Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: f2a07be9fb7478e9b44a6ed50a7b9f07b8c793b1
https://github.com/WebKit/WebKit/commit/f2a07be9fb7478e9b44a6ed50a7b9f07b8c793b1
Author: Brady Eidson <[email protected]>
Date: 2026-09-04 (Fri, 04 Sep 2026)
Changed paths:
M Source/WebCore/loader/DocumentThreadableLoader.cpp
M Source/WebCore/loader/cache/CachedResourceLoader.cpp
M Source/WebCore/loader/cache/CachedResourceLoader.h
M Source/WebCore/platform/LegacySchemeRegistry.cpp
M Source/WebCore/platform/LegacySchemeRegistry.h
M Source/WebKit/NetworkProcess/NetworkProcess.h
M Source/WebKit/WebProcess/WebPage/WebPage.cpp
M Source/WebKit/WebProcess/WebProcess.cpp
M Source/WebKit/WebProcess/WebProcess.h
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/CreateWebArchive.mm
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKURLSchemeHandler-1.mm
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WebsitePolicies.mm
Log Message:
-----------
WKWebView does not enforce CORS response header validation for apps' custom
schemes after registerURLSchemeAsCORSEnabled()
rdar://174287004
Reviewed by Chris Dumez.
We mean for app provided custom URL schemes to participate in CORS, but our
implementation had a few holes.
- The network process was never informed of the custom scheme registrations
- Some types of requests that would never hit the network process skipped
needed checks in the web process.
A lot of care was taken to make sure app-provided content still works with
custom schemes as it always had.
This patch makes those changes and tests them.
Tests: Tools/TestWebKitAPI/Tests/WebKitCocoa/CreateWebArchive.mm
Tools/TestWebKitAPI/Tests/WebKitCocoa/WKURLSchemeHandler-1.mm
Tools/TestWebKitAPI/Tests/WebKitCocoa/WebsitePolicies.mm
* Source/WebCore/loader/DocumentThreadableLoader.cpp:
(WebCore::DocumentThreadableLoader::loadRequest):
* Source/WebCore/loader/cache/CachedResourceLoader.cpp:
(WebCore::CachedResourceLoader::canRequest):
(WebCore::CachedResourceLoader::canRequestAfterRedirection const):
(WebCore::CachedResourceLoader::isNoCorsCrossOriginRequestToURLSchemeHandler
const):
* Source/WebCore/loader/cache/CachedResourceLoader.h:
* Source/WebCore/platform/LegacySchemeRegistry.cpp:
(WebCore::LegacySchemeRegistry::isBuiltInWebKitHandledScheme):
(WebCore::LegacySchemeRegistry::registerURLSchemeAsCORSEnabled):
* Source/WebCore/platform/LegacySchemeRegistry.h:
* Source/WebKit/NetworkProcess/NetworkProcess.h:
* Source/WebKit/WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::registerURLSchemeHandler):
* Source/WebKit/WebProcess/WebProcess.cpp:
(WebKit::WebProcess::registerURLSchemeAsCORSEnabled):
* Source/WebKit/WebProcess/WebProcess.h:
* Tools/TestWebKitAPI/Tests/WebKitCocoa/CreateWebArchive.mm:
(TestWebKitAPI::(WebArchive, CreateCustomScheme)):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/WKURLSchemeHandler-1.mm:
(TEST(URLSchemeHandler, BasicWithHTTPS)):
((URLSchemeHandler, DisableCORSCanvas)):
((URLSchemeHandler, SameSchemeSubresourcesAllowed)):
((URLSchemeHandler, CrossOriginNoCorsSubresourcesBlocked)):
((URLSchemeHandler, CrossOriginIframeCORSEnforcementForCustomScheme)):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/WebsitePolicies.mm:
Originally-landed-as: 305413.959@safari-7624-branch (1011610c6800).
rdar://184744641
Canonical link: https://commits.webkit.org/320522@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
