Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d4867a890432d2368c2cd6a4bc1516da4d0f4c7b
https://github.com/WebKit/WebKit/commit/d4867a890432d2368c2cd6a4bc1516da4d0f4c7b
Author: Chris Dumez <[email protected]>
Date: 2026-09-01 (Tue, 01 Sep 2026)
Changed paths:
A
LayoutTests/http/tests/cookies/resources/set-raw-cookie-in-third-party-iframe-frame.html
A
LayoutTests/http/tests/cookies/set-raw-cookie-in-third-party-iframe-expected.txt
A LayoutTests/http/tests/cookies/set-raw-cookie-in-third-party-iframe.html
A LayoutTests/ipc/set-raw-cookie-empty-commenturl-crash-expected.txt
A LayoutTests/ipc/set-raw-cookie-empty-commenturl-crash.html
A LayoutTests/ipc/set-raw-cookie-firstparty-message-check-expected.txt
A LayoutTests/ipc/set-raw-cookie-firstparty-message-check.html
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
Log Message:
-----------
Regression(314177@main) SetRawCookie's MESSAGE_CHECKs reject legitimate
cookie writes from third-party iframes
https://bugs.webkit.org/show_bug.cgi?id=323060
rdar://177769847
Reviewed by Ben Nham.
NetworkConnectionToWebProcess::setRawCookie validated cookie.domain and
url against firstParty:
```
MESSAGE_CHECK(RegistrableDomain::uncheckedCreateFromHost(cookie.domain).matches(firstParty));
MESSAGE_CHECK(RegistrableDomain(url).matches(firstParty));
```
This is too strict. WebCookieJar::setRawCookie passes
document.firstPartyForCookies() as firstParty (the top-level page's URL)
and document.cookieURL() as url (the document's own URL). For a
third-party iframe these legitimately differ, so the checks terminate
the WebProcess whenever Web Inspector or internals.setCookie is used in
a cross-site iframe.
Replace the two checks with an integrity check that cookie.domain's
registrable domain matches url, mirroring the existing posture of
setCookieFromDOMAsync which validates firstParty only and trusts the
url/cookie pair. The new check still rejects a mismatched
cookie.domain/url pair (the most useful invariant) without coupling
either to the unrelated top-level firstParty.
Tests: http/tests/cookies/set-raw-cookie-in-third-party-iframe.html
ipc/set-raw-cookie-empty-commenturl-crash.html
ipc/set-raw-cookie-firstparty-message-check.html
*
LayoutTests/http/tests/cookies/resources/set-raw-cookie-in-third-party-iframe-frame.html:
Added.
*
LayoutTests/http/tests/cookies/set-raw-cookie-in-third-party-iframe-expected.txt:
Added.
* LayoutTests/http/tests/cookies/set-raw-cookie-in-third-party-iframe.html:
Added.
Add test coverage for the overly strict checks.
* LayoutTests/ipc/set-raw-cookie-empty-commenturl-crash-expected.txt: Added.
* LayoutTests/ipc/set-raw-cookie-empty-commenturl-crash.html: Added.
* LayoutTests/ipc/set-raw-cookie-firstparty-message-check-expected.txt: Added.
* LayoutTests/ipc/set-raw-cookie-firstparty-message-check.html: Added.
Add test coverage for what 314177@main was trying to fix, to make sure
that we don't regress it.
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::setRawCookie):
Canonical link: https://commits.webkit.org/320304@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
