Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e9f94fd4c6430f0b308c17c22bac8141a1cfdb41
https://github.com/WebKit/WebKit/commit/e9f94fd4c6430f0b308c17c22bac8141a1cfdb41
Author: Chris Dumez <[email protected]>
Date: 2026-06-26 (Fri, 26 Jun 2026)
Changed paths:
A
LayoutTests/ipc/decide-policy-for-navigation-action-cross-page-frame-expected.txt
A LayoutTests/ipc/decide-policy-for-navigation-action-cross-page-frame.html
A LayoutTests/ipc/resources/cross-page-target.html
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
M
Source/WebKit/UIProcess/Cocoa/SOAuthorization/SubFrameSOAuthorizationSession.mm
M Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm
M Source/WebKit/UIProcess/ProvisionalPageProxy.cpp
M Source/WebKit/UIProcess/ProvisionalPageProxy.h
M Source/WebKit/UIProcess/WebBackForwardList.cpp
M Source/WebKit/UIProcess/WebBackForwardList.swift
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/UIProcess/WebPageProxy.h
M Source/WebKit/UIProcess/WebProcessProxy.cpp
M Source/WebKit/UIProcess/WebProcessProxy.h
Log Message:
-----------
[WebKit Process Model] missing sender-ownership validation in 12
process-global identifier-map lookups
https://bugs.webkit.org/show_bug.cgi?id=315535
rdar://176814631
Reviewed by Ben Nham.
Twelve DispatchedFrom=WebContent IPC handlers in UIProcess and
NetworkProcess resolve a WebContent-supplied ObjectIdentifier against a
process-global map (WebFrameProxy::allFrames(), webPageProxyMap(),
WebBackForwardListItem::allItems(), SWServer::m_registrations,
NetworkProcess::m_webProcessConnections) and operate on the result
without checking that the resolved object belongs to the sending
connection / page / process. The identifiers are small monotonic
integers minted in the receiving process, so a compromised WebContent
process can guess a sibling tab's IDs and read or write its
security-relevant state across the WCP->UIP / WCP->NP boundary.
Add MESSAGE_CHECK(frame->page() == this) (or the process-ownership
equivalent) at each affected site so the resolved object is rejected
when it does not belong to the sender, following the existing precedent
in didNavigateWithNavigationDataShared / didPerformClientRedirectShared
/ requestDOMPasteAccess / WebLockRegistryProxy.
Test: ipc/decide-policy-for-navigation-action-cross-page-frame.html
*
LayoutTests/ipc/decide-policy-for-navigation-action-cross-page-frame-expected.txt:
Added.
* LayoutTests/ipc/decide-policy-for-navigation-action-cross-page-frame.html:
Added.
* LayoutTests/ipc/resources/cross-page-target.html: Added.
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::connectToRTCDataChannelRemoteSource):
*
Source/WebKit/UIProcess/Cocoa/SOAuthorization/SubFrameSOAuthorizationSession.mm:
(WebKit::SubFrameSOAuthorizationSession::loadRequestToFrame):
* Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm:
(WebKit::WebPageProxy::contentFilterDidBlockLoadForFrame):
(WebKit::WebPageProxy::contentFilterDidBlockLoadForFrameShared):
* Source/WebKit/UIProcess/ProvisionalPageProxy.cpp:
(WebKit::ProvisionalPageProxy::contentFilterDidBlockLoadForFrame):
* Source/WebKit/UIProcess/ProvisionalPageProxy.h:
* Source/WebKit/UIProcess/WebBackForwardList.cpp:
(WebKit::WebBackForwardList::backForwardAddItemShared):
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::navigationOriginatingPage):
(WebKit::WebPageProxy::decidePolicyForNavigationActionAsync):
(WebKit::WebPageProxy::decidePolicyForNavigationActionSync):
(WebKit::WebPageProxy::decidePolicyForNewWindowAction):
(WebKit::WebPageProxy::willSubmitForm):
(WebKit::WebPageProxy::createNewPage):
(WebKit::WebPageProxy::runJavaScriptAlert):
(WebKit::WebPageProxy::runJavaScriptConfirm):
(WebKit::WebPageProxy::runJavaScriptPrompt):
(WebKit::WebPageProxy::runBeforeUnloadConfirmPanel):
(WebKit::WebPageProxy::runOpenPanel):
(WebKit::WebPageProxy::requestGeolocationPermissionForFrame):
(WebKit::WebPageProxy::requestUserMediaPermissionForFrame):
* Source/WebKit/UIProcess/WebPageProxy.h:
Canonical link: https://commits.webkit.org/315947@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
