Title: [265264] trunk
Revision
265264
Author
pvol...@apple.com
Date
2020-08-04 15:49:38 -0700 (Tue, 04 Aug 2020)

Log Message

[iOS] Check that Accessibility is enabled when receiving the enable Accessibility notification
https://bugs.webkit.org/show_bug.cgi?id=215112
Source/WebCore/PAL:

Reviewed by Youenn Fablet.

Declare NSApplication methods to enable enhanced accessibility user interface, and check if it is enabled.

* pal/spi/mac/NSApplicationSPI.h:

Source/WebKit:

<rdar://problem/66498397>

Reviewed by Youenn Fablet.

As a security mitigation, return early when handling this notification if Accessibility is not enabled.

API test: WebKit.AccessibilityHasNoPreferencesServiceAccessWhenPostingNotification

* UIProcess/Cocoa/WebProcessPoolCocoa.mm:
(WebKit::WebProcessPool::registerNotificationObservers):

Tools:

Reviewed by Youenn Fablet.

Added test WebKit.AccessibilityHasNoPreferencesServiceAccessWhenPostingNotification.

* TestWebKitAPI/Tests/WebKit/EnableAccessibility.mm:
(TEST):

Modified Paths

Diff

Modified: trunk/Source/WebCore/PAL/ChangeLog (265263 => 265264)


--- trunk/Source/WebCore/PAL/ChangeLog	2020-08-04 22:39:21 UTC (rev 265263)
+++ trunk/Source/WebCore/PAL/ChangeLog	2020-08-04 22:49:38 UTC (rev 265264)
@@ -1,3 +1,14 @@
+2020-08-04  Per Arne Vollan  <pvol...@apple.com>
+
+        [iOS] Check that Accessibility is enabled when receiving the enable Accessibility notification
+        https://bugs.webkit.org/show_bug.cgi?id=215112
+
+        Reviewed by Youenn Fablet.
+
+        Declare NSApplication methods to enable enhanced accessibility user interface, and check if it is enabled.
+
+        * pal/spi/mac/NSApplicationSPI.h:
+
 2020-08-03  Andres Gonzalez  <andresg...@apple.com>
 
         Check for the presence of libAccessibility before trying to load the _AXSIsolatedTreeMode function.

Modified: trunk/Source/WebCore/PAL/pal/spi/mac/NSApplicationSPI.h (265263 => 265264)


--- trunk/Source/WebCore/PAL/pal/spi/mac/NSApplicationSPI.h	2020-08-04 22:39:21 UTC (rev 265263)
+++ trunk/Source/WebCore/PAL/pal/spi/mac/NSApplicationSPI.h	2020-08-04 22:49:38 UTC (rev 265264)
@@ -32,6 +32,9 @@
 + (void)_accessibilityInitialize;
 + (void)_preventDockConnections;
 
+- (void)accessibilitySetEnhancedUserInterfaceAttribute:(id)value;
+- (id)accessibilityEnhancedUserInterfaceAttribute;
+
 // Conditionally define this only for !USE_APPLE_INTERNAL_SDK when <rdar://problem/63864711> is fixed.
 @property (copy, setter=_setAccentColor:) NSColor *_accentColor;
 

Modified: trunk/Source/WebKit/ChangeLog (265263 => 265264)


--- trunk/Source/WebKit/ChangeLog	2020-08-04 22:39:21 UTC (rev 265263)
+++ trunk/Source/WebKit/ChangeLog	2020-08-04 22:49:38 UTC (rev 265264)
@@ -1,3 +1,18 @@
+2020-08-04  Per Arne Vollan  <pvol...@apple.com>
+
+        [iOS] Check that Accessibility is enabled when receiving the enable Accessibility notification
+        https://bugs.webkit.org/show_bug.cgi?id=215112
+        <rdar://problem/66498397>
+
+        Reviewed by Youenn Fablet.
+
+        As a security mitigation, return early when handling this notification if Accessibility is not enabled.
+
+        API test: WebKit.AccessibilityHasNoPreferencesServiceAccessWhenPostingNotification
+
+        * UIProcess/Cocoa/WebProcessPoolCocoa.mm:
+        (WebKit::WebProcessPool::registerNotificationObservers):
+
 2020-08-04  Brent Fulgham  <bfulg...@apple.com>
 
         Limit 'com.apple.webkit.microphone' use to macOS and MacCatalyst 

Modified: trunk/Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm (265263 => 265264)


--- trunk/Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm	2020-08-04 22:39:21 UTC (rev 265263)
+++ trunk/Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm	2020-08-04 22:49:38 UTC (rev 265264)
@@ -79,6 +79,7 @@
 
 #if PLATFORM(MAC)
 #import <QuartzCore/CARemoteLayerServer.h>
+#import <pal/spi/mac/NSApplicationSPI.h>
 #else
 #import "UIKitSPI.h"
 #endif
@@ -643,11 +644,13 @@
 #if !PLATFORM(IOS_FAMILY)
     // Listen for enhanced accessibility changes and propagate them to the WebProcess.
     m_enhancedAccessibilityObserver = [[NSNotificationCenter defaultCenter] addObserverForName:WebKitApplicationDidChangeAccessibilityEnhancedUserInterfaceNotification object:nil queue:[NSOperationQueue currentQueue] usingBlock:^(NSNotification *note) {
+        setEnhancedAccessibility([[[note userInfo] objectForKey:@"AXEnhancedUserInterface"] boolValue]);
 #if ENABLE(CFPREFS_DIRECT_MODE)
+        if (![[NSApp accessibilityEnhancedUserInterfaceAttribute] boolValue])
+            return;
         for (auto& process : m_processes)
             process->unblockPreferenceServiceIfNeeded();
 #endif
-        setEnhancedAccessibility([[[note userInfo] objectForKey:@"AXEnhancedUserInterface"] boolValue]);
     }];
 
     m_automaticTextReplacementNotificationObserver = [[NSNotificationCenter defaultCenter] addObserverForName:NSSpellCheckerDidChangeAutomaticTextReplacementNotification object:nil queue:[NSOperationQueue currentQueue] usingBlock:^(NSNotification *notification) {
@@ -702,6 +705,8 @@
 
