Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: fe637671df13fc775e702d6f3a1f855484abf764
https://github.com/WebKit/WebKit/commit/fe637671df13fc775e702d6f3a1f855484abf764
Author: Matthew Finkel <[email protected]>
Date: 2026-08-22 (Sat, 22 Aug 2026)
Changed paths:
A
LayoutTests/http/tests/cookies/same-site/fetch-in-srcdoc-iframe-inside-cross-origin-iframe-expected.txt
A
LayoutTests/http/tests/cookies/same-site/fetch-in-srcdoc-iframe-inside-cross-origin-iframe.html
A
LayoutTests/http/tests/cookies/same-site/img-from-srcdoc-iframe-inside-cross-origin-iframe-expected.txt
A
LayoutTests/http/tests/cookies/same-site/img-from-srcdoc-iframe-inside-cross-origin-iframe.html
A LayoutTests/http/tests/cookies/same-site/resources/record-image-cookies.py
A
LayoutTests/http/tests/cookies/same-site/resources/srcdoc-creator-img-inside-cross-origin-iframe.html
A
LayoutTests/http/tests/cookies/same-site/resources/srcdoc-creator-inside-cross-origin-iframe.html
M Source/WebCore/loader/FrameLoader.cpp
Log Message:
-----------
Cherry-pick [email protected] (edd74642a6ef).
https://bugs.webkit.org/show_bug.cgi?id=313220
Srcdoc iframes bypass SameSite Strict and Lax cookies
https://bugs.webkit.org/show_bug.cgi?id=313220
rdar://175498842
Reviewed by Charlie Wolfe.
When we set firstPartyForCookies on a subframe, we check if either:
1) shouldInheritSecurityOriginFromOwner is true for the current document's
URL, or
2) if the current document's URL is same-registrable-domain as the
top-level document URL
In the case of an iframe with srcdoc, shouldInheritSecurityOriginFromOwner
returns true (as documented), and this causes us to set the page's
mainFrameURL
as the firstPartyForCookies. We need a conditional exception for
shouldInheritSecurityOriginFromOwner, but it should take nested iframes into
account. This patch adjusts the logic so we inherit the ancestor frame's
siteForCookies instead of the page's URL. The same-registrable-domain check
remains unchanged.
Test:
http/tests/cookies/same-site/fetch-in-srcdoc-iframe-inside-cross-origin-iframe.html
*
LayoutTests/http/tests/cookies/same-site/fetch-in-srcdoc-iframe-inside-cross-origin-iframe-expected.txt:
Added.
*
LayoutTests/http/tests/cookies/same-site/fetch-in-srcdoc-iframe-inside-cross-origin-iframe.html:
Added.
*
LayoutTests/http/tests/cookies/same-site/img-from-srcdoc-iframe-inside-cross-origin-iframe-expected.txt:
Added.
*
LayoutTests/http/tests/cookies/same-site/img-from-srcdoc-iframe-inside-cross-origin-iframe.html:
Added.
*
LayoutTests/http/tests/cookies/same-site/resources/record-image-cookies.py:
Added.
*
LayoutTests/http/tests/cookies/same-site/resources/srcdoc-creator-img-inside-cross-origin-iframe.html:
Added.
*
LayoutTests/http/tests/cookies/same-site/resources/srcdoc-creator-inside-cross-origin-iframe.html:
Added.
* Source/WebCore/loader/FrameLoader.cpp:
(WebCore::FrameLoader::setFirstPartyForCookies):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/317695.139@webkitglib/2.54
Commit: a4a0aa920e003fb423cd249c62150189f94737a8
https://github.com/WebKit/WebKit/commit/a4a0aa920e003fb423cd249c62150189f94737a8
Author: Chris Dumez <[email protected]>
Date: 2026-08-22 (Sat, 22 Aug 2026)
Changed paths:
A
LayoutTests/fast/dom/trusted-types-execCommand-insertHTML-case-insensitive-expected.txt
A
LayoutTests/fast/dom/trusted-types-execCommand-insertHTML-case-insensitive.html
M Source/WebCore/dom/Document.cpp
Log Message:
-----------
Cherry-pick 0e4f1956aff4. https://bugs.webkit.org/show_bug.cgi?id=314183
Trusted Types enforcement in Document.execCommand should be case-insensitive
https://bugs.webkit.org/show_bug.cgi?id=314183
rdar://175852496
Reviewed by Anne van Kesteren and Ryosuke Niwa.
The Trusted Types check in Document::execCommand() was using a
case-sensitive
comparison (commandName != "insertHTML"_s) to decide whether to enforce
TrustedHTML. Since execCommand command names are case-insensitive per spec,
passing a differently-cased variant like "InsertHTML" or "inserthtml" would
bypass the Trusted Types enforcement entirely.
Fix by using equalIgnoringASCIICase() for the comparison.
