Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ac57a2af8c0e77f9ce5528d6ddb457a12a462bd3
https://github.com/WebKit/WebKit/commit/ac57a2af8c0e77f9ce5528d6ddb457a12a462bd3
Author: Charlie Wolfe <[email protected]>
Date: 2026-10-08 (Thu, 08 Oct 2026)
Changed paths:
A
LayoutTests/http/tests/resourceLoadStatistics/prevalent-domain-script-expected.txt
A LayoutTests/http/tests/resourceLoadStatistics/prevalent-domain-script.html
A
LayoutTests/http/tests/resourceLoadStatistics/resources/create-prevalent-domain-code.js
A
LayoutTests/http/tests/resourceLoadStatistics/resources/is-prevalent-domain-script-on-stack.js
A
LayoutTests/http/tests/resourceLoadStatistics/resources/make-domains-prevalent.js
A
LayoutTests/http/tests/resourceLoadStatistics/third-party-script-not-prevalent-expected.txt
A
LayoutTests/http/tests/resourceLoadStatistics/third-party-script-not-prevalent.html
A LayoutTests/http/tests/resourceLoadStatistics/top-site-script-expected.txt
A LayoutTests/http/tests/resourceLoadStatistics/top-site-script.html
M LayoutTests/ipc/use-redirection-for-current-navigation-message-check.html
M Source/JavaScriptCore/CMakeLists.txt
M Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
M
Source/JavaScriptCore/SaferCPPExpectations/UncountedLocalVarsCheckerExpectations
M Source/JavaScriptCore/Sources.txt
M Source/JavaScriptCore/bytecode/CodeBlock.cpp
M Source/JavaScriptCore/interpreter/Interpreter.cpp
M Source/JavaScriptCore/parser/SourceCode.h
M Source/JavaScriptCore/parser/SourceProvider.cpp
M Source/JavaScriptCore/parser/SourceProvider.h
R Source/JavaScriptCore/parser/SourceTaintedOrigin.cpp
R Source/JavaScriptCore/parser/SourceTaintedOrigin.h
A Source/JavaScriptCore/parser/SourceTaintedness.cpp
A Source/JavaScriptCore/parser/SourceTaintedness.h
M Source/JavaScriptCore/runtime/CachedTypes.cpp
M Source/JavaScriptCore/runtime/Forward.h
M Source/JavaScriptCore/runtime/FunctionConstructor.cpp
M Source/JavaScriptCore/runtime/FunctionConstructor.h
M Source/JavaScriptCore/runtime/FunctionExecutable.cpp
M Source/JavaScriptCore/runtime/FunctionExecutable.h
M Source/JavaScriptCore/runtime/JSBoundFunction.cpp
M Source/JavaScriptCore/runtime/JSGlobalObject.cpp
M Source/JavaScriptCore/runtime/JSGlobalObject.h
M Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
M Source/JavaScriptCore/runtime/ShadowRealmPrototype.cpp
M Source/JavaScriptCore/runtime/VM.h
M Source/JavaScriptCore/wasm/WasmOperations.cpp
M Source/JavaScriptCore/wasm/js/JSWebAssembly.cpp
M Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h
M Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp
M Source/JavaScriptCore/wasm/js/WebAssemblyFunction.h
M Source/JavaScriptCore/wasm/js/WebAssemblyInstanceConstructor.cpp
M Source/WebCore/WebCorePrefix.h
M Source/WebCore/bindings/js/JSLazyEventListener.cpp
M Source/WebCore/bindings/js/JSLazyEventListener.h
M Source/WebCore/bindings/js/RunJavaScriptParameters.h
M Source/WebCore/bindings/js/ScheduledAction.cpp
M Source/WebCore/bindings/js/ScheduledAction.h
M Source/WebCore/bindings/js/ScriptController.cpp
M Source/WebCore/bindings/js/ScriptController.h
M Source/WebCore/bindings/js/ScriptSourceCode.h
M Source/WebCore/dom/ScriptElement.cpp
M Source/WebCore/dom/ScriptElement.h
M Source/WebCore/dom/ScriptExecutionContext.cpp
M Source/WebCore/platform/network/ResourceResponseBase.cpp
M Source/WebCore/platform/network/ResourceResponseBase.h
M Source/WebCore/testing/Internals.cpp
M Source/WebCore/testing/Internals.h
M Source/WebCore/testing/Internals.idl
M Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp
M Source/WebKit/NetworkProcess/NetworkResourceLoader.h
M Source/WebKit/NetworkProcess/NetworkSession.cpp
M Source/WebKit/NetworkProcess/NetworkSession.h
M Source/WebKit/Shared/JavaScriptCore.serialization.in
M Source/WebKit/Shared/WebCoreArgumentCodersNetwork.serialization.in
M Source/WebKit/WebKitPrefix.h
M Source/WebKit/WebProcess/Automation/WebAutomationSessionProxy.cpp
Log Message:
-----------
Add a prevalent domain taint kind to JSC source taintedness
https://bugs.webkit.org/show_bug.cgi?id=326466
rdar://189264144
Reviewed by Keith Miller.
JSC tracks a single SourceTaintedOrigin per SourceProvider, which is only used
for script tracking
privacy. This adds a second, independent kind of taint so WebCore can tell when
code from a domain
that ITP classifies as prevalent is on the stack.
SourceTaintedness holds one SourceTaintedOrigin per SourceTaintKind
(ScriptTrackingPrivacy,
PrevalentDomain). Each kind propagates to newly created code on its own.
The network process sets ResourceResponse::isFromPrevalentDomain on script
responses, since it is
the only process that knows ITP's classification. This flag is not persisted.
