Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: 89b737fcdfd91ac223f6c0ae44dddfba10f3ed82
https://github.com/WebKit/WebKit/commit/89b737fcdfd91ac223f6c0ae44dddfba10f3ed82
Author: Chris Dumez <[email protected]>
Date: 2026-08-25 (Tue, 25 Aug 2026)
Changed paths:
M Source/WebKit/UIProcess/WebFrameProxy.cpp
M Source/WebKit/UIProcess/WebFrameProxy.h
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/gtk/TestWebViewEditor.cpp
Log Message:
-----------
Cherry-pick 6e4e21af9c2e. https://bugs.webkit.org/show_bug.cgi?id=314886
Validate transient user activation in UIProcess for async clipboard reads
https://bugs.webkit.org/show_bug.cgi?id=314886
rdar://177152667
Reviewed by Ryosuke Niwa.
Follow-up to 305413.908@safari-7624-branch, which added a WebCore-side
transient activation check to navigator.clipboard.readText() / read(). That
check is bypassable by a compromised WebContent process that calls the
RequestDOMPasteAccess IPC directly with a fabricated activation claim.
Mirror the spec's transient activation tracking
(LocalDOMWindow::notifyActivated, LocalDOMWindow::hasTransientActivation) in
the UIProcess so the UIProcess can independently verify that the requesting
frame really is activated:
- WebFrameProxy gains m_lastActivationTimestamp, notifyActivated(), and
hasTransientActivation(). notifyActivated() propagates the timestamp to
ancestor frames (any origin) and same-origin descendant frames, matching
the HTML spec's activation notification algorithm.
- The four input-event entry points in WebPageProxy
(sendMouseEvent / sendKeyEvent / sendPreventableTouchEvent /
sendUnpreventableTouchEvent) now call WebFrameProxy::notifyActivated for
activation-triggering events on the target frame. The pre-existing
page-level lastActivationTimestamp updates remain; they serve a
different
heuristic.
- WebPageProxy::requestDOMPasteAccess rejects with DeniedForGesture if the
requesting WebFrameProxy does not have transient activation. A
compromised
WebContent process can no longer get past this gate.
- WebFrameProxy::didCommitLoad resets m_lastActivationTimestamp so a new
document does not inherit activation from the previous one (matches
LocalDOMWindow::consumeLastActivationIfNecessary semantics).
* Source/WebKit/UIProcess/WebFrameProxy.cpp:
(WebKit::WebFrameProxy::didCommitLoad):
(WebKit::WebFrameProxy::notifyActivated):
(WebKit::WebFrameProxy::propagateActivationToSameOriginDescendants):
(WebKit::WebFrameProxy::hasTransientActivation const):
(WebKit::WebFrameProxy::securityOrigin const):
* Source/WebKit/UIProcess/WebFrameProxy.h:
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::sendMouseEvent):
(WebKit::WebPageProxy::sendKeyEvent):
(WebKit::WebPageProxy::sendPreventableTouchEvent):
(WebKit::WebPageProxy::sendUnpreventableTouchEvent):
(WebKit::WebPageProxy::requestDOMPasteAccess):
Identifier: 305413.928@safari-7624-branch
Canonical link: https://commits.webkit.org/[email protected]
Canonical link: https://commits.webkit.org/317695.149@webkitglib/2.54
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
