Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ccf0c4874cb25ab1fac973a60d6f291bc204a44a
https://github.com/WebKit/WebKit/commit/ccf0c4874cb25ab1fac973a60d6f291bc204a44a
Author: Charlie Wolfe <[email protected]>
Date: 2026-07-06 (Mon, 06 Jul 2026)
Changed paths:
A LayoutTests/ipc/load-image-for-decoding-file-url-expected.txt
A LayoutTests/ipc/load-image-for-decoding-file-url.html
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
M Source/WebKit/UIProcess/WebPageProxy.cpp
Log Message:
-----------
Add scheme and cookie access validation to LoadImageForDecoding
https://bugs.webkit.org/show_bug.cgi?id=312832
rdar://174708372
Reviewed by Rupin Mittal.
LoadImageForDecoding accepted arbitrary ResourceRequest fields with only a
url.isValid() check. This
allowed file:// reads of NetworkProcess-sandbox files and credentialed
cross-origin body reads via
spoofed firstPartyForCookies.
Restrict the URL to HTTP(S) and enforce allowsFirstPartyForCookies, matching
every other
cookie-touching IPC entry point.
Test: ipc/load-image-for-decoding-file-url.html
* LayoutTests/ipc/load-image-for-decoding-file-url-expected.txt: Added.
* LayoutTests/ipc/load-image-for-decoding-file-url.html: Added.
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::loadImageForDecoding):
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::loadAndDecodeImage):
Originally-landed-as: 305413.744@safari-7624-branch (f118e35bcfa5).
rdar://180428370
Canonical link: https://commits.webkit.org/316601@main
Commit: 6287cb3802f3ff30f2ded80193898f11478b58f2
https://github.com/WebKit/WebKit/commit/6287cb3802f3ff30f2ded80193898f11478b58f2
Author: Rupin Mittal <[email protected]>
Date: 2026-07-06 (Mon, 06 Jul 2026)
Changed paths:
M Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/LoadAndDecodeImage.mm
Log Message:
-----------
Web content process gets terminated after loading various sites (invalid
message 'NetworkConnectionToWebProcess_LoadImageForDecoding')
https://bugs.webkit.org/show_bug.cgi?id=314261
rdar://176310702
Reviewed by Abrar Rahman Protyasha.
When loading various sites (like github.com), we see that that site will
immediately reload with a message saying that the site reloaded because it
encountered a problem. The web process is crashing after hitting this:
MESSAGE_CHECK_COMPLETION(m_networkProcess->allowsFirstPartyForCookies
(m_webProcessIdentifier, request.firstPartyForCookies()) ==
NetworkProcess::AllowCookieAccess::Allow ...)
in NetworkConnectionToWebProcess::loadImageForDecoding().
The issue is that after the site is loaded, LinkPresentation calls
_loadAndDecodeImage on the WKWebView with a NSURLRequest whose mainDocumentURL
is nil. When _loadAndDecodeImage converts this to a ResourceRequest, the
firstPartyForCookies is null. This ResourceRequest ends up in
loadImageForDecoding where allowsFirstPartyForCookies() returns "disallow"
for a null firstPartyForCookies and so we terminate the web process.
In the past, some of these “== allow” checks we’ve added have caused crashes
like these and have been hard to reproduce since we often only have a stability
tracer crash. So we generally change the check to be “!= terminate” in those
cases. Doing that is not ideal but would fix this crash.
But here, we actually have a reproduction and the root cause. We can fix this
by amending _loadAndDecodeImage to ensure that the NSURLRequest has a
mainDocumentURL when one exists. This will cover LinkPresentation’s callsite
and possibly others.
New test: LoadAndDecodeImageNilMainDocumentURLAfterNavigation.
(Credit to Abrar Protyasha for coming up with the test).
* Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm:
(-[WKWebView
_loadAndDecodeImage:constrainedToSize:maximumBytesFromNetwork:completionHandler:]):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/LoadAndDecodeImage.mm:
(TestWebKitAPI::TEST(WebKit,
LoadAndDecodeImageNilMainDocumentURLAfterNavigation)):
Originally-landed-as: 7744f7322ebb. rdar://181074236
Canonical link: https://commits.webkit.org/316602@main
Commit: cf2d4056d8ec678955f4835232076c3b5194baff
https://github.com/WebKit/WebKit/commit/cf2d4056d8ec678955f4835232076c3b5194baff
Author: Charlie Wolfe <[email protected]>
Date: 2026-07-06 (Mon, 06 Jul 2026)
Changed paths:
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
M Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm
M Source/WebKit/WebProcess/WebPage/WebPage.cpp
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/LoadAndDecodeImage.mm
Log Message:
-----------
com.apple.WebKit.Networking at Received an invalid message
'NetworkConnectionToWebProcess_LoadImageForDecoding'
https://bugs.webkit.org/show_bug.cgi?id=315252
rdar://177568018
Reviewed by Rupin Mittal.
There are two cases where the MESSAGE_CHECK in
NetworkConnectionToWebProcess::loadImageForDecoding
can still fail after the fix in rdar://176310702:
- A client set an incorrect or empty mainDocumentURL.
- A client called _loadAndDecodeImage: on a WKWebView that has not loaded any
content.
Set firstPartyForCookies in the web process from page->mainFrameURL(), which is
the authoritative
value, and drop the WKWebView-side fallback added in the previous fix. When
mainFrameURL is empty
(no navigation has happened yet, so there is no cookie context), disable
cookies for the request
instead of failing the MESSAGE_CHECK.
Test: Tools/TestWebKitAPI/Tests/WebKitCocoa/LoadAndDecodeImage.mm
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::loadImageForDecoding):
* Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm:
(-[WKWebView
_loadAndDecodeImage:constrainedToSize:maximumBytesFromNetwork:completionHandler:]):
* Source/WebKit/WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::loadAndDecodeImage):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/LoadAndDecodeImage.mm:
(TestWebKitAPI::TEST(WebKit, LoadAndDecodeImageBeforeAnyNavigation)):
(TestWebKitAPI::TEST(WebKit,
LoadAndDecodeImageWithCallerProvidedDisallowedMainDocumentURL)):
Originally-landed-as: 305413.944@safari-7624-branch (bc7a427882d4).
rdar://181074279
Canonical link: https://commits.webkit.org/316603@main
Compare: https://github.com/WebKit/WebKit/compare/9f2f1b8a49b7...cf2d4056d8ec
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
