Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 7935a51ec31047310970afdf9c0a73765686058d
https://github.com/WebKit/WebKit/commit/7935a51ec31047310970afdf9c0a73765686058d
Author: Basuke Suzuki <[email protected]>
Date: 2026-07-16 (Thu, 16 Jul 2026)
Changed paths:
M Source/WebCore/loader/PolicyChecker.cpp
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/Download.mm
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm
Log Message:
-----------
[Page Loading] Network process crashes when downloading a cross-origin
target=_blank link
https://bugs.webkit.org/show_bug.cgi?id=319427
rdar://182181803
Reviewed by Chris Dumez.
Option-clicking a cross-origin link with target="_blank" (for example the "Full
logs"
link on an ews-build.webkit.org results page, which points to an S3 URL)
reliably
terminates the Network process.
PolicyChecker::checkNewWindowPolicy() handles new-window (target="_blank")
navigations. Its
PolicyAction::Download case called FrameLoaderClient::startDownload() without
first calling
FrameLoader::setOriginalURLForDownloadRequest(), unlike the same-frame path in
checkNavigationPolicy(). As a result the download request kept the
firstPartyForCookies that
FrameLoader sets for a willOpenInNewWindow main-resource load, which is the
destination URL
itself (the cross-origin URL). The StartDownload IPC is then sent from the
source page's web
process, whose allowed-first-parties set only contains the source site, so the
CSRF
first-party-for-cookies MESSAGE_CHECK in
NetworkConnectionToWebProcess::startDownload()
rejected the message and terminated the process.
Call setOriginalURLForDownloadRequest() in checkNewWindowPolicy()'s download
case, matching
checkNavigationPolicy(). Because m_frame is the source frame,
firstPartyForCookies becomes the
originating page, which is in the process's allowed set.
* Source/WebCore/loader/PolicyChecker.cpp:
(WebCore::PolicyChecker::checkNewWindowPolicy):
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/Download.mm:
(TestWebKitAPI::TEST): Added
CrossSiteTargetBlankDownloadDoesNotCrashNetworkProcess.
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:
(TestWebKitAPI::TEST): Added
CrossSiteTargetBlankDownloadDoesNotCrashNetworkProcess.
Canonical link: https://commits.webkit.org/317338@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
