Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 5ca4d87ac78cbb8cbb0e7210d91835f8559fab24
https://github.com/WebKit/WebKit/commit/5ca4d87ac78cbb8cbb0e7210d91835f8559fab24
Author: Chris Dumez <[email protected]>
Date: 2026-06-26 (Fri, 26 Jun 2026)
Changed paths:
A LayoutTests/ipc/forged-geolocation-permission-frame-origin-expected.txt
A LayoutTests/ipc/forged-geolocation-permission-frame-origin.html
M Source/WebKit/UIProcess/Cocoa/NavigationState.mm
M Source/WebKit/UIProcess/Cocoa/SOAuthorization/SOAuthorizationSession.mm
M Source/WebKit/UIProcess/GeolocationPermissionRequestManagerProxy.cpp
M Source/WebKit/UIProcess/GeolocationPermissionRequestManagerProxy.h
M Source/WebKit/UIProcess/GeolocationPermissionRequestProxy.cpp
M Source/WebKit/UIProcess/GeolocationPermissionRequestProxy.h
M Source/WebKit/UIProcess/WebGeolocationManagerProxy.cpp
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/PermissionsAPI.mm
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SOAuthorizationTests.mm
Log Message:
-----------
[WebKit Process Model | All] WebContent-supplied origin forwarded to system
service without UI-process re-derivation at 4 sites
https://bugs.webkit.org/show_bug.cgi?id=315534
rdar://176895464
Reviewed by Sihui Liu.
Four UI-process IPC handlers accepted an origin/domain field from a
DispatchedFrom=WebContent message and forwarded it verbatim to a system
service as a per-site authorization key, without comparing it against
UI-process-authoritative state. A compromised WebContent process could
spoof the origin and have CoreLocation / AppSSO / MarketplaceKit / the
geolocation policy decider apply another site's permission decision.
This change re-derives each value from UI-process-authoritative state
(WebFrameProxy::url() / WebFrameProxy::securityOrigin() / the page's
committed main-frame URL) instead of trusting the IPC-supplied field:
- SOAuthorizationSession: derive InitiatorOrigin from
m_page->mainFrame()->url() for all initiating actions, matching the
existing SubFrame override and dropping the read of
NavigationActionData::originatingFrameInfoData.securityOrigin.
- interceptMarketplaceKitNavigation: derive the referrer/top-origin URL
from page.mainFrame()->url() instead of NavigationRequester::topOrigin.
- WebPageProxy::requestGeolocationPermissionForFrame: overwrite
FrameInfoData::securityOrigin with WebFrameProxy::securityOrigin()
(computed UI-side at commit time) before passing it to the embedder,
and MESSAGE_CHECK that the frame resolves. The override is only
applied when the frame's load URL carries a meaningful host, since
some loads (e.g. webarchives loaded from a local file URL) commit a
document whose origin is determined by content the UIProcess cannot
inspect; in that case the WebContent-supplied origin is left in place.
- WebGeolocationManagerProxy::startUpdatingWithProxy: bind the
RegistrableDomain (derived UI-side from the page's committed
main-frame URL at permission-request time) to the authorization token,
and MESSAGE_CHECK that the WebContent-supplied domain in StartUpdating
matches the token's bound domain. When the UI-derived domain is empty
(same webarchive / opaque-document case as above), the equality check
is skipped and the WebContent-supplied domain is accepted, matching
the pre-existing behavior for those edge cases.
Tests: ipc/forged-geolocation-permission-frame-origin.html
Tools/TestWebKitAPI/Tests/WebKitCocoa/SOAuthorizationTests.mm
* LayoutTests/ipc/forged-geolocation-permission-frame-origin-expected.txt:
Added.
* LayoutTests/ipc/forged-geolocation-permission-frame-origin.html: Added.
* Source/WebKit/UIProcess/Cocoa/NavigationState.mm:
(WebKit::interceptMarketplaceKitNavigation):
* Source/WebKit/UIProcess/Cocoa/SOAuthorization/SOAuthorizationSession.mm:
(WebKit::SOAuthorizationSession::continueStartAfterDecidePolicy):
* Source/WebKit/UIProcess/GeolocationPermissionRequestManagerProxy.cpp:
(WebKit::GeolocationPermissionRequestManagerProxy::createRequest):
(WebKit::GeolocationPermissionRequestManagerProxy::didReceiveGeolocationPermissionDecision):
(WebKit::GeolocationPermissionRequestManagerProxy::registrableDomainForAuthorizationToken
const):
* Source/WebKit/UIProcess/GeolocationPermissionRequestManagerProxy.h:
* Source/WebKit/UIProcess/GeolocationPermissionRequestProxy.cpp:
(WebKit::GeolocationPermissionRequestProxy::GeolocationPermissionRequestProxy):
* Source/WebKit/UIProcess/GeolocationPermissionRequestProxy.h:
(WebKit::GeolocationPermissionRequestProxy::create):
* Source/WebKit/UIProcess/WebGeolocationManagerProxy.cpp:
(WebKit::WebGeolocationManagerProxy::startUpdatingWithProxy):
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::requestGeolocationPermissionForFrame):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/SOAuthorizationTests.mm:
(TestWebKitAPI::overrideBeginAuthorizationWithURLAndRecordInitiatorOrigin):
(TestWebKitAPI::TEST(SOAuthorizationRedirect,
InitiatorOriginIgnoresWebProcessSuppliedSourceFrameOrigin)):
Canonical link: https://commits.webkit.org/315884@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
