- Revision
- 284838
- Author
- [email protected]
- Date
- 2021-10-25 14:51:24 -0700 (Mon, 25 Oct 2021)
Log Message
Cherry-pick r284532. rdar://problem/84625267
Source/WebKit:
[WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
https://bugs.webkit.org/show_bug.cgi?id=219813
<rdar://problem/72484635>
Patch by John Pascoe <[email protected]> on 2021-10-20
Reviewed by Brent Fulgham.
Currently, whenever the platform authenticator is within excludedCredentials during makeCredential we
always return NotAllowedError and merely flash a consent screen. This does not match the spec per Step 3.1
of makeCredential (https://w3c.github.io/webauthn/#sctn-op-make-cred). Instead, we should always obtain consent
and return a different error depending on consent was obtained.
A fixme to add this was inadvertently removed in https://bugs.webkit.org/attachment.cgi?id=393180&action=""
Added api test TestWebKitAPI.WebAuthenticationPanel.LADuplicateCredentialWithConsent
* UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm:
(WebKit::LocalAuthenticator::makeCredential):
Tools:
[WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
https://bugs.webkit.org/show_bug.cgi?id=219813
<rdar://problem/72484635>
Patch by John Pascoe <[email protected]> on 2021-10-20
Reviewed by Brent Fulgham.
Currently, whenever the platform authenticator is within excludedCredentials during makeCredential we
always return NotAllowedError and merely flash a consent screen. This does not match the spec per Step 3.1
of makeCredential (https://w3c.github.io/webauthn/#sctn-op-make-cred). Instead, we should always obtain consent
and return a different error depending on consent was obtained.
This adds a test to confirm a different path is taken whenever consent is obtained.
* TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm:
(TestWebKitAPI::TEST):
LayoutTests:
WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
https://bugs.webkit.org/show_bug.cgi?id=219813
<rdar://problem/72484635>
Patch by John Pascoe <[email protected]> on 2021-10-20
Reviewed by Brent Fulgham.
Modify layout tests to reflect different exception returned when consent is provided
* http/wpt/webauthn/public-key-credential-create-failure-local-silent.https.html:
* http/wpt/webauthn/public-key-credential-create-failure-local.https.html:
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@284532 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Diff
Modified: branches/safari-612-branch/LayoutTests/ChangeLog (284837 => 284838)
--- branches/safari-612-branch/LayoutTests/ChangeLog 2021-10-25 21:51:20 UTC (rev 284837)
+++ branches/safari-612-branch/LayoutTests/ChangeLog 2021-10-25 21:51:24 UTC (rev 284838)
@@ -1,5 +1,75 @@
2021-10-25 Null <[email protected]>
+ Cherry-pick r284532. rdar://problem/84625267
+
+ Source/WebKit:
+ [WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
+ https://bugs.webkit.org/show_bug.cgi?id=219813
+ <rdar://problem/72484635>
+
+ Patch by John Pascoe <[email protected]> on 2021-10-20
+ Reviewed by Brent Fulgham.
+
+ Currently, whenever the platform authenticator is within excludedCredentials during makeCredential we
+ always return NotAllowedError and merely flash a consent screen. This does not match the spec per Step 3.1
+ of makeCredential (https://w3c.github.io/webauthn/#sctn-op-make-cred). Instead, we should always obtain consent
+ and return a different error depending on consent was obtained.
+
+ A fixme to add this was inadvertently removed in https://bugs.webkit.org/attachment.cgi?id=393180&action=""
+
+ Added api test TestWebKitAPI.WebAuthenticationPanel.LADuplicateCredentialWithConsent
+
+ * UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm:
+ (WebKit::LocalAuthenticator::makeCredential):
+
+ Tools:
+ [WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
+ https://bugs.webkit.org/show_bug.cgi?id=219813
+ <rdar://problem/72484635>
+
+ Patch by John Pascoe <[email protected]> on 2021-10-20
+ Reviewed by Brent Fulgham.
