Diff
Modified: trunk/Source/WebKit/ChangeLog (264282 => 264283)
--- trunk/Source/WebKit/ChangeLog 2020-07-12 18:47:31 UTC (rev 264282)
+++ trunk/Source/WebKit/ChangeLog 2020-07-12 18:53:53 UTC (rev 264283)
@@ -1,3 +1,23 @@
+2020-07-12 Darin Adler <da...@apple.com>
+
+ REGRESSION (r261152): 9 blocks of critical sandboxing code disabled because they are guarded with HAVE(SANDBOX_ISSUE_READ_EXTENSION_TO_PROCESS_BY_AUDIT_TOKEN)
+ https://bugs.webkit.org/show_bug.cgi?id=214233
+
+ Reviewed by Per Arne Vollan.
+
+ * NetworkProcess/NetworkResourceLoadParameters.cpp:
+ (WebKit::NetworkResourceLoadParameters::encode const): Remove #if HAVE.
+ * UIProcess/Cocoa/WebPageProxyCocoa.mm:
+ (WebKit::WebPageProxy::createSandboxExtensionsIfNeeded): Ditto.
+ * UIProcess/WebPageProxy.cpp:
+ (WebKit::WebPageProxy::maybeInitializeSandboxExtensionHandle): Ditto.
+ (WebKit::WebPageProxy::loadRequestWithNavigationShared): Ditto.
+ (WebKit::WebPageProxy::loadFile): Ditto.
+ * UIProcess/WebProcessProxy.cpp:
+ (WebKit::WebProcessProxy::shouldSendPendingMessage): Ditto.
+ * WebProcess/GPU/media/MediaPlayerPrivateRemote.cpp:
+ (WebKit::MediaPlayerPrivateRemote::MediaPlayerPrivateRemote::load): Ditto.
+
2020-07-11 Darin Adler <da...@apple.com>
Remove live ranges from AccessibilityObject.h, AccessibilityObjectInterface.h, AccessibilityRenderObject.h, AXIsolatedObject.h
Modified: trunk/Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.cpp (264282 => 264283)
--- trunk/Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.cpp 2020-07-12 18:47:31 UTC (rev 264282)
+++ trunk/Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.cpp 2020-07-12 18:53:53 UTC (rev 264283)
@@ -66,13 +66,11 @@
if (request.url().isLocalFile()) {
SandboxExtension::Handle requestSandboxExtension;
-#if HAVE(SANDBOX_ISSUE_READ_EXTENSION_TO_PROCESS_BY_AUDIT_TOKEN)
+#if ENABLE(SANDBOX_EXTENSIONS)
if (networkProcessAuditToken)
SandboxExtension::createHandleForReadByAuditToken(request.url().fileSystemPath(), *networkProcessAuditToken, requestSandboxExtension);
else
SandboxExtension::createHandle(request.url().fileSystemPath(), SandboxExtension::Type::ReadOnly, requestSandboxExtension);
-#else
- SandboxExtension::createHandle(request.url().fileSystemPath(), SandboxExtension::Type::ReadOnly, requestSandboxExtension);
#endif
encoder << requestSandboxExtension;
}
Modified: trunk/Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm (264282 => 264283)
--- trunk/Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm 2020-07-12 18:47:31 UTC (rev 264282)
+++ trunk/Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm 2020-07-12 18:53:53 UTC (rev 264283)
@@ -184,15 +184,11 @@
if (files.size() == 1) {
BOOL isDirectory;
if ([[NSFileManager defaultManager] fileExistsAtPath:files[0] isDirectory:&isDirectory] && !isDirectory) {
-#if HAVE(SANDBOX_ISSUE_READ_EXTENSION_TO_PROCESS_BY_AUDIT_TOKEN)
ASSERT(process().connection() && process().connection()->getAuditToken());
if (process().connection() && process().connection()->getAuditToken())
SandboxExtension::createHandleForReadByAuditToken("/", *(process().connection()->getAuditToken()), fileReadHandle);
else
SandboxExtension::createHandle("/", SandboxExtension::Type::ReadOnly, fileReadHandle);
-#else
- SandboxExtension::createHandle("/", SandboxExtension::Type::ReadOnly, fileReadHandle);
-#endif
willAcquireUniversalFileReadSandboxExtension(m_process);
