Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e2b88c2f80488fed156450007f317f5ff0e564f4
https://github.com/WebKit/WebKit/commit/e2b88c2f80488fed156450007f317f5ff0e564f4
Author: Anthony Tarbinian <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
A
LayoutTests/ipc/networksindexeddb-close-connection-during-version-change-expected.txt
A
LayoutTests/ipc/networksindexeddb-close-connection-during-version-change.html
M Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.cpp
M Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.h
M Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp
Log Message:
-----------
Reject IndexedDB transactions during version change operation
https://bugs.webkit.org/show_bug.cgi?id=312391
rdar://173799670
Reviewed by Sihui Liu.
When an IndexedDB connection is closed while a version
change transaction is active, UniqueIDBDatabase::connectionClosedFromClient
successfully closes the version change transaction however it does
not clear any other pending transactions due to an early return
when clearing version change transactions.
Instead of being defensive and clearing the pending transaciton
in the case of the early return, we should reject any incoming
transactions which come on a version change connection.
Only whenever a version change operation completes, can
a new transaction be established. So, this patch rejects any
incoming transactions which come while a version change operation
is active.
The IndexedDB spec describes the steps for starting a new transaction:
The transaction(storeNames, mode, options) method steps are:
1. If a live upgrade transaction is associated with the connection,
throw an "InvalidStateError" DOMException.
https://w3c.github.io/IndexedDB/#dom-idbdatabase-transaction
This check already happens in the web process during
IDBDatabase::transaction where it returns an "InvalidStateError"
in this state.
However, this doesn't account for a compromised web process
who avoids this client side check and makes it across IPC
to invoke transaction creation in the NetworkProcess.
This patch adds a check for this scenario of a comprimised web
process who manages to start a new transaction during a
version change, if this is detected, we return early and
don't move forward with creating the transaction
This patch checks that the current connection isn't the
stored UniqueIDBDatabase::m_versionChangeDatabaseConnection.
That member variable will point to the active version change connection,
if any, and it is cleared when the version change completes.
It also checks if m_versionChangeTransaction is non-null
since it will only be null once the version change transaction
is completed.
*
LayoutTests/ipc/networksindexeddb-close-connection-during-version-change-expected.txt:
Added.
*
LayoutTests/ipc/networksindexeddb-close-connection-during-version-change.html:
Added.
* Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.cpp:
(WebCore::IDBServer::UniqueIDBDatabase::isVersionChangeTransactionActive const):
* Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.h:
* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp:
(WebKit::NetworkStorageManager::establishTransaction):
(WebKit::NetworkStorageManager::databaseConnectionPendingClose):
Originally-landed-as: 305413.734@safari-7624-branch (6b2393e40648).
rdar://180437837
Canonical link: https://commits.webkit.org/316133@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
