Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 6703af8d68a100de6bee755fb1887b10a5b2756b
https://github.com/WebKit/WebKit/commit/6703af8d68a100de6bee755fb1887b10a5b2756b
Author: Charlie Wolfe <[email protected]>
Date: 2026-07-01 (Wed, 01 Jul 2026)
Changed paths:
M Source/WebCore/loader/NavigationAction.cpp
M Source/WebCore/loader/NavigationAction.h
M Source/WebKit/Shared/NavigationActionData.h
M Source/WebKit/Shared/NavigationActionData.serialization.in
M Source/WebKit/UIProcess/API/APINavigation.h
M Source/WebKit/UIProcess/WebProcessPool.cpp
M Source/WebKit/UIProcess/win/AutomationSessionClientWin.cpp
M Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp
M Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
M Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.cpp
Log Message:
-----------
Remove treatAsSameOriginNavigation from NavigationActionData IPC
https://bugs.webkit.org/show_bug.cgi?id=312445
rdar://174702490
Reviewed by Rupin Mittal.
A compromised WebContent process could forge treatAsSameOriginNavigation in
DecidePolicyForNavigationAction to skip the cross-site process swap in
processForNavigationInternal.
Remove the field from NavigationActionData, NavigationAction, and
API::Navigation, and compute it
directly in processForNavigationInternal from the target URL protocol and the
UIProcess-owned
sourceURL.
* Source/WebCore/loader/NavigationAction.cpp:
(WebCore::shouldTreatAsSameOriginNavigation): Deleted.
* Source/WebCore/loader/NavigationAction.h:
(WebCore::NavigationAction::treatAsSameOriginNavigation const): Deleted.
* Source/WebKit/Shared/NavigationActionData.h:
* Source/WebKit/Shared/NavigationActionData.serialization.in:
* Source/WebKit/UIProcess/API/APINavigation.h:
(API::Navigation::treatAsSameOriginNavigation const): Deleted.
* Source/WebKit/UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::processForNavigationInternal):
* Source/WebKit/UIProcess/win/AutomationSessionClientWin.cpp:
(WebKit::AutomationSessionClient::requestNewPageWithOptions):
* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp:
(WebKit::WebChromeClient::createWindow):
* Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
(WebKit::WebFrameLoaderClient::navigationActionData const):
* Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.cpp:
(WebKit::WebLocalFrameLoaderClient::didSameDocumentNavigationForFrameViaJS):
(WebKit::WebLocalFrameLoaderClient::dispatchDecidePolicyForNewWindowAction):
Originally-landed-as: 305413.684@safari-7624-branch (8bb359efde80).
rdar://180435329
Canonical link: https://commits.webkit.org/316244@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