 #if PLATFORM(IOS_FAMILY)
     m_accessibilityEnabledObserver = [[NSNotificationCenter defaultCenter] addObserverForName:(__bridge id)kAXSApplicationAccessibilityEnabledNotification object:nil queue:[NSOperationQueue currentQueue] usingBlock:^(NSNotification *) {
+        if (!_AXSApplicationAccessibilityEnabled())
+            return;
         for (size_t i = 0; i < m_processes.size(); ++i) {
 #if ENABLE(CFPREFS_DIRECT_MODE)
             m_processes[i]->unblockPreferenceServiceIfNeeded();

Modified: trunk/Tools/ChangeLog (265263 => 265264)


--- trunk/Tools/ChangeLog	2020-08-04 22:39:21 UTC (rev 265263)
+++ trunk/Tools/ChangeLog	2020-08-04 22:49:38 UTC (rev 265264)
@@ -1,3 +1,15 @@
+2020-08-04  Per Arne Vollan  <pvol...@apple.com>
+
+        [iOS] Check that Accessibility is enabled when receiving the enable Accessibility notification
+        https://bugs.webkit.org/show_bug.cgi?id=215112
+
+        Reviewed by Youenn Fablet.
+
+        Added test WebKit.AccessibilityHasNoPreferencesServiceAccessWhenPostingNotification.
+
+        * TestWebKitAPI/Tests/WebKit/EnableAccessibility.mm:
+        (TEST):
+
 2020-08-04  Chris Fleizach  <cfleiz...@apple.com>
 
         AX: VoiceOver needs access to font styling at insertion point

Modified: trunk/Tools/TestWebKitAPI/Tests/WebKit/EnableAccessibility.mm (265263 => 265264)


--- trunk/Tools/TestWebKitAPI/Tests/WebKit/EnableAccessibility.mm	2020-08-04 22:39:21 UTC (rev 265263)
+++ trunk/Tools/TestWebKitAPI/Tests/WebKit/EnableAccessibility.mm	2020-08-04 22:49:38 UTC (rev 265264)
@@ -33,6 +33,10 @@
 #import <pal/spi/cocoa/NSAccessibilitySPI.h>
 #import <wtf/SoftLinking.h>
 
+#if PLATFORM(MAC)
+#import <pal/spi/mac/NSApplicationSPI.h>
+#endif
+
 SOFT_LINK_LIBRARY(libAccessibility)
 SOFT_LINK_CONSTANT(libAccessibility, kAXSApplicationAccessibilityEnabledNotification, CFStringRef);
 
@@ -59,15 +63,39 @@
 
     [webView synchronouslyLoadTestPageNamed:@"simple"];
 
-    [[NSNotificationCenter defaultCenter] postNotificationName:NSApplicationDidChangeAccessibilityEnhancedUserInterfaceNotification object:nil userInfo:nil];
+    [NSApp accessibilitySetEnhancedUserInterfaceAttribute:@(YES)];
 
     auto sandboxAccess = [&] {
         return [webView stringByEvaluatingJavaScript:@"window.internals.hasSandboxMachLookupAccessToGlobalName('com.apple.WebKit.WebContent', 'com.apple.cfprefsd.daemon')"].boolValue;
     };
 
+    [webView synchronouslyLoadTestPageNamed:@"simple"];
+
     ASSERT_TRUE(sandboxAccess());
+
+    [NSApp accessibilitySetEnhancedUserInterfaceAttribute:@(NO)];
 }
 
+TEST(WebKit, AccessibilityHasNoPreferencesServiceAccessWhenPostingNotification)
+{
+    auto configuration = adoptNS([[WKWebViewConfiguration alloc] init]);
+    WKRetainPtr<WKContextRef> context = adoptWK(TestWebKitAPI::Util::createContextForInjectedBundleTest("InternalsInjectedBundleTest"));
+    configuration.get().processPool = (WKProcessPool *)context.get();
+    auto webView = adoptNS([[TestWKWebView alloc] initWithFrame:NSMakeRect(0, 0, 300, 300) configuration:configuration.get() addToWindow:YES]);
+
+    [webView synchronouslyLoadTestPageNamed:@"simple"];
+
+    [[NSNotificationCenter defaultCenter] postNotificationName:NSApplicationDidChangeAccessibilityEnhancedUserInterfaceNotification object:nil userInfo:nil];
+
+    auto sandboxAccess = [&] {
+        return [webView stringByEvaluatingJavaScript:@"window.internals.hasSandboxMachLookupAccessToGlobalName('com.apple.WebKit.WebContent', 'com.apple.cfprefsd.daemon')"].boolValue;
+    };
+
+    [webView synchronouslyLoadTestPageNamed:@"simple"];
+
+    ASSERT_TRUE(!sandboxAccess());
+}
+
 #if PLATFORM(IOS_FAMILY)
 TEST(WebKit, AccessibilityHasFrontboardServiceAccess)
 {
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to