Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 89fdf3d120e33378db776d04a73d6b13766d8bbd
https://github.com/WebKit/WebKit/commit/89fdf3d120e33378db776d04a73d6b13766d8bbd
Author: Sihui Liu <[email protected]>
Date: 2026-07-28 (Tue, 28 Jul 2026)
Changed paths:
M Source/WebCore/editing/cocoa/AutofillElements.cpp
M Source/WebCore/html/HTMLInputElement.cpp
M Source/WebCore/html/HTMLInputElement.h
M Source/WebCore/page/ChromeClient.h
M Source/WebKit/Sources.txt
M Source/WebKit/UIProcess/API/Cocoa/WKWebsiteDataStore.mm
M Source/WebKit/UIProcess/API/Cocoa/WKWebsiteDataStorePrivate.h
M Source/WebKit/UIProcess/BrowsingContextGroup.cpp
M Source/WebKit/UIProcess/WebProcessProxy.cpp
M Source/WebKit/UIProcess/WebProcessProxy.h
M Source/WebKit/UIProcess/WebProcessProxy.messages.in
A Source/WebKit/UIProcess/WebsiteData/IsolatedSiteStore.cpp
A Source/WebKit/UIProcess/WebsiteData/IsolatedSiteStore.h
M Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.cpp
M Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.h
M Source/WebKit/WebKit.xcodeproj/project.pbxproj
M Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp
M Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.h
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/UserContentController.mm
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ios/WKWebViewAutofillTests.mm
Log Message:
-----------
[Site Isolation] Autofilled sites should not enter shared process
https://bugs.webkit.org/show_bug.cgi?id=320396
rdar://183351796
Reviewed by Ryosuke Niwa.
Site Isolation's shared process mode puts multiple cross-site frames into one
WebProcess for performance, trading away
some of the process-boundary protection between the co-located sites. Sites
that are likely to contains sensitive data
or capabilities should not be put in the shared process. We currently use user
interaction as indicator, but there are
better signals, like whether user has used autofill on the site to fill in
credentials. This patch introduces a new
per-session, in-memory IsolatedSiteStore to store these important sites.
BrowsingContextGroup::sharedProcessForSite
now consults it and will not put any site it flags in shared process.
In the initial version of IsolatedSiteStore, a site is recorded via two paths
that both funnel through
HTMLInputElement::didCompleteAutofill(), which calls
ChromeClient::didCompleteAutofill():
- Native autofill: AutofillElements::autofill() calls didCompleteAutofill()
after filling in a non-empty
username/password.
- Scripted autofill: HTMLInputElement::setAutofilled(bool) calls
didCompleteAutofill() when the field
transitions to autofilled. This is reached by real autofill agents via the
existing [EnabledForWorld=allowAutofill]
autofilled IDL attribute, which is only reachable from a JS world with
allowAutofill() set. Hooking into this existing,
narrowly-scoped setter avoids adding any overhead to HTMLInputElement's value
setter.
WebChromeClient::didCompleteAutofill computes the WebCore::Site for the input's
document and sends it to the UI process
via the new WebProcessProxy::DidCompleteAutofill IPC message, which forwards it
to WebsiteDataStore's
IsolatedSiteStore::addSite(). The IPC message and IsolatedSiteStore's interface
intentionally carry WebCore::Site
rather than RegistrableDomain so scheme information isn't discarded before it
crosses the process boundary, even though
the store's internal map is currently keyed by domain only.
Added WKWebsiteDataStore._isIsolatedSiteForTesting: SPI to observe this from
tests, and covered both the native-autofill
(iOS) and scripted-autofill (macOS) paths with new API tests.
API tests: WKWebViewAutoFillTests.AutofillMarksSiteAsIsolated
WKUserContentController.AutofillScriptingMarksSiteAsIsolated
* Source/WebCore/editing/cocoa/AutofillElements.cpp:
(WebCore::AutofillElements::autofill):
* Source/WebCore/html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::setAutofilled):
(WebCore::HTMLInputElement::didCompleteAutofill):
* Source/WebCore/html/HTMLInputElement.h:
* Source/WebCore/page/ChromeClient.h:
(WebCore::ChromeClient::didCompleteAutofill):
* Source/WebKit/Sources.txt:
* Source/WebKit/UIProcess/API/Cocoa/WKWebsiteDataStore.mm:
(-[WKWebsiteDataStore _isIsolatedSiteForTesting:]):
* Source/WebKit/UIProcess/API/Cocoa/WKWebsiteDataStorePrivate.h:
* Source/WebKit/UIProcess/BrowsingContextGroup.cpp:
(WebKit::BrowsingContextGroup::sharedProcessForSite):
* Source/WebKit/UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::didCompleteAutofill):
* Source/WebKit/UIProcess/WebProcessProxy.h:
* Source/WebKit/UIProcess/WebProcessProxy.messages.in:
* Source/WebKit/UIProcess/WebsiteData/IsolatedSiteStore.cpp: Added.
(WebKit::IsolatedSiteStore::addSite):
(WebKit::IsolatedSiteStore::reasonsFor const):
(WebKit::IsolatedSiteStore::contains const):
* Source/WebKit/UIProcess/WebsiteData/IsolatedSiteStore.h: Added.
* Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.cpp:
(WebKit::WebsiteDataStore::isIsolatedSiteForTesting const):
* Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.h:
(WebKit::WebsiteDataStore::isolatedSiteStore):
* Source/WebKit/WebKit.xcodeproj/project.pbxproj:
* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp:
(WebKit::WebChromeClient::didCompleteAutofill):
* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.h:
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/UserContentController.mm:
(TEST(WKUserContentController, AutofillScriptingMarksSiteAsIsolated)):
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ios/WKWebViewAutofillTests.mm:
(TestWebKitAPI::TEST(WKWebViewAutoFillTests, AutofillMarksSiteAsIsolated)):
Canonical link: https://commits.webkit.org/318135@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