}
}
Modified: trunk/Source/WebKit/UIProcess/WebPageProxy.cpp (264282 => 264283)
--- trunk/Source/WebKit/UIProcess/WebPageProxy.cpp 2020-07-12 18:47:31 UTC (rev 264282)
+++ trunk/Source/WebKit/UIProcess/WebPageProxy.cpp 2020-07-12 18:53:53 UTC (rev 264283)
@@ -1180,23 +1180,28 @@
closePage();
}
+#if !ENABLE(SANDBOX_EXTENSIONS)
+
+void WebPageProxy::maybeInitializeSandboxExtensionHandle(WebProcessProxy&, const URL&, const URL&, SandboxExtension::Handle&, bool)
+{
+}
+
+#else
+
void WebPageProxy::maybeInitializeSandboxExtensionHandle(WebProcessProxy& process, const URL& url, const URL& resourceDirectoryURL, SandboxExtension::Handle& sandboxExtensionHandle, bool checkAssumedReadAccessToResourceURL)
{
if (!url.isLocalFile())
return;
-#if HAVE(SANDBOX_ISSUE_READ_EXTENSION_TO_PROCESS_BY_AUDIT_TOKEN)
// If the process is still launching then it does not have a PID yet. We will take care of creating the sandbox extension
// once the process has finished launching.
if (process.isLaunching() || process.wasTerminated())
return;
-#endif
if (!resourceDirectoryURL.isEmpty()) {
if (checkAssumedReadAccessToResourceURL && process.hasAssumedReadAccessToURL(resourceDirectoryURL))
return;
-#if HAVE(SANDBOX_ISSUE_READ_EXTENSION_TO_PROCESS_BY_AUDIT_TOKEN)
ASSERT(process.connection() && process.connection()->getAuditToken());
bool createdExtension = false;
if (process.connection() && process.connection()->getAuditToken())
@@ -1208,12 +1213,6 @@
process.assumeReadAccessToBaseURL(*this, resourceDirectoryURL.string());
return;
}
-#else
- if (SandboxExtension::createHandle(resourceDirectoryURL.fileSystemPath(), SandboxExtension::Type::ReadOnly, sandboxExtensionHandle)) {
- process.assumeReadAccessToBaseURL(*this, resourceDirectoryURL.string());
- return;
- }
-#endif
}
if (process.hasAssumedReadAccessToURL(url))
@@ -1222,7 +1221,6 @@
// Inspector resources are in a directory with assumed access.
RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(!WebKit::isInspectorPage(*this));
-#if HAVE(SANDBOX_ISSUE_READ_EXTENSION_TO_PROCESS_BY_AUDIT_TOKEN)
ASSERT(process.connection() && process.connection()->getAuditToken());
bool createdExtension = false;
if (process.connection() && process.connection()->getAuditToken())
@@ -1234,12 +1232,6 @@
willAcquireUniversalFileReadSandboxExtension(process);
return;
}
-#else
- if (SandboxExtension::createHandle("/", SandboxExtension::Type::ReadOnly, sandboxExtensionHandle)) {
- willAcquireUniversalFileReadSandboxExtension(process);
- return;
- }
-#endif
#if PLATFORM(COCOA)
if (!linkedOnOrAfter(SDKVersion::FirstWithoutUnconditionalUniversalSandboxExtension))
@@ -1251,7 +1243,6 @@
auto basePath = baseURL.fileSystemPath();
if (basePath.isNull())
return;
-#if HAVE(SANDBOX_ISSUE_READ_EXTENSION_TO_PROCESS_BY_AUDIT_TOKEN)
if (process.connection() && process.connection()->getAuditToken())
createdExtension = SandboxExtension::createHandleForReadByAuditToken(basePath, *(process.connection()->getAuditToken()), sandboxExtensionHandle);
else
@@ -1259,16 +1250,16 @@
if (createdExtension)
process.assumeReadAccessToBaseURL(*this, baseURL.string());
-#else
- if (SandboxExtension::createHandle(basePath, SandboxExtension::Type::ReadOnly, sandboxExtensionHandle))
- process.assumeReadAccessToBaseURL(*this, baseURL.string());
-#endif
}
+#endif
+
#if !PLATFORM(COCOA)
+