+
+ Currently, whenever the platform authenticator is within excludedCredentials during makeCredential we
+ always return NotAllowedError and merely flash a consent screen. This does not match the spec per Step 3.1
+ of makeCredential (https://w3c.github.io/webauthn/#sctn-op-make-cred). Instead, we should always obtain consent
+ and return a different error depending on consent was obtained.
+
+ This adds a test to confirm a different path is taken whenever consent is obtained.
+
+ * TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm:
+ (TestWebKitAPI::TEST):
+
+ LayoutTests:
+ WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
+ https://bugs.webkit.org/show_bug.cgi?id=219813
+ <rdar://problem/72484635>
+
+ Patch by John Pascoe <[email protected]> on 2021-10-20
+ Reviewed by Brent Fulgham.
+
+ Modify layout tests to reflect different exception returned when consent is provided
+
+ * http/wpt/webauthn/public-key-credential-create-failure-local-silent.https.html:
+ * http/wpt/webauthn/public-key-credential-create-failure-local.https.html:
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@284532 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2021-10-20 John Pascoe <[email protected]>
+
+ WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
+ https://bugs.webkit.org/show_bug.cgi?id=219813
+ <rdar://problem/72484635>
+
+ Reviewed by Brent Fulgham.
+
+ Modify layout tests to reflect different exception returned when consent is provided
+
+ * http/wpt/webauthn/public-key-credential-create-failure-local-silent.https.html:
+ * http/wpt/webauthn/public-key-credential-create-failure-local.https.html:
+
+2021-10-25 Null <[email protected]>
+
Cherry-pick r284247. rdar://problem/84629726
REGRESSION (r276370): Elements with animated transform property might not properly rendered
Modified: branches/safari-612-branch/LayoutTests/http/wpt/webauthn/public-key-credential-create-failure-local-silent.https.html (284837 => 284838)
--- branches/safari-612-branch/LayoutTests/http/wpt/webauthn/public-key-credential-create-failure-local-silent.https.html 2021-10-25 21:51:20 UTC (rev 284837)
+++ branches/safari-612-branch/LayoutTests/http/wpt/webauthn/public-key-credential-create-failure-local-silent.https.html 2021-10-25 21:51:24 UTC (rev 284838)
@@ -50,7 +50,7 @@
};
if (window.testRunner)
testRunner.addTestKeyToKeychain(privateKeyBase64, testRpId, testUserEntityBundleBase64);
- return promiseRejects(t, "NotAllowedError", navigator.credentials.create(options), "Operation timed out.").then(() => {
+ return promiseRejects(t, "InvalidStateError", navigator.credentials.create(options), "At least one credential matches an entry of the excludeCredentials list in the platform attached authenticator.").then(() => {
if (window.testRunner)
testRunner.cleanUpKeychain(testRpId, credentialIDBase64);
});
@@ -84,7 +84,7 @@
};
if (window.testRunner)
testRunner.addTestKeyToKeychain(privateKeyBase64, testRpId, testUserEntityBundleBase64);
- return promiseRejects(t, "NotAllowedError", navigator.credentials.create(options), "Operation timed out.").then(() => {
+ return promiseRejects(t, "InvalidStateError", navigator.credentials.create(options), "At least one credential matches an entry of the excludeCredentials list in the platform attached authenticator.").then(() => {
if (window.testRunner)
testRunner.cleanUpKeychain(testRpId, credentialIDBase64);
});
Modified: branches/safari-612-branch/LayoutTests/http/wpt/webauthn/public-key-credential-create-failure-local.https.html (284837 => 284838)
--- branches/safari-612-branch/LayoutTests/http/wpt/webauthn/public-key-credential-create-failure-local.https.html 2021-10-25 21:51:20 UTC (rev 284837)
+++ branches/safari-612-branch/LayoutTests/http/wpt/webauthn/public-key-credential-create-failure-local.https.html 2021-10-25 21:51:24 UTC (rev 284838)
@@ -48,7 +48,7 @@
};
if (window.testRunner)
testRunner.addTestKeyToKeychain(privateKeyBase64, testRpId, testUserEntityBundleBase64);
