Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d7c0b5ae247bd01a12f6741b142f8e6b5aeaeda8
https://github.com/WebKit/WebKit/commit/d7c0b5ae247bd01a12f6741b142f8e6b5aeaeda8
Author: Anthony Tarbinian <[email protected]>
Date: 2026-06-29 (Mon, 29 Jun 2026)
Changed paths:
A
LayoutTests/http/tests/navigation/cross-origin-iframe-fragment-navigation-onload-url-leak-expected.txt
A
LayoutTests/http/tests/navigation/cross-origin-iframe-fragment-navigation-onload-url-leak.html
M
LayoutTests/http/tests/navigation/cross-origin-iframe-location-hash-reexecute-onload.html
M
LayoutTests/http/tests/navigation/cross-origin-navigation-fires-onload.html
M Source/WebCore/loader/FrameLoader.cpp
M Source/WebCore/loader/FrameLoader.h
Log Message:
-----------
Fire async load event to prevent guessing a cross-origin iframe's URL
https://bugs.webkit.org/show_bug.cgi?id=316653
rdar://179100444
Reviewed by Charlie Wolfe.
Currently, the URL of a cross-origin iframe can be guessed based
on the timing of a load event of a same-document navigation.
Before this patch, WebKit fires a synthetic load event when a
cross-origin frame is navigated to the same-document (see
FrameLoader::loadInSameDocument from https://commits.webkit.org/259384@main ).
However, this load event fires immediately and synchronously.
So from JS, the timing of this immediate load event could be noticed
and used as an oracle to determine if a cross-origin iframe is a the
same URL as the navigation destination.
This patch adds a delayed timer before firing the load event
when a cross-origin parent initiates a same-document navigation.
This fix is similar to what is described in
https://chromium-review.googlesource.com/c/chromium/src/+/7560041
Test:
http/tests/navigation/cross-origin-iframe-fragment-navigation-onload-url-leak.html
*
LayoutTests/http/tests/navigation/cross-origin-iframe-fragment-navigation-onload-url-leak-expected.txt:
Added.
*
LayoutTests/http/tests/navigation/cross-origin-iframe-fragment-navigation-onload-url-leak.html:
Added.
*
LayoutTests/http/tests/navigation/cross-origin-iframe-location-hash-reexecute-onload.html:
Added delay to wait for delayed load
* LayoutTests/http/tests/navigation/cross-origin-navigation-fires-onload.html:
Added delay to wait for delayed load
* Source/WebCore/loader/FrameLoader.cpp:
(WebCore::FrameLoader::FrameLoader):
Initialize timer
(WebCore::FrameLoader::clear):
Stop timer
(WebCore::FrameLoader::startCrossOriginParentSyntheticSameDocLoadEventTimer):
Start a new timer and cancel an existing one, if any.
(WebCore::FrameLoader::crossOriginParentSyntheticSameDocLoadEventTimerFired):
Dispatch load event when timer fires
(WebCore::FrameLoader::loadInSameDocument):
Start timer
(WebCore::FrameLoader::stopAllLoadersAndCheckCompleteness):
Stop timer
(WebCore::FrameLoader::frameDetached):
Stop timer
(WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
Stop timer
* Source/WebCore/loader/FrameLoader.h:
Canonical link: https://commits.webkit.org/316098@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