Test: fast/dom/trusted-types-execCommand-insertHTML-case-insensitive.html
*
LayoutTests/fast/dom/trusted-types-execCommand-insertHTML-case-insensitive-expected.txt:
Added.
*
LayoutTests/fast/dom/trusted-types-execCommand-insertHTML-case-insensitive.html:
Added.
* Source/WebCore/dom/Document.cpp:
(WebCore::Document::execCommand):
Identifier: 305413.846@safari-7624-branch
Canonical link: https://commits.webkit.org/[email protected]
Canonical link: https://commits.webkit.org/317695.140@webkitglib/2.54
Commit: ffcccbf5280872c6d6d842be1d2caa7432d2e25c
https://github.com/WebKit/WebKit/commit/ffcccbf5280872c6d6d842be1d2caa7432d2e25c
Author: Chris Dumez <[email protected]>
Date: 2026-08-22 (Sat, 22 Aug 2026)
Changed paths:
A
LayoutTests/fast/shadow-dom/manual-slot-assign-renderer-teardown-crash-expected.txt
A
LayoutTests/fast/shadow-dom/manual-slot-assign-renderer-teardown-crash.html
M Source/WebCore/dom/SlotAssignment.cpp
Log Message:
-----------
Cherry-pick ddc8b3fae09f. https://bugs.webkit.org/show_bug.cgi?id=314886
UAF in ManualSlotAssignment via WeakHashMap rehash during reentrant
composed-tree teardown
https://bugs.webkit.org/show_bug.cgi?id=REDACTED
rdar://179729192
Reviewed by Anne van Kesteren.
ManualSlotAssignment::slotManualAssignmentDidChange computed
effectiveCurrent
by calling assignedNodesForSlot, which returns a raw pointer to the
cachedAssignment Vector inside a Slot value stored directly in the m_slots
WeakHashMap bucket array. It then called
RenderTreeUpdater::tearDownRenderersAfterSlotChange, whose composed-tree
traversal can call HTMLSlotElement::assignedNodes on a sibling slot and
re-enter ManualSlotAssignment::assignedNodesForSlot. The reentrant
m_slots.ensure call may invoke the WeakHashMap amortized cleanup, sweep
null-keyed entries left by previously inserted, removed and GC-collected
slot
elements, and rehash the table, freeing the bucket array effectiveCurrent
points into. The stale pointer was then dereferenced in
scheduleSlotChangeEventIfNeeded.
Compute effectiveCurrent as a local Vector via effectiveAssignedNodes,
mirroring effectivePrevious, so no pointer into m_slots is held across the
render-tree teardown.
*
LayoutTests/fast/shadow-dom/manual-slot-assign-renderer-teardown-crash-expected.txt:
Added.
*
LayoutTests/fast/shadow-dom/manual-slot-assign-renderer-teardown-crash.html:
Added.
* Source/WebCore/dom/SlotAssignment.cpp:
(WebCore::ManualSlotAssignment::slotManualAssignmentDidChange):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/[email protected]
Canonical link: https://commits.webkit.org/317695.141@webkitglib/2.54
Commit: 2a2ed37c6a028bbe5014737f401a0e971055dc3a
https://github.com/WebKit/WebKit/commit/2a2ed37c6a028bbe5014737f401a0e971055dc3a
Author: Brady Eidson <[email protected]>
Date: 2026-08-22 (Sat, 22 Aug 2026)
Changed paths:
M Source/WebCore/loader/cache/CachedResourceLoader.cpp
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKURLSchemeHandler-1.mm
Log Message:
-----------
Cherry-pick 111cc2819a4d. https://bugs.webkit.org/show_bug.cgi?id=314886
(305413.959@safari-7624-branch) Embedded image is not load as image in mail
app
rdar://179999480
Reviewed by Ben Nham.
The addition of custom scheme CORS checks broke apps that load the main
HTML via
file URL and then mix in custom schemes.
It's totally find to relax the checks for that case.
Test: Tools/TestWebKitAPI/Tests/WebKitCocoa/WKURLSchemeHandler-1.mm
* Source/WebCore/loader/cache/CachedResourceLoader.cpp:
(WebCore::CachedResourceLoader::isNoCorsCrossOriginRequestToURLSchemeHandler
const):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/WKURLSchemeHandler-1.mm:
((URLSchemeHandler, LoadFileURLNoCorsSubresourceAllowed)):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/[email protected]
Canonical link: https://commits.webkit.org/317695.142@webkitglib/2.54
Commit: cded2ae81f348a4bcc12d7feb527c3bdd1fa2e9d
https://github.com/WebKit/WebKit/commit/cded2ae81f348a4bcc12d7feb527c3bdd1fa2e9d
Author: Roberto Rodriguez <[email protected]>
Date: 2026-08-22 (Sat, 22 Aug 2026)
Changed paths:
A
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/about-blank-from-javascript-url-inherits-csp-from-initiator.sub-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/about-blank-from-javascript-url-inherits-csp-from-initiator.sub.html
A
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/support/page-with-csp-marker.html
A
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/support/page-with-csp-marker.html.headers
M LayoutTests/platform/ios-site-isolation/TestExpectations
M LayoutTests/platform/mac-site-isolation/TestExpectations
M Source/WebCore/loader/NavigationRequester.cpp
Log Message:
-----------
Cherry-pick 45512c517789. https://bugs.webkit.org/show_bug.cgi?id=316512
about:blank inherits cross-origin policy container due to empty document URL
https://bugs.webkit.org/show_bug.cgi?id=316512
rdar://176188073
Reviewed by Alex Christensen.
