Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8bd2ba0d3e5c4e753b5238a0180a5900df05e5db
https://github.com/WebKit/WebKit/commit/8bd2ba0d3e5c4e753b5238a0180a5900df05e5db
Author: Sihui Liu <[email protected]>
Date: 2026-08-17 (Mon, 17 Aug 2026)
Changed paths:
M Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml
M Source/WebCore/PAL/pal/spi/cocoa/WebPrivacySPI.h
M Source/WebKit/Configurations/AllowedSPI-legacy.toml
M Source/WebKit/Platform/cocoa/WebPrivacyHelpers.h
M Source/WebKit/Platform/cocoa/WebPrivacyHelpers.mm
M Source/WebKit/UIProcess/API/Cocoa/WKWebsiteDataStore.mm
M Source/WebKit/UIProcess/API/Cocoa/WKWebsiteDataStorePrivate.h
M Source/WebKit/UIProcess/WebsiteData/IsolatedSiteStore.cpp
M Source/WebKit/UIProcess/WebsiteData/IsolatedSiteStore.h
M Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.cpp
M Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.h
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm
Log Message:
-----------
[Site Isolation] Keep high-value fraud target domains out of the shared
process
https://bugs.webkit.org/show_bug.cgi?id=321804
rdar://184938204
Reviewed by Basuke Suzuki.
IsolatedSiteStore currently only knows what this device has observed --
Autofill, FirstPartyVisit, FirstPartyUserGesture
-- so a site is kept out of the shared Web process only after the user has
already interacted with it here, leaving the
first visit unprotected. Adopt WebPrivacy's high-value fraud target domains
list as an additional signal so that a site
likely to hold sensitive user data is isolated on first contact.
HighValueFraudTargetDomainsController follows
RestrictedOpenerDomainsController: it fetches the list on construction,
has it refreshed by a WKWebPrivacyNotificationListener, and re-requests it
every [24, 26) hours. It is constructed from
WebsiteDataStore::updateIsolatedSiteStoreSettings() when a page that enables
this is added to the data store -- earlier
than prewarming or the start of a load, and skipped for pages that do not
enable this.
Note that placement does not wait for the list. The fetch has no bounded
completion time, and a timeout-based bailout
would not help: every cross-site subframe in that window would wait out the
full timeout first. A site looked up before
the list arrives is therefore treated as not being on it and may enter the
shared process. The opposite default --
assuming an unknown site is on the list -- would instead launch a process per
cross-site subframe. Given that sites
already recorded in IsolatedSiteStore are still isolated, this is the tradeoff
we chose.
The new signal is behind SiteIsolationHighValueFraudTargetDomainsEnabled, which
is unstable and off by default. It has
no effect unless SiteIsolationSharedProcessEnabled is also on. Although that is
a WebPreferences flag, the placement it
influences is per-data-store state: a shared process's domain set is shared by
every page in the store, and
WebProcessCache keys cached shared processes on the store. Aggregate it across
every page using the WebsiteDataStore and
keep the result as a single flag on IsolatedSiteStore, updated from
propagateSettingUpdates() -- which already runs on
addPage, removePage and WebPageProxy::preferencesDidChange -- and seeded when
the store is created.
Tests: SiteIsolation.SharedProcessExcludesHighValueFraudTargetDomains
SiteIsolation.SharedProcessIgnoresHighValueFraudTargetDomainsWhenDisabled
* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:
* Source/WebCore/PAL/pal/spi/cocoa/WebPrivacySPI.h:
* Source/WebKit/Configurations/AllowedSPI-legacy.toml:
* Source/WebKit/Platform/cocoa/WebPrivacyHelpers.h:
* Source/WebKit/Platform/cocoa/WebPrivacyHelpers.mm:
(WebKit::HighValueFraudTargetDomainsController::singleton):
(WebKit::HighValueFraudTargetDomainsController::HighValueFraudTargetDomainsController):
(WebKit::HighValueFraudTargetDomainsController::scheduleNextUpdate):
(WebKit::HighValueFraudTargetDomainsController::update):
(WebKit::HighValueFraudTargetDomainsController::contains const):
(WebKit::HighValueFraudTargetDomainsController::setDomainsForTesting):
* Source/WebKit/UIProcess/API/Cocoa/WKWebsiteDataStore.mm:
(-[WKWebsiteDataStore _setHighValueFraudTargetDomainsForTesting:]):
* Source/WebKit/UIProcess/API/Cocoa/WKWebsiteDataStorePrivate.h:
* Source/WebKit/UIProcess/WebsiteData/IsolatedSiteStore.cpp:
(WebKit::IsolatedSiteStore::create):
(WebKit::IsolatedSiteStore::IsolatedSiteStore):
(WebKit::IsolatedSiteStore::reasonsFor const):
(WebKit::IsolatedSiteStore::containsDomain const):
(WebKit::IsolatedSiteStore::isHighValueFraudTargetDomain const):
(WebKit::IsolatedSiteStore::setHighValueFraudTargetDomainsEnabled):
* Source/WebKit/UIProcess/WebsiteData/IsolatedSiteStore.h:
* Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.cpp:
(WebKit::WebsiteDataStore::isolatedSiteStore):
(WebKit::WebsiteDataStore::computeSiteIsolationHighValueFraudTargetDomainsEnabled
const):
(WebKit::WebsiteDataStore::updateIsolatedSiteStoreSettings):
(WebKit::WebsiteDataStore::setHighValueFraudTargetDomainsForTesting):
(WebKit::WebsiteDataStore::propagateSettingUpdates):
* Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.h:
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:
(TestWebKitAPI::(SiteIsolation,
SharedProcessExcludesHighValueFraudTargetDomains)):
(TestWebKitAPI::(SiteIsolation,
SharedProcessIgnoresHighValueFraudTargetDomainsWhenDisabled)):
Canonical link: https://commits.webkit.org/319324@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
