') {"
+                    "fetch('/corssuccess')"
+                "} else {"
+                    "fetch('/corsfailure')"
+                "}"
+            "}).catch(function(){fetch('/corsfailure')})"
+        "}).catch(function(){fetch('/corsfailure')})"
+        , server.port()];
+
     [handler setStartURLSchemeTaskHandler:[&](WKWebView *, id<WKURLSchemeTask> task) {
         if ([task.request.URL.path isEqualToString:@"/main.html"]) {
             NSData *data = "" stringWithFormat:
-                @"<script>"
-                    "fetch('http://127.0.0.1:%d/subresource').then(function(r){"
-                        "r.json().then(function(object) {"
-                            "if (object.testkey == 'testvalue') {"
-                                "fetch('/corssuccess')"
-                            "} else {"
-                                "fetch('/corsfailure')"
-                            "}"
-                        "}).catch(function(){fetch('/corsfailure')})"
-                    "}).catch(function(){fetch('/corsfailure')})"
-                "</script>", server.port()] dataUsingEncoding:NSUTF8StringEncoding];
+                @"<script>%@</script>", testJS] dataUsingEncoding:NSUTF8StringEncoding];
             [task didReceiveResponse:[[[NSURLResponse alloc] initWithURL:task.request.URL MIMEType:@"text/html" expectedContentLength:data.length textEncodingName:nil] autorelease]];
             [task didReceiveData:data];
             [task didFinish];
@@ -888,13 +890,31 @@
     done = false;
 
     configuration._corsDisablingPatterns = @[@"*://*/*"];
-    {
-        auto webView = adoptNS([[WKWebView alloc] initWithFrame:CGRectMake(0, 0, 800, 600) configuration:configuration]);
-        [webView loadRequest:[NSURLRequest requestWithURL:[NSURL URLWithString:@"cors://host1/main.html"]]];
-        TestWebKitAPI::Util::run(&done);
-    }
+    auto webView = adoptNS([[WKWebView alloc] initWithFrame:CGRectMake(0, 0, 800, 600) configuration:configuration]);
+    [webView loadRequest:[NSURLRequest requestWithURL:[NSURL URLWithString:@"cors://host1/main.html"]]];
+    TestWebKitAPI::Util::run(&done);
     EXPECT_TRUE(corssuccess);
     EXPECT_FALSE(corsfailure);
+
+    corssuccess = false;
+    corsfailure = false;
+    done = false;
+
+    webView.get()._corsDisablingPatterns = @[];
+    [webView evaluateJavaScript:testJS completionHandler:nil];
+    TestWebKitAPI::Util::run(&done);
+    EXPECT_FALSE(corssuccess);
+    EXPECT_TRUE(corsfailure);
+
+    corssuccess = false;
+    corsfailure = false;
+    done = false;
+
+    webView.get()._corsDisablingPatterns = @[@"*://*/*"];
+    [webView evaluateJavaScript:testJS completionHandler:nil];
+    TestWebKitAPI::Util::run(&done);
+    EXPECT_TRUE(corssuccess);
+    EXPECT_FALSE(corsfailure);
 }
 
 TEST(URLSchemeHandler, DisableCORSCredentials)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to