Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 937bbd7aea09c489b1aa36657ed464bc8bcfb64f
https://github.com/WebKit/WebKit/commit/937bbd7aea09c489b1aa36657ed464bc8bcfb64f
Author: Chris Dumez <[email protected]>
Date: 2026-06-29 (Mon, 29 Jun 2026)
Changed paths:
A LayoutTests/ipc/networkstoragemanager-putoradd-nullptr-key-expected.txt
A LayoutTests/ipc/networkstoragemanager-putoradd-nullptr-key.html
M Source/WebCore/Modules/indexeddb/IDBKeyData.h
M Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp
Log Message:
-----------
[IndexedDB] IDBKeyData validation on CoreIPC should reject invalid key types
https://bugs.webkit.org/show_bug.cgi?id=314538
rdar://174499511
Reviewed by Sihui Liu.
IDBKeyData implements CustomHashTraits, and IDBKeyDataHashTraits uses the
std::nullptr_t variant (IDBKeyData::isNull()) as the HashMap empty value.
A compromised WebContent process can send PutOrAdd with an IDBKeyData
whose variant is std::nullptr_t; the message passes IPC decoding and
reaches MemoryObjectStore::addRecord, which inserts the key into
m_keyValueStore — a HashMap whose empty sentinel is exactly that value —
crashing the Network process via the HashMap key validation RELEASE_ASSERT.
The IDBKeyData::Invalid variant is similarly unusable as a HashMap key.
Add a MESSAGE_CHECK at the putOrAdd handler that keyData is either a
placeholder or a valid key. IDBTransaction::putOrAdd sends a placeholder
(nullptr_t + isPlaceholder=true) for auto-generated keys, which is
replaced with the generated key on the server side before any HashMap
insertion, so placeholders are exempt. The check cannot be hoisted into
the IDBKeyData IPC validator because std::nullptr_t and Invalid variants
have legitimate non-placeholder IPC uses (e.g. IDBCursor::advance sends
a null IDBKeyData as the "no search key" sentinel; Invalid IDBKeyData
can come from detached-ArrayBuffer index keys in multi-entry indexes).
Test: ipc/networkstoragemanager-putoradd-nullptr-key.html
* LayoutTests/ipc/networkstoragemanager-putoradd-nullptr-key-expected.txt:
Added.
* LayoutTests/ipc/networkstoragemanager-putoradd-nullptr-key.html: Added.
* Source/WebCore/Modules/indexeddb/IDBKeyData.h:
* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp:
(WebKit::NetworkStorageManager::putOrAdd):
Originally-landed-as: 305413.887@safari-7624-branch (7cf0b2823ce9).
rdar://180428546
Canonical link: https://commits.webkit.org/316061@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