Documents created via javascript: URL have an empty internal URL.
Document::setURL() would
normally normalize this to aboutBlankURL(), but the call is conditionally
skipped during
document creation.
When one of these documents creates a cross-origin iframe and then
navigates it to about:blank,
the empty URL passes through NavigationRequester into
NavigationAction::isEmpty(), which
mistakes it for an action that was never set. The fallback in
FrameLoader::loadWithDocumentLoader
incorrectly rebuilds the action from the target frame's cross-origin
document rather than the
original initiator (the javascript: URL document). The about:blank then
inherits that document's
policy container instead of the initiator's, leaking its CSP and referrer
via
SecurityPolicyViolationEvent.
Fix by normalizing empty document URLs to aboutBlankURL() in
NavigationRequester::from(),
matching what Document::setURL() and Document::urlForBindings() already do.
Tests:
imported/w3c/web-platform-tests/content-security-policy/inheritance/about-blank-from-javascript-url-inherits-csp-from-initiator.sub.html
imported/w3c/web-platform-tests/content-security-policy/inheritance/support/page-with-csp-marker.html
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/about-blank-from-javascript-url-inherits-csp-from-initiator.sub-expected.txt:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/about-blank-from-javascript-url-inherits-csp-from-initiator.sub.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/support/page-with-csp-marker.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/support/page-with-csp-marker.html.headers:
Added.
* LayoutTests/platform/ios-site-isolation/TestExpectations:
* LayoutTests/platform/mac-site-isolation/TestExpectations:
* Source/WebCore/loader/NavigationRequester.cpp:
(WebCore::NavigationRequester::from):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/[email protected]
Canonical link: https://commits.webkit.org/317695.143@webkitglib/2.54
Commit: 939f996fbdcdd98607eda0a950b7d5f972d3c9bd
https://github.com/WebKit/WebKit/commit/939f996fbdcdd98607eda0a950b7d5f972d3c9bd
Author: Basuke Suzuki <[email protected]>
Date: 2026-08-22 (Sat, 22 Aug 2026)
Changed paths:
M Source/WebCore/loader/cache/CachedResourceLoader.cpp
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKURLSchemeHandler-1.mm
Log Message:
-----------
Cherry-pick 349f00426824. https://bugs.webkit.org/show_bug.cgi?id=313521
[Loading] App custom scheme documents cannot load no-cors subresources from
other app custom schemes
rdar://181845365
Reviewed by Sihui Liu.
The custom-scheme CORS enforcement added in rdar://174287004 blocks no-cors
cross-scheme
subresource loads between two app custom schemes. rdar://179999480 relaxed
this for
documents with an opaque origin (loadData:) or a file: origin
(loadFileURL:), but not for
documents served from an app-registered custom scheme. Books loads its EPUB
document from
ibooks:// and its images from ibooksimg://, so embedded images and
thumbnails stopped
loading with "Unsafe attempt to load URL ibooksimg://... from origin
ibooks://...".
Extend the same relaxation to app-provided custom scheme origins: a
document whose origin
protocol is handled by a WKURLSchemeHandler (and is not a built-in WebKit
scheme) is
app-controlled content, just like file:/opaque app content. http(s) can
never be registered
as a scheme handler, so this does not widen web content's access to app
custom schemes.
Test: Tools/TestWebKitAPI/Tests/WebKitCocoa/WKURLSchemeHandler-1.mm
* Source/WebCore/loader/cache/CachedResourceLoader.cpp:
(WebCore::CachedResourceLoader::isNoCorsCrossOriginRequestToURLSchemeHandler
const):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/WKURLSchemeHandler-1.mm:
((URLSchemeHandler, LoadCustomSchemeNoCorsCrossSchemeSubresourceAllowed)):
Identifier: [email protected]
Canonical link:
https://commits.webkit.org/[email protected]
Canonical link: https://commits.webkit.org/317695.144@webkitglib/2.54
Compare: https://github.com/WebKit/WebKit/compare/d23526630231...939f996fbdcd
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