- return promiseRejects(t, "NotAllowedError", navigator.credentials.create(options), "At least one credential matches an entry of the excludeCredentials list in the platform attached authenticator.").then(() => {
+ return promiseRejects(t, "InvalidStateError", navigator.credentials.create(options), "At least one credential matches an entry of the excludeCredentials list in the platform attached authenticator.").then(() => {
if (window.testRunner)
testRunner.cleanUpKeychain(testRpId, credentialIDBase64);
});
@@ -81,7 +81,7 @@
};
if (window.testRunner)
testRunner.addTestKeyToKeychain(privateKeyBase64, testRpId, testUserEntityBundleBase64);
- return promiseRejects(t, "NotAllowedError", navigator.credentials.create(options), "At least one credential matches an entry of the excludeCredentials list in the platform attached authenticator.").then(() => {
+ return promiseRejects(t, "InvalidStateError", navigator.credentials.create(options), "At least one credential matches an entry of the excludeCredentials list in the platform attached authenticator.").then(() => {
if (window.testRunner)
testRunner.cleanUpKeychain(testRpId, credentialIDBase64);
});
Modified: branches/safari-612-branch/Source/WebKit/ChangeLog (284837 => 284838)
--- branches/safari-612-branch/Source/WebKit/ChangeLog 2021-10-25 21:51:20 UTC (rev 284837)
+++ branches/safari-612-branch/Source/WebKit/ChangeLog 2021-10-25 21:51:24 UTC (rev 284838)
@@ -1,5 +1,81 @@
2021-10-25 Null <[email protected]>
+ Cherry-pick r284532. rdar://problem/84625267
+
+ Source/WebKit:
+ [WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
+ https://bugs.webkit.org/show_bug.cgi?id=219813
+ <rdar://problem/72484635>
+
+ Patch by John Pascoe <[email protected]> on 2021-10-20
+ Reviewed by Brent Fulgham.
+
+ Currently, whenever the platform authenticator is within excludedCredentials during makeCredential we
+ always return NotAllowedError and merely flash a consent screen. This does not match the spec per Step 3.1
+ of makeCredential (https://w3c.github.io/webauthn/#sctn-op-make-cred). Instead, we should always obtain consent
+ and return a different error depending on consent was obtained.
+
+ A fixme to add this was inadvertently removed in https://bugs.webkit.org/attachment.cgi?id=393180&action=""
+
+ Added api test TestWebKitAPI.WebAuthenticationPanel.LADuplicateCredentialWithConsent
+
+ * UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm:
+ (WebKit::LocalAuthenticator::makeCredential):
+
+ Tools:
+ [WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
+ https://bugs.webkit.org/show_bug.cgi?id=219813
+ <rdar://problem/72484635>
+
+ Patch by John Pascoe <[email protected]> on 2021-10-20
+ Reviewed by Brent Fulgham.
+
+ Currently, whenever the platform authenticator is within excludedCredentials during makeCredential we
+ always return NotAllowedError and merely flash a consent screen. This does not match the spec per Step 3.1
+ of makeCredential (https://w3c.github.io/webauthn/#sctn-op-make-cred). Instead, we should always obtain consent
+ and return a different error depending on consent was obtained.
+
+ This adds a test to confirm a different path is taken whenever consent is obtained.
+
+ * TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm:
+ (TestWebKitAPI::TEST):
+
+ LayoutTests:
+ WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
+ https://bugs.webkit.org/show_bug.cgi?id=219813
+ <rdar://problem/72484635>
+
+ Patch by John Pascoe <[email protected]> on 2021-10-20
+ Reviewed by Brent Fulgham.
+
+ Modify layout tests to reflect different exception returned when consent is provided
+
+ * http/wpt/webauthn/public-key-credential-create-failure-local-silent.https.html:
+ * http/wpt/webauthn/public-key-credential-create-failure-local.https.html:
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@284532 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2021-10-20 John Pascoe <[email protected]>
+ [WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
+ https://bugs.webkit.org/show_bug.cgi?id=219813
+ <rdar://problem/72484635>
+
+ Reviewed by Brent Fulgham.
