Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 6452a350bc4dfbf2ef16fb38907be3c726601b00
https://github.com/WebKit/WebKit/commit/6452a350bc4dfbf2ef16fb38907be3c726601b00
Author: Xyan Bhatnagar <[email protected]>
Date: 2026-10-01 (Thu, 01 Oct 2026)
Changed paths:
M LayoutTests/TestExpectations
A
LayoutTests/fast/cookies/cookie-name-and-value-with-unicode-characters-expected.txt
A
LayoutTests/fast/cookies/cookie-name-and-value-with-unicode-characters.html
A
LayoutTests/http/tests/cookies/cookie-store-change-event-with-unicode-characters.https-expected.txt
A
LayoutTests/http/tests/cookies/cookie-store-change-event-with-unicode-characters.https.html
A
LayoutTests/http/tests/cookies/cookie-store-delete-with-unicode-name.https-expected.txt
A
LayoutTests/http/tests/cookies/cookie-store-delete-with-unicode-name.https.html
A
LayoutTests/http/tests/cookies/cookie-store-document-cookie-interop-with-unicode-characters.https-expected.txt
A
LayoutTests/http/tests/cookies/cookie-store-document-cookie-interop-with-unicode-characters.https.html
A
LayoutTests/http/tests/cookies/cookie-store-get-set-with-unicode-characters.https-expected.txt
A
LayoutTests/http/tests/cookies/cookie-store-get-set-with-unicode-characters.https.html
A
LayoutTests/http/tests/cookies/cookie-store-set-size-limit-with-unicode-characters.https-expected.txt
A
LayoutTests/http/tests/cookies/cookie-store-set-size-limit-with-unicode-characters.https.html
M
LayoutTests/imported/w3c/web-platform-tests/cookies/encoding/charset-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/cookiestore/change_eventhandler_for_document_cookie.https.window-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/cookiestore/change_eventhandler_for_http_cookie_and_set_cookie_headers.https.window-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/cookiestore/encoding.https.any-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/cookiestore/encoding.https.any.serviceworker-expected.txt
M LayoutTests/platform/ios/TestExpectations
M LayoutTests/platform/mac/TestExpectations
M Source/WebCore/Modules/cookie-store/CookieListItem.h
M Source/WebCore/Modules/cookie-store/CookieStore.cpp
M Source/WebCore/dom/Document.cpp
M Source/WebCore/platform/Cookie.h
M Source/WebCore/platform/network/Cookie.cpp
M Source/WebCore/platform/network/cocoa/CookieCocoa.mm
M Source/WebCore/platform/network/cocoa/CookieStorageSessionCocoa.mm
M Source/WebKit/WebProcess/WebPage/WebCookieCache.cpp
Log Message:
-----------
Correct the encoding of DOM cookies sent/received from CFNetwork
https://bugs.webkit.org/show_bug.cgi?id=325665
rdar://124266311
Reviewed by Anne van Kesteren and Alex Christensen.
This PR fixes cookie encoding issues on the ingress and
egress path between WebKit and CFNetwork.
Ingress: WebKit would send DOM cookies to CFNetwork as
strings comprised of Unicode characters, via the
document.cookie API or the cookieStore.set API.
This causes a problem because CFNetwork expects ISO-Latin1
characters in strings (per RFC6265) and would only parse the
cookie string until the first non-Latin1 character, discarding
the rest.
To solve this, WebKit should encode all DOM cookies
into UTF-8 and reinterpret those bytes as a Latin-1
string. When done like this, CFNetwork will correctly
parse the string and store it without losing any characters.
Egress: When reading cookies for DOM, WebKit would read
cookie strings from CFNetwork as Latin-1 characters. We have
observed that other browsers do a lossy reinterpretation
of the cookie as UTF-8. To match the behavior, WebKit now
does a lossy UTF-8 reinterpretation of the name and value,
only for Javascript DOM purposes.
Note: This change regresses the behavior of cookieStore.set(...).
Cookies set using this API that contain non-ASCII unicode characters
are double-encoded in the Cookie header due to a known issue
with the Darwin networking stack (rdar://188107044). The same issue
also occurs when setting such a cookie via `document.cookie`.
This change is still worthwhile because it standardizes the cookie
strings to Latin-1 encoding, which is what CFNetwork expects.
Added new layout tests for document.cookie and cookie store APIs
* LayoutTests/TestExpectations:
*
LayoutTests/fast/cookies/cookie-name-and-value-with-unicode-characters-expected.txt:
Added.
* LayoutTests/fast/cookies/cookie-name-and-value-with-unicode-characters.html:
Added.
*
LayoutTests/http/tests/cookies/cookie-store-change-event-with-unicode-characters.https-expected.txt:
Added.
*
LayoutTests/http/tests/cookies/cookie-store-change-event-with-unicode-characters.https.html:
Added.
*
LayoutTests/http/tests/cookies/cookie-store-delete-with-unicode-name.https-expected.txt:
Added.
*
LayoutTests/http/tests/cookies/cookie-store-delete-with-unicode-name.https.html:
Added.
*
LayoutTests/http/tests/cookies/cookie-store-document-cookie-interop-with-unicode-characters.https-expected.txt:
Added.
*
LayoutTests/http/tests/cookies/cookie-store-document-cookie-interop-with-unicode-characters.https.html:
Added.
*
LayoutTests/http/tests/cookies/cookie-store-get-set-with-unicode-characters.https-expected.txt:
Added.
*
LayoutTests/http/tests/cookies/cookie-store-get-set-with-unicode-characters.https.html:
Added.
*
LayoutTests/http/tests/cookies/cookie-store-set-size-limit-with-unicode-characters.https-expected.txt:
Added.
*
LayoutTests/http/tests/cookies/cookie-store-set-size-limit-with-unicode-characters.https.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/cookies/encoding/charset-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/cookiestore/change_eventhandler_for_document_cookie.https.window-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/cookiestore/change_eventhandler_for_http_cookie_and_set_cookie_headers.https.window-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/cookiestore/encoding.https.any-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/cookiestore/encoding.https.any.serviceworker-expected.txt:
* LayoutTests/platform/ios/TestExpectations:
* LayoutTests/platform/mac/TestExpectations:
* Source/WebCore/Modules/cookie-store/CookieListItem.h:
(WebCore::CookieListItem::fromCookie):
* Source/WebCore/Modules/cookie-store/CookieStore.cpp:
(WebCore::CookieStore::getShared):
(WebCore::CookieStore::set):
(WebCore::CookieStore::remove):
* Source/WebCore/dom/Document.cpp:
(WebCore::Document::setCookie):
* Source/WebCore/platform/Cookie.h:
* Source/WebCore/platform/network/Cookie.cpp:
(WebCore::CookieUtil::cookieStringForScript):
(WebCore::CookieUtil::cookieStringForStorage):
* Source/WebCore/platform/network/cocoa/CookieCocoa.mm:
(WebCore::CookieUtil::cookieStringForScript):
(WebCore::CookieUtil::cookieStringForStorage):
* Source/WebCore/platform/network/cocoa/CookieStorageSessionCocoa.mm:
(WebCore::CookieStorageSession::cookiesForSession const):
* Source/WebKit/WebProcess/WebPage/WebCookieCache.cpp:
(WebKit::cookiesToString):
Canonical link: https://commits.webkit.org/322447@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
