Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e88c8b010e7f325019231b36d6031c41462c5ee8
https://github.com/WebKit/WebKit/commit/e88c8b010e7f325019231b36d6031c41462c5ee8
Author: Brady Eidson <[email protected]>
Date: 2026-08-26 (Wed, 26 Aug 2026)
Changed paths:
M Source/WebKit/NetworkProcess/NetworkBroadcastChannelRegistry.cpp
M Source/WebKit/NetworkProcess/NetworkBroadcastChannelRegistry.h
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/NetworkProcess.mm
Log Message:
-----------
BroadcastChannel cross-origin spoof
rdar://172230453
Reviewed by Charlie Wolfe.
A compromised web content process can send a malicious message to the
Networking process
to register for broadcast channel messages it should not have access to.
This adds message checks to validate that the IPC::Connection these messages are
coming from has access to the top security origin claimed.
Tests: Tools/TestWebKitAPI/Tests/WebKitCocoa/BroadcastChannelOriginSpoof.mm
* Source/WebKit/NetworkProcess/NetworkBroadcastChannelRegistry.cpp:
(WebKit::NetworkBroadcastChannelRegistry::isOriginAllowedForConnection const):
(WebKit::NetworkBroadcastChannelRegistry::registerChannel):
(WebKit::NetworkBroadcastChannelRegistry::unregisterChannel):
(WebKit::NetworkBroadcastChannelRegistry::postMessage):
* Source/WebKit/NetworkProcess/NetworkBroadcastChannelRegistry.h:
* Source/WebKit/NetworkProcess/NetworkProcess.cpp:
(WebKit::NetworkProcess::allowsFirstPartyForCookies): Remove an unnecessary
ASSERT that prevents
this from being tested in the debug configuration.
* Tools/TestWebKitAPI/Tests/WebKitCocoa/NetworkProcess.mm:
(-[BroadcastChannelSpoofMessageHandler
userContentController:didReceiveScriptMessage:]):
((NetworkProcess, BroadcastChannelOriginSpoof)):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/PasteHTML.mm:
Originally-landed-as: 305413.560@safari-7624-branch (e1706a288fb5).
rdar://185459196
Canonical link: https://commits.webkit.org/319914@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