void WebPageProxy::addPlatformLoadParameters(WebProcessProxy&, LoadParameters&)
{
}
+
#endif
WebProcessProxy& WebPageProxy::ensureRunningProcess()
@@ -1329,14 +1320,10 @@
navigation.setIsLoadedWithNavigationShared(true);
-#if HAVE(SANDBOX_ISSUE_READ_EXTENSION_TO_PROCESS_BY_AUDIT_TOKEN)
if (!process->isLaunching() || !url.isLocalFile())
process->send(Messages::WebPage::LoadRequest(loadParameters), webPageID);
else
process->send(Messages::WebPage::LoadRequestWaitingForProcessLaunch(loadParameters, m_pageLoadState.resourceDirectoryURL(), m_identifier, true), webPageID);
-#else
- process->send(Messages::WebPage::LoadRequest(loadParameters), webPageID);
-#endif
process->startResponsivenessTimer();
}
@@ -1387,14 +1374,10 @@
maybeInitializeSandboxExtensionHandle(m_process, fileURL, resourceDirectoryURL, loadParameters.sandboxExtensionHandle, checkAssumedReadAccessToResourceURL);
addPlatformLoadParameters(m_process, loadParameters);
-#if HAVE(SANDBOX_ISSUE_READ_EXTENSION_TO_PROCESS_BY_AUDIT_TOKEN)
if (m_process->isLaunching())
send(Messages::WebPage::LoadRequestWaitingForProcessLaunch(loadParameters, resourceDirectoryURL, m_identifier, checkAssumedReadAccessToResourceURL));
else
send(Messages::WebPage::LoadRequest(loadParameters));
-#else
- send(Messages::WebPage::LoadRequest(loadParameters));
-#endif
m_process->startResponsivenessTimer();
return navigation;
Modified: trunk/Source/WebKit/UIProcess/WebProcessProxy.cpp (264282 => 264283)
--- trunk/Source/WebKit/UIProcess/WebProcessProxy.cpp 2020-07-12 18:47:31 UTC (rev 264282)
+++ trunk/Source/WebKit/UIProcess/WebProcessProxy.cpp 2020-07-12 18:53:53 UTC (rev 264283)
@@ -358,7 +358,6 @@
bool WebProcessProxy::shouldSendPendingMessage(const PendingMessage& message)
{
-#if HAVE(SANDBOX_ISSUE_READ_EXTENSION_TO_PROCESS_BY_AUDIT_TOKEN)
if (message.encoder->messageName() == IPC::MessageName::WebPage_LoadRequestWaitingForProcessLaunch) {
auto buffer = message.encoder->buffer();
auto bufferSize = message.encoder->bufferSize();
@@ -376,7 +375,6 @@
ASSERT_NOT_REACHED();
return false;
}
-#endif
return true;
}
Modified: trunk/Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.cpp (264282 => 264283)
--- trunk/Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.cpp 2020-07-12 18:47:31 UTC (rev 264282)
+++ trunk/Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.cpp 2020-07-12 18:53:53 UTC (rev 264283)
@@ -139,16 +139,15 @@
void MediaPlayerPrivateRemote::MediaPlayerPrivateRemote::load(const URL& url, const ContentType& contentType, const String& keySystem)
{
Optional<SandboxExtension::Handle> sandboxExtensionHandle;
+
+#if ENABLE(SANDBOX_EXTENSIONS)
if (url.isLocalFile()) {
SandboxExtension::Handle handle;
auto fileSystemPath = url.fileSystemPath();
auto createExtension = [&] {
-#if HAVE(SANDBOX_ISSUE_READ_EXTENSION_TO_PROCESS_BY_AUDIT_TOKEN)
if (auto auditToken = m_manager.gpuProcessConnection().auditToken())
return SandboxExtension::createHandleForReadByAuditToken(fileSystemPath, auditToken.value(), handle);
-#endif
-
return SandboxExtension::createHandle(fileSystemPath, SandboxExtension::Type::ReadOnly, handle);
};
@@ -161,6 +160,7 @@
sandboxExtensionHandle = WTFMove(handle);
}
+#endif
connection().sendWithAsyncReply(Messages::RemoteMediaPlayerProxy::Load(url, sandboxExtensionHandle, contentType, keySystem), [weakThis = makeWeakPtr(*this)](auto&& configuration) {
if (weakThis)
