Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8e1483499e1ae03695dfa2a7ca4945b18d2200cd
https://github.com/WebKit/WebKit/commit/8e1483499e1ae03695dfa2a7ca4945b18d2200cd
Author: Adrian Taylor <[email protected]>
Date: 2026-10-07 (Wed, 07 Oct 2026)
Changed paths:
M Source/WebKit/Platform/IPC/Untrusted.h
M Source/WebKit/UIProcess/Automation/WebAutomationSession.cpp
M Source/WebKit/UIProcess/Inspector/Agents/ProxyingPageAgent.cpp
M Source/WebKit/UIProcess/Inspector/Agents/ProxyingPageAgent.h
M Source/WebKit/UIProcess/ProvisionalPageProxy.cpp
M Source/WebKit/UIProcess/SpeechRecognitionServer.cpp
M
Source/WebKit/UIProcess/WebAuthentication/Cocoa/WebAuthenticatorCoordinatorProxy.mm
M
Source/WebKit/UIProcess/WebAuthentication/WebAuthenticatorCoordinatorProxy.cpp
M
Source/WebKit/UIProcess/WebAuthentication/WebAuthenticatorCoordinatorProxy.h
M Source/WebKit/UIProcess/WebFrameProxy.cpp
M Source/WebKit/UIProcess/WebFrameProxy.h
M Source/WebKit/UIProcess/WebGeolocationManagerProxy.cpp
M Source/WebKit/UIProcess/WebLockRegistryProxy.cpp
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/UIProcess/WebPageProxy.h
M Source/WebKit/UIProcess/WebPermissionControllerProxy.cpp
M Source/WebKit/UIProcess/WebProcessProxy.cpp
M Source/WebKit/UIProcess/XR/PlatformXRSystem.cpp
M Source/WebKit/UIProcess/XR/PlatformXRSystem.h
Log Message:
-----------
Validate almost all origins flowing from WCP to UI process
https://bugs.webkit.org/show_bug.cgi?id=323231
rdar://186478592
Reviewed by Zak Ridouh.
Sixth in a series proving all origins are validated when flowing from the WCP
to the
UI process. This is the commit which turns the validation on: 32 of the 37
UI-process
origin parameters are now validated; 5 keep a bypass with a reason recorded at
the
call site. See ValidationProcedures.h for the checks, added by earlier no-op
commits.
Almost all of it is confined to site-isolated configurations. The two app-badge
messages are the exception because they already validated the origin
unconditionally, and so pass ShouldCheckWithoutSiteIsolation::Yes. WebAuthn also
now checks that the rpId truly matches.
Seven of them were already checked by hand - the five Web
Locks messages and the two app-badge ones - and that check is simply replaced
by the
typed one. The rest did not previously exist.
- WebProcessProxy::didCollectPrewarmInformation, didCompleteAutofill and
didObserveFirstPartyUserGesture previously only rejected an empty value. All
three
write into site-isolation bookkeeping, so a process naming another site's
domain
corrupts that site's state.
- WebPageProxy's capture and DRM permission messages previously trusted the
origin
they were handed. It appears in the camera, microphone and key-system prompts
and
in the granted-permission state.
- The capture messages carry two origins, and only one is a claim the sender
makes
about itself. The requesting document's origin goes through the sending
process;
the page's top-level origin does not, because a cross-origin iframe may
legitimately request capture without authority over it, so that parameter is
checked against the main frame's process, as BeginSystemPreview does.
- DidCommitLoadForFrame's set of CSP upgrade origins is validated in
WebPageProxy's
handler; ProvisionalPageProxy's copy bypasses and forwards it there.
Two kinds of commit have an origin the UI process cannot derive from the URL it
navigated to: a web archive's document carries the origin of the archived
content, and an opaque origin is a nonce the web process minted. WebFrameProxy
now records the origin the web process reports for those and validates against
it,
keying the archive case on the load the UI process asked for rather than the
reported content type. This change is visible without site isolation, via the
Web Locks checks that already called hasCommittedClientOrigin by hand.
The five remaining bypasses, each with an UnvalidatedReason:
- PostMessageToRemote's targetOrigin is RequestTarget: it is the origin the
sender
is addressing, not one it claims to be.
- PostMessageToRemote's sourceOrigin is ValidatedElsewhere: the handler
requires the
sender to own the source frame and compares the origin against what it
committed.
- GetAssertion's parentOrigin is ValidatedElsewhere: the handler walks the
frame's
ancestor chain, stronger than domain authority where an ancestor is
HTTP-family.
- WebGeolocationManagerProxy::StartUpdating's domain is ValidatedElsewhere: it
is
checked against the domain bound to the authorization token the permission
manager
issued, stronger again.
