Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 64315b6f7b375021083fe772cf91baca65617cb1
https://github.com/WebKit/WebKit/commit/64315b6f7b375021083fe772cf91baca65617cb1
Author: Rupin Mittal <[email protected]>
Date: 2026-06-29 (Mon, 29 Jun 2026)
Changed paths:
M Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp
Log Message:
-----------
WebResourceLoader::WillSendRequest reply may lead to cross-origin cookie
access
https://bugs.webkit.org/show_bug.cgi?id=313866
rdar://174663032
Reviewed by Per Arne Vollan.
Consider this sequence of events:
1. A compromised web process schedules a load with its own origin used for
firstPartyForCookies.
2. NetworkConnectionToWebProcess::scheduleResourceLoad() is called and the
message check passes.
3. The request goes through and the server responds with 302 (redirect).
4. NetworkResourceLoader::continueWillSendRedirectedRequest() calls
WebResourceLoader::WillSendRequest() which gives the web process the chance
to alter the request that will be sent to perform the redirect.
5. The compromised web process alters the request so that firstPartyForCookies
is now a different origin.
6. NetworkResourceLoader::continueWillSendRequest() receives this altered
request and passes it off to CFNetwork.
7. The result of this request is that the compromised web process receives
the cookies of this different origin.
There are multiple callsites of continueWillSendRequest(), but only one place
which allows the web process to alter the request before it's given to
continueWillSendRequest(). So we fix this by adding a message check right
before that callsite that will double check that the origin contained in this
potentially modified request from the web process is in this web process's
allowed list. If not, the web process will be killed so that it doesn't recieve
the cross-origin cookies.
We also only do this message check if the web process actually changes the
origin. This is because there are cases where the origin is not yet in the
allowlist but not because the web process modified it (like in:
imported/w3c/web-platform-tests/speculation-rules/prefetch/redirect-url.https.html?origin=cross-site-redirect
where there is a cross-site redirect as part of a prefetch, so the cross-site
origin is supplied by the server but hasn't made it into the allow list since
the navigation to it is not complete).
* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:
(WebKit::NetworkResourceLoader::continueWillSendRedirectedRequest):
Originally-landed-as: 305413.834@safari-7624-branch (9fd9439df22f).
rdar://180437365
Canonical link: https://commits.webkit.org/316046@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