+
+ Currently, whenever the platform authenticator is within excludedCredentials during makeCredential we
+ always return NotAllowedError and merely flash a consent screen. This does not match the spec per Step 3.1
+ of makeCredential (https://w3c.github.io/webauthn/#sctn-op-make-cred). Instead, we should always obtain consent
+ and return a different error depending on consent was obtained.
+
+ A fixme to add this was inadvertently removed in https://bugs.webkit.org/attachment.cgi?id=393180&action=""
+
+ Added api test TestWebKitAPI.WebAuthenticationPanel.LADuplicateCredentialWithConsent
+
+ * UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm:
+ (WebKit::LocalAuthenticator::makeCredential):
+
+2021-10-25 Null <[email protected]>
+
Cherry-pick r284294. rdar://problem/84630302
[iOS] Screen Sharing doesn't switch to AirPlay when <video> enters fullscreen mode
Modified: branches/safari-612-branch/Source/WebKit/UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm (284837 => 284838)
--- branches/safari-612-branch/Source/WebKit/UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm 2021-10-25 21:51:20 UTC (rev 284837)
+++ branches/safari-612-branch/Source/WebKit/UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm 2021-10-25 21:51:24 UTC (rev 284838)
@@ -235,7 +235,18 @@
ASSERT(rawId);
return excludeCredentialIds.contains(base64EncodeToString(rawId->data(), rawId->byteLength()));
})) {
- receiveException({ NotAllowedError, "At least one credential matches an entry of the excludeCredentials list in the platform attached authenticator."_s }, WebAuthenticationStatus::LAExcludeCredentialsMatched);
+ // Obtain consent per Step 3.1
+ auto callback = [weakThis = WeakPtr { *this }] (LocalAuthenticatorPolicy policy) {
+ ASSERT(RunLoop::isMain());
+ if (!weakThis)
+ return;
+
+ if (policy == LocalAuthenticatorPolicy::Allow)
+ weakThis->receiveException({ InvalidStateError, "At least one credential matches an entry of the excludeCredentials list in the platform attached authenticator."_s }, WebAuthenticationStatus::LAExcludeCredentialsMatched);
+ else
+ weakThis->receiveException({ NotAllowedError, "This request has been cancelled by the user."_s });
+ };
+ observer()->decidePolicyForLocalAuthenticator(WTFMove(callback));
return;
}
}
Modified: branches/safari-612-branch/Tools/ChangeLog (284837 => 284838)
--- branches/safari-612-branch/Tools/ChangeLog 2021-10-25 21:51:20 UTC (rev 284837)
+++ branches/safari-612-branch/Tools/ChangeLog 2021-10-25 21:51:24 UTC (rev 284838)
@@ -1,5 +1,79 @@
2021-10-25 Null <[email protected]>
+ Cherry-pick r284532. rdar://problem/84625267
+
+ Source/WebKit:
+ [WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
+ https://bugs.webkit.org/show_bug.cgi?id=219813
+ <rdar://problem/72484635>
+
+ Patch by John Pascoe <[email protected]> on 2021-10-20
+ Reviewed by Brent Fulgham.
+
+ Currently, whenever the platform authenticator is within excludedCredentials during makeCredential we
+ always return NotAllowedError and merely flash a consent screen. This does not match the spec per Step 3.1
+ of makeCredential (https://w3c.github.io/webauthn/#sctn-op-make-cred). Instead, we should always obtain consent
+ and return a different error depending on consent was obtained.
+
+ A fixme to add this was inadvertently removed in https://bugs.webkit.org/attachment.cgi?id=393180&action=""
+
+ Added api test TestWebKitAPI.WebAuthenticationPanel.LADuplicateCredentialWithConsent
+
+ * UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm:
+ (WebKit::LocalAuthenticator::makeCredential):
+
+ Tools:
+ [WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
+ https://bugs.webkit.org/show_bug.cgi?id=219813
+ <rdar://problem/72484635>
+
+ Patch by John Pascoe <[email protected]> on 2021-10-20
+ Reviewed by Brent Fulgham.
