Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 0eed6a8c1241dffc62afee534ac2d2b1078b015b
https://github.com/WebKit/WebKit/commit/0eed6a8c1241dffc62afee534ac2d2b1078b015b
Author: Cole Carley <[email protected]>
Date: 2026-01-30 (Fri, 30 Jan 2026)
Changed paths:
M Source/WebCore/page/PerformanceResourceTiming.cpp
Log Message:
-----------
Fix PerformanceResourceTiming TAO checks on same origin requests
https://bugs.webkit.org/show_bug.cgi?id=306585
rdar://169229697
Reviewed by Alex Christensen.
The issue was that PerformanceResourceTiming:: transferSize, encodedBodySize,
and decodedBodySize must
return 0 on a TAO failure. There were concerns about timing attacks which was
addressed here:
https://commits.webkit.org/254922@main. The change returns 0 when the request
is not same origin.
The problem is that same origin request can fail TAO checks. I fixed this by
returning 0 on a TAO
failure even in same origin requests.
* Source/WebCore/page/PerformanceResourceTiming.cpp:
(WebCore::PerformanceResourceTiming::transferSize const):
(WebCore::PerformanceResourceTiming::encodedBodySize const):
(WebCore::PerformanceResourceTiming::decodedBodySize const):
Canonical link: https://commits.webkit.org/306524@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
