Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 0e878ab17f770bfca631a48f4dbdc84d3667cb2f
https://github.com/WebKit/WebKit/commit/0e878ab17f770bfca631a48f4dbdc84d3667cb2f
Author: Basuke Suzuki <[email protected]>
Date: 2026-09-24 (Thu, 24 Sep 2026)
Changed paths:
M Source/WebCore/loader/DocumentThreadableLoader.cpp
M Source/WebCore/loader/cache/CachedResourceLoader.cpp
M Source/WebCore/loader/cache/CachedResourceLoader.h
M Source/WebCore/platform/LegacySchemeRegistry.cpp
M Source/WebCore/platform/LegacySchemeRegistry.h
M Source/WebKit/WebProcess/WebPage/WebPage.cpp
M Source/WebKit/WebProcess/WebProcess.cpp
M Source/WebKit/WebProcess/WebProcess.h
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/CreateWebArchive.mm
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKURLSchemeHandler-1.mm
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WebsitePolicies.mm
Log Message:
-----------
Cherry-pick [email protected] (3fa88516dc20). rdar://188123167
Revert the app custom-scheme CORS enforcement on safari-7624.5-branch
rdar://182056880
Reviewed by Chris Dumez.
The CORS enforcement added for rdar://178748484 blocks no-cors subresource
loads whenever the document origin's scheme differs from the subresource
scheme, in both directions. This breaks the legitimate pattern of a page
loaded over http(s) (e.g. via -loadData:...baseURL: or -loadHTMLString:...)
that then loads subresources from a custom scheme the app itself registered
with a WKURLSchemeHandler:
Unsafe attempt to load URL custom-scheme://... from origin https://...
Apple News hits this (rdar://182056880, a LuckG release blocker: Sports team
logos fail to load in World Cup / Sports feeds), as does a third-party app
(rdar://182251092). The intended threat model was the opposite direction
only
(a custom-scheme document reaching out to fetch other content), so both of
these are collateral breakage.
The follow-up relaxations only covered a subset of app content: opaque and
file: origins (rdar://179999480) and app-provided custom-scheme document
origins (rdar://181845365, Books), but not http(s)-origin app-loaded
documents.
The enforcement is not present on main/trunk and was already reverted from
the 26.5 branches (rdar://178748484). Align safari-7624.5-branch with that
state by reverting the enforcement and its relaxations:
Revert 349f00426824 (rdar://181845365)
Revert 111cc2819a4d (rdar://179999480)
Revert 83b41e4ce721 (rdar://178748484)
No new tests (revert of a landed change; removes the tests added with it).
Identifier: [email protected]
Canonical link: https://commits.webkit.org/321782@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
