Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 12024828ce4fd3a6d4c7196503bfcd6e9372f3d5
https://github.com/WebKit/WebKit/commit/12024828ce4fd3a6d4c7196503bfcd6e9372f3d5
Author: Zak Ridouh <[email protected]>
Date: 2026-09-25 (Fri, 25 Sep 2026)
Changed paths:
A
LayoutTests/http/tests/site-isolation/post-message-forged-source-frame-expected.txt
A
LayoutTests/http/tests/site-isolation/post-message-forged-source-frame.html
A
LayoutTests/http/tests/site-isolation/post-message-forged-source-origin-expected.txt
A
LayoutTests/http/tests/site-isolation/post-message-forged-source-origin.html
A
LayoutTests/http/tests/site-isolation/post-message-forged-target-frame-expected.txt
A
LayoutTests/http/tests/site-isolation/post-message-forged-target-frame.html
A
LayoutTests/http/tests/site-isolation/resources/post-message-forged-source-iframe.html
A
LayoutTests/http/tests/site-isolation/resources/post-message-forged-source-origin-sandboxed.html
A
LayoutTests/http/tests/site-isolation/resources/post-message-forged-source-origin-victim.html
A
LayoutTests/http/tests/site-isolation/resources/post-message-forged-target-popup.html
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/UIProcess/WebPageProxy.h
M Source/WebKit/WebProcess/WebPage/WebPage.cpp
Log Message:
-----------
[Site Isolation] Validate the target frame of cross-process postMessage and
focus
https://bugs.webkit.org/show_bug.cgi?id=321743
rdar://184871551
Reviewed by Alex Christensen.
postMessageToRemote and focusRemoteFrame look up a frame identifier from the
sending WebContent process in a global map, so a compromised process could post
into, or focus, another page's frame.
Both messages are sent on the WebPage mirroring the named frame's page, even
from an opener or an opened window, so that frame must belong to the receiving
page. Make this a message check in both, and check it again in
WebPage::remotePostMessage.
postMessageToRemote also names the source frame and origin behind event.source
and event.origin. The sender must host the source frame; drop the message if
not, since the old process can still send one before it receives
LoadDidCommitInAnotherProcess. The claimed origin must be opaque or the one the
UI process derives;
terminate the sender if not. When the UI process expects an opaque origin, only
drop the message: a cross-process parent's sandbox attribute changes don't
reach the frame's own process yet.
*
LayoutTests/http/tests/site-isolation/post-message-forged-source-frame-expected.txt:
Added.
* LayoutTests/http/tests/site-isolation/post-message-forged-source-frame.html:
Added.
*
LayoutTests/http/tests/site-isolation/post-message-forged-source-origin-expected.txt:
Added.
* LayoutTests/http/tests/site-isolation/post-message-forged-source-origin.html:
Added.
*
LayoutTests/http/tests/site-isolation/post-message-forged-target-frame-expected.txt:
Added.
* LayoutTests/http/tests/site-isolation/post-message-forged-target-frame.html:
Added.
*
LayoutTests/http/tests/site-isolation/resources/post-message-forged-source-iframe.html:
Added.
*
LayoutTests/http/tests/site-isolation/resources/post-message-forged-source-origin-sandboxed.html:
Added.
*
LayoutTests/http/tests/site-isolation/resources/post-message-forged-source-origin-victim.html:
Added.
*
LayoutTests/http/tests/site-isolation/resources/post-message-forged-target-popup.html:
Added.
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::focusRemoteFrame):
(WebKit::WebPageProxy::postMessageToRemote):
* Source/WebKit/UIProcess/WebPageProxy.h:
* Source/WebKit/WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::remotePostMessage):
Canonical link: https://commits.webkit.org/321962@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
