Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: a38f039d8f8a22dd138a45c0f8d33b9dc8528c9d
https://github.com/WebKit/WebKit/commit/a38f039d8f8a22dd138a45c0f8d33b9dc8528c9d
Author: Chris Dumez <[email protected]>
Date: 2026-06-29 (Mon, 29 Jun 2026)
Changed paths:
M Source/WebKit/Shared/Cocoa/CoreIPCNSURLRequest.mm
Log Message:
-----------
[CoreIPC] [NP] CoreIPCNSURLRequest bodyParts Forwarded to CFNetwork Leads to
Arbitrary File Exfiltration
https://bugs.webkit.org/show_bug.cgi?id=312553
rdar://174708131
Reviewed by Brady Eidson.
In the macOS 15+ / iOS 18+ secure-coding path
(HAVE_WK_SECURE_CODING_NSURLREQUEST),
CoreIPCNSURLRequest forwards fields from the decoded IPC message into
-[NSURLRequest _initWithWebKitPropertyListData:] inside NetworkProcess.
CFNetwork
interprets NSString entries in bodyParts as POSIX file paths
(CFURLCreateWithFileSystemPath -> CFReadStreamCreateWithFile), so a compromised
WebContent process could exfiltrate any NetworkProcess-readable file by
injecting
arbitrary paths into bodyParts.
The legitimate encoder in ResourceRequestCocoa.mm already clears the HTTP body
before serialization (setHTTPBody:nil / setHTTPBodyStream:nil at lines 127-128),
so body and bodyParts are normally empty in the serialized NSURLRequest.
However,
that strip is encoder-side only and a compromised WebContent process can
populate
these fields directly on the wire. The HTTP body is carried separately via
WebCore::FormData which has its own validation.
Stop extracting body and bodyParts on the encoder side; stop forwarding them on
the receiver side in toID(); add assertions that they remain empty.
* Source/WebKit/Shared/Cocoa/CoreIPCNSURLRequest.mm:
(WebKit::CoreIPCNSURLRequest::CoreIPCNSURLRequest):
(WebKit::CoreIPCNSURLRequest::toID const):
Originally-landed-as: 305413.696@safari-7624-branch (0df93a7f1b13).
rdar://180428381
Canonical link: https://commits.webkit.org/316056@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