- WebAutomationSession::ScriptRealmCreated's origin is NotSecuritySensitive: it
labels a realm for the automation client, which already drives the browser.
* Source/WebKit/Platform/IPC/Untrusted.h:
* Source/WebKit/UIProcess/Automation/WebAutomationSession.cpp:
(WebKit::WebAutomationSession::scriptRealmCreated):
* Source/WebKit/UIProcess/Inspector/Agents/ProxyingPageAgent.cpp:
(Inspector::ProxyingPageAgent::frameNavigated):
* Source/WebKit/UIProcess/Inspector/Agents/ProxyingPageAgent.h:
* Source/WebKit/UIProcess/ProvisionalPageProxy.cpp:
(WebKit::ProvisionalPageProxy::didCommitLoadForFrame):
* Source/WebKit/UIProcess/SpeechRecognitionServer.cpp:
(WebKit::SpeechRecognitionServer::start):
*
Source/WebKit/UIProcess/WebAuthentication/Cocoa/WebAuthenticatorCoordinatorProxy.mm:
(WebKit::WebAuthenticatorCoordinatorProxy::isConditionalMediationAvailable):
(WebKit::WebAuthenticatorCoordinatorProxy::getClientCapabilities):
(WebKit::WebAuthenticatorCoordinatorProxy::isUserVerifyingPlatformAuthenticatorAvailable):
(WebKit::WebAuthenticatorCoordinatorProxy::signalUnknownCredential):
(WebKit::WebAuthenticatorCoordinatorProxy::signalAllAcceptedCredentials):
(WebKit::WebAuthenticatorCoordinatorProxy::signalCurrentUserDetails):
*
Source/WebKit/UIProcess/WebAuthentication/WebAuthenticatorCoordinatorProxy.cpp:
(WebKit::WebAuthenticatorCoordinatorProxy::getAssertion):
(WebKit::WebAuthenticatorCoordinatorProxy::isUserVerifyingPlatformAuthenticatorAvailable):
(WebKit::WebAuthenticatorCoordinatorProxy::isConditionalMediationAvailable):
* Source/WebKit/UIProcess/WebAuthentication/WebAuthenticatorCoordinatorProxy.h:
* Source/WebKit/UIProcess/WebFrameProxy.cpp:
(WebKit::WebFrameProxy::didCommitLoad):
(WebKit::WebFrameProxy::committedDocumentSecurityOriginData const):
(WebKit::WebFrameProxy::setAppBadge):
(WebKit::WebFrameProxy::didChangeCSPOriginsThatUpgradeInsecureNavigations):
* Source/WebKit/UIProcess/WebFrameProxy.h:
* Source/WebKit/UIProcess/WebGeolocationManagerProxy.cpp:
(WebKit::WebGeolocationManagerProxy::startUpdating):
(WebKit::WebGeolocationManagerProxy::stopUpdating):
(WebKit::WebGeolocationManagerProxy::setEnableHighAccuracy):
* Source/WebKit/UIProcess/WebLockRegistryProxy.cpp:
(WebKit::WebLockRegistryProxy::requestLock):
(WebKit::WebLockRegistryProxy::releaseLock):
(WebKit::WebLockRegistryProxy::abortLockRequest):
(WebKit::WebLockRegistryProxy::snapshot):
(WebKit::WebLockRegistryProxy::clientIsGoingAway):
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::didCommitLoadForFrame):
(WebKit::WebPageProxy::requestUserMediaPermissionForFrame):
(WebKit::WebPageProxy::enumerateMediaDevicesForFrame):
(WebKit::WebPageProxy::validateCaptureStateUpdate):
(WebKit::WebPageProxy::requestMediaKeySystemPermissionForFrame):
(WebKit::WebPageProxy::beginSystemPreview):
(WebKit::WebPageProxy::dispatchCrossOriginBeforeUnloadCheckForFrame):
(WebKit::webArchiveSourceForNavigation):
(WebKit::WebPageProxy::updateDataStoreForWebArchiveLoad):
* Source/WebKit/UIProcess/WebPageProxy.h:
* Source/WebKit/UIProcess/WebPermissionControllerProxy.cpp:
(WebKit::WebPermissionControllerProxy::query):
* Source/WebKit/UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::didCollectPrewarmInformation):
(WebKit::WebProcessProxy::didCompleteAutofill):
(WebKit::WebProcessProxy::didObserveFirstPartyUserGesture):
(WebKit::WebProcessProxy::setAppBadgeFromWorker):
* Source/WebKit/UIProcess/XR/PlatformXRSystem.cpp:
(WebKit::PlatformXRSystem::requestPermissionOnSessionFeatures):
* Source/WebKit/UIProcess/XR/PlatformXRSystem.h:
Canonical link: https://commits.webkit.org/322953@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
