Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: a10139469788ae684435fd2226ee8bc1c322e373
https://github.com/WebKit/WebKit/commit/a10139469788ae684435fd2226ee8bc1c322e373
Author: Franco Vieira de Souza <[email protected]>
Date: 2026-08-08 (Sat, 08 Aug 2026)
Changed paths:
M Source/WebKit/UIProcess/API/APINavigation.h
M Source/WebKit/UIProcess/WebPageProxy.cpp
Log Message:
-----------
Cherry-pick 53ed150fb399. https://bugs.webkit.org/show_bug.cgi?id=313163
Don't block page loading due pending SafeBrowsing result
https://bugs.webkit.org/show_bug.cgi?id=313163
rdar://165058397
Reviewed by Pascoe.
WebPageProxy::decidePolicyForResponseShared() no longer waits for
the SafeBrowsing request to be completed before responding. This
unblocks the WebContent process to proceed with the load. This is not
a bypass of the SafeBrowsing logic since a warning that arrives later
is still handled and shown.
* Source/WebKit/UIProcess/API/APINavigation.h:
(API::Navigation::setSafeBrowsingCheckTimedOut): Deleted.
(API::Navigation::safeBrowsingCheckTimedOut): Deleted.
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::decidePolicyForResponseShared):
Identifier: 305413.801@safari-7624-branch
Canonical link: https://commits.webkit.org/[email protected]
Canonical link: https://commits.webkit.org/305877.1061@webkitglib/2.52
Commit: f7b029a34bd170aa5cceab31ec51ce358a9115de
https://github.com/WebKit/WebKit/commit/f7b029a34bd170aa5cceab31ec51ce358a9115de
Author: Ryosuke Niwa <[email protected]>
Date: 2026-08-08 (Sat, 08 Aug 2026)
Changed paths:
M Source/WebCore/Modules/streams/StreamPipeToUtilities.cpp
Log Message:
-----------
Cherry-pick 6fd41e08545c. https://bugs.webkit.org/show_bug.cgi?id=313907
Crash in StreamPipeToState::errorsMustBePropagatedForward
https://bugs.webkit.org/show_bug.cgi?id=313907
rdar://175745036
Reviewed by Youenn Fablet.
Added a nullptr check.
No new tests since we don't have a reproduction.
* Source/WebCore/Modules/streams/StreamPipeToUtilities.cpp:
(WebCore::StreamPipeToState::handleSignal):
(WebCore::StreamPipeToState::errorsMustBePropagatedForward):
Identifier: 305413.826@safari-7624-branch
Canonical link: https://commits.webkit.org/[email protected]
Canonical link: https://commits.webkit.org/305877.1062@webkitglib/2.52
Commit: dd14aecd6c2bb000d669f9a1d7aa60d590a4b27e
https://github.com/WebKit/WebKit/commit/dd14aecd6c2bb000d669f9a1d7aa60d590a4b27e
Author: Chris Dumez <[email protected]>
Date: 2026-08-08 (Sat, 08 Aug 2026)
Changed paths:
A
LayoutTests/fast/dom/trusted-types-execCommand-insertHTML-case-insensitive-expected.txt
A
LayoutTests/fast/dom/trusted-types-execCommand-insertHTML-case-insensitive.html
M Source/WebCore/dom/Document.cpp
Log Message:
-----------
Cherry-pick 0e4f1956aff4. https://bugs.webkit.org/show_bug.cgi?id=314183
Trusted Types enforcement in Document.execCommand should be case-insensitive
https://bugs.webkit.org/show_bug.cgi?id=314183
rdar://175852496
Reviewed by Anne van Kesteren and Ryosuke Niwa.
The Trusted Types check in Document::execCommand() was using a
case-sensitive
comparison (commandName != "insertHTML"_s) to decide whether to enforce
TrustedHTML. Since execCommand command names are case-insensitive per spec,
passing a differently-cased variant like "InsertHTML" or "inserthtml" would
bypass the Trusted Types enforcement entirely.
Fix by using equalIgnoringASCIICase() for the comparison.
Test: fast/dom/trusted-types-execCommand-insertHTML-case-insensitive.html
*
LayoutTests/fast/dom/trusted-types-execCommand-insertHTML-case-insensitive-expected.txt:
Added.
*
LayoutTests/fast/dom/trusted-types-execCommand-insertHTML-case-insensitive.html:
Added.
* Source/WebCore/dom/Document.cpp:
(WebCore::Document::execCommand):
Identifier: 305413.846@safari-7624-branch
Canonical link: https://commits.webkit.org/[email protected]
Canonical link: https://commits.webkit.org/305877.1063@webkitglib/2.52
Commit: 26272727d539e92e7323a2b8c66403fdcf61f0a0
https://github.com/WebKit/WebKit/commit/26272727d539e92e7323a2b8c66403fdcf61f0a0
Author: Roberto Rodriguez <[email protected]>
Date: 2026-08-08 (Sat, 08 Aug 2026)
Changed paths:
A
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/about-blank-from-javascript-url-inherits-csp-from-initiator.sub-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/about-blank-from-javascript-url-inherits-csp-from-initiator.sub.html
A
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/support/page-with-csp-marker.html
A
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/support/page-with-csp-marker.html.headers
M LayoutTests/platform/ios-site-isolation/TestExpectations
M LayoutTests/platform/mac-site-isolation/TestExpectations
M Source/WebCore/loader/NavigationRequester.cpp
Log Message:
-----------
Cherry-pick 45512c517789. https://bugs.webkit.org/show_bug.cgi?id=316512
Unreviewed backport
about:blank inherits cross-origin policy container due to empty document URL
https://bugs.webkit.org/show_bug.cgi?id=316512
rdar://176188073
Reviewed by Alex Christensen.
Documents created via javascript: URL have an empty internal URL.
Document::setURL() would
normally normalize this to aboutBlankURL(), but the call is conditionally
skipped during
document creation.
When one of these documents creates a cross-origin iframe and then
navigates it to about:blank,
the empty URL passes through NavigationRequester into
NavigationAction::isEmpty(), which
mistakes it for an action that was never set. The fallback in
FrameLoader::loadWithDocumentLoader
incorrectly rebuilds the action from the target frame's cross-origin
document rather than the
original initiator (the javascript: URL document). The about:blank then
inherits that document's
policy container instead of the initiator's, leaking its CSP and referrer
via
SecurityPolicyViolationEvent.
Fix by normalizing empty document URLs to aboutBlankURL() in
NavigationRequester::from(),
matching what Document::setURL() and Document::urlForBindings() already do.
Tests:
imported/w3c/web-platform-tests/content-security-policy/inheritance/about-blank-from-javascript-url-inherits-csp-from-initiator.sub.html
imported/w3c/web-platform-tests/content-security-policy/inheritance/support/page-with-csp-marker.html
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/about-blank-from-javascript-url-inherits-csp-from-initiator.sub-expected.txt:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/about-blank-from-javascript-url-inherits-csp-from-initiator.sub.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/support/page-with-csp-marker.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/support/page-with-csp-marker.html.headers:
Added.
* LayoutTests/platform/ios-site-isolation/TestExpectations:
* LayoutTests/platform/mac-site-isolation/TestExpectations:
* Source/WebCore/loader/NavigationRequester.cpp:
(WebCore::NavigationRequester::from):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/[email protected]
Canonical link: https://commits.webkit.org/305877.1064@webkitglib/2.52
Compare: https://github.com/WebKit/WebKit/compare/9879ca6dcc00...26272727d539
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