+
+ Currently, whenever the platform authenticator is within excludedCredentials during makeCredential we
+ always return NotAllowedError and merely flash a consent screen. This does not match the spec per Step 3.1
+ of makeCredential (https://w3c.github.io/webauthn/#sctn-op-make-cred). Instead, we should always obtain consent
+ and return a different error depending on consent was obtained.
+
+ This adds a test to confirm a different path is taken whenever consent is obtained.
+
+ * TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm:
+ (TestWebKitAPI::TEST):
+
+ LayoutTests:
+ WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
+ https://bugs.webkit.org/show_bug.cgi?id=219813
+ <rdar://problem/72484635>
+
+ Patch by John Pascoe <[email protected]> on 2021-10-20
+ Reviewed by Brent Fulgham.
+
+ Modify layout tests to reflect different exception returned when consent is provided
+
+ * http/wpt/webauthn/public-key-credential-create-failure-local-silent.https.html:
+ * http/wpt/webauthn/public-key-credential-create-failure-local.https.html:
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@284532 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2021-10-20 John Pascoe <[email protected]>
+ [WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
+ https://bugs.webkit.org/show_bug.cgi?id=219813
+ <rdar://problem/72484635>
+
+ Reviewed by Brent Fulgham.
+
+ Currently, whenever the platform authenticator is within excludedCredentials during makeCredential we
+ always return NotAllowedError and merely flash a consent screen. This does not match the spec per Step 3.1
+ of makeCredential (https://w3c.github.io/webauthn/#sctn-op-make-cred). Instead, we should always obtain consent
+ and return a different error depending on consent was obtained.
+
+ This adds a test to confirm a different path is taken whenever consent is obtained.
+
+ * TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm:
+ (TestWebKitAPI::TEST):
+
+2021-10-25 Null <[email protected]>
+
Cherry-pick r283515. rdar://problem/84624826
[WebAuthn] Prefer internal user verification if available over pin entry.
Modified: branches/safari-612-branch/Tools/TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm (284837 => 284838)
--- branches/safari-612-branch/Tools/TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm 2021-10-25 21:51:20 UTC (rev 284837)
+++ branches/safari-612-branch/Tools/TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm 2021-10-25 21:51:24 UTC (rev 284838)
@@ -1384,6 +1384,29 @@
ASSERT_TRUE(addKeyToKeychain(testES256PrivateKeyBase64, "", testUserEntityBundleBase64));
[webView loadRequest:[NSURLRequest requestWithURL:testURL.get()]];
+ Util::run(&webAuthenticationPanelFailed);
+ cleanUpKeychain("");
+}
+
+TEST(WebAuthenticationPanel, LADuplicateCredentialWithConsent)
+{
+ reset();
+ RetainPtr<NSURL> testURL = [[NSBundle mainBundle] URLForResource:@"web-authentication-make-credential-la-duplicate-credential" withExtension:@"html" subdirectory:@"TestWebKitAPI.resources"];
+
+ auto *configuration = [WKWebViewConfiguration _test_configurationWithTestPlugInClassName:@"WebProcessPlugInWithInternals" configureJSCForTesting:YES];
+ [[configuration preferences] _setEnabled:YES forExperimentalFeature:webAuthenticationExperimentalFeature()];
+ [[configuration preferences] _setEnabled:NO forExperimentalFeature:webAuthenticationModernExperimentalFeature()];
+
+ auto webView = adoptNS([[TestWKWebView alloc] initWithFrame:NSZeroRect configuration:configuration]);
+ auto delegate = adoptNS([[TestWebAuthenticationPanelUIDelegate alloc] init]);
+ [webView setUIDelegate:delegate.get()];
+ [webView focus];
+
+ ASSERT_TRUE(addKeyToKeychain(testES256PrivateKeyBase64, "", testUserEntityBundleBase64));
+
+ localAuthenticatorPolicy = _WKLocalAuthenticatorPolicyAllow;
+
+ [webView loadRequest:[NSURLRequest requestWithURL:testURL.get()]];
Util::run(&webAuthenticationPanelUpdateLAExcludeCredentialsMatched);
cleanUpKeychain("");
}