Tests: http/tests/resourceLoadStatistics/prevalent-domain-script.html
http/tests/resourceLoadStatistics/third-party-script-not-prevalent.html
http/tests/resourceLoadStatistics/top-site-script.html
*
LayoutTests/http/tests/resourceLoadStatistics/prevalent-domain-script-expected.txt:
Added.
* LayoutTests/http/tests/resourceLoadStatistics/prevalent-domain-script.html:
Added.
*
LayoutTests/http/tests/resourceLoadStatistics/resources/create-prevalent-domain-code.js:
Added.
(window.prevalentDomainFunction):
*
LayoutTests/http/tests/resourceLoadStatistics/resources/is-prevalent-domain-script-on-stack.js:
Added.
*
LayoutTests/http/tests/resourceLoadStatistics/resources/make-domains-prevalent.js:
Added.
(async makeDomainsPrevalent):
(makeTestSitesPrevalent):
(otherSiteHost):
(loadScript):
*
LayoutTests/http/tests/resourceLoadStatistics/third-party-script-not-prevalent-expected.txt:
Added.
*
LayoutTests/http/tests/resourceLoadStatistics/third-party-script-not-prevalent.html:
Added.
* LayoutTests/http/tests/resourceLoadStatistics/top-site-script-expected.txt:
Added.
* LayoutTests/http/tests/resourceLoadStatistics/top-site-script.html: Added.
* Source/JavaScriptCore/CMakeLists.txt:
* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:
*
Source/JavaScriptCore/SaferCPPExpectations/UncountedLocalVarsCheckerExpectations:
* Source/JavaScriptCore/Sources.txt:
* Source/JavaScriptCore/bytecode/CodeBlock.cpp:
(JSC::CodeBlock::CodeBlock):
* Source/JavaScriptCore/interpreter/Interpreter.cpp:
(JSC::eval):
(JSC::Interpreter::executeProgram):
* Source/JavaScriptCore/parser/SourceCode.h:
(JSC::makeSource):
* Source/JavaScriptCore/parser/SourceProvider.cpp:
(JSC::SourceProvider::SourceProvider):
* Source/JavaScriptCore/parser/SourceProvider.h:
(JSC::SourceProvider::setSourceTaintedOrigin):
(JSC::SourceProvider::taintedness const):
(JSC::SourceProvider::sourceTaintedOrigin const):
(JSC::SourceProvider::couldBeTainted const):
(JSC::StringSourceProvider::create):
(JSC::StringSourceProvider::StringSourceProvider):
* Source/JavaScriptCore/parser/SourceTaintedOrigin.cpp: Removed.
* Source/JavaScriptCore/parser/SourceTaintedness.cpp: Added.
(JSC::sourceTaintedOriginToString):
(JSC::sourceProviderIfCouldBeTainted):
(JSC::highestSourceTaintednessOnStack):
(JSC::sourceTaintedOriginFromStack):
(JSC::sourceTaintednessFromStack):
(JSC::computeNewSourceTaintednessFromStack):
(JSC::markSourceAsPrevalentDomainTainted):
(JSC::isPrevalentDomainTaintedCodeOnStack):
* Source/JavaScriptCore/parser/SourceTaintedness.h: Renamed from
Source/JavaScriptCore/parser/SourceTaintedOrigin.h.
(JSC::taintednessToTriState):
(JSC::SourceTaintedness::SourceTaintedness):
(JSC::SourceTaintedness::forEveryKind):
(JSC::SourceTaintedness::operator[] const):
(JSC::SourceTaintedness::couldBeTainted const):
(JSC::SourceTaintedness::isTainted const):
(JSC::SourceTaintedness::back):
* Source/JavaScriptCore/runtime/CachedTypes.cpp:
(JSC::CachedSourceProviderShape::encode):
(JSC::CachedSourceProviderShape::decode const):
* Source/JavaScriptCore/runtime/Forward.h:
* Source/JavaScriptCore/runtime/FunctionConstructor.cpp:
(JSC::constructFunction):
(JSC::constructFunctionSkippingEvalEnabledCheck):
* Source/JavaScriptCore/runtime/FunctionConstructor.h:
* Source/JavaScriptCore/runtime/FunctionExecutable.cpp:
(JSC::FunctionExecutable::fromGlobalCode):
* Source/JavaScriptCore/runtime/FunctionExecutable.h:
* Source/JavaScriptCore/runtime/JSBoundFunction.cpp:
(JSC::JSBoundFunction::create):
(JSC::JSBoundFunction::createRaw):
(JSC::JSBoundFunction::JSBoundFunction):
* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::tryGetCachedFunctionExecutableForFunctionConstructor):
* Source/JavaScriptCore/runtime/JSGlobalObject.h:
* Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/runtime/ShadowRealmPrototype.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/runtime/VM.h:
(JSC::VM::mightHavePrevalentDomainTaintedCode const):
(JSC::VM::setMightHavePrevalentDomainTaintedCode):
* Source/JavaScriptCore/wasm/WasmOperations.cpp:
(JSC::Wasm::JSC_DEFINE_JIT_OPERATION):
* Source/JavaScriptCore/wasm/js/JSWebAssembly.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h:
* Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/wasm/js/WebAssemblyFunction.h:
* Source/JavaScriptCore/wasm/js/WebAssemblyInstanceConstructor.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/WebCore/WebCorePrefix.h:
* Source/WebCore/bindings/js/JSLazyEventListener.cpp:
(WebCore::JSLazyEventListener::JSLazyEventListener):
* Source/WebCore/bindings/js/JSLazyEventListener.h:
* Source/WebCore/bindings/js/RunJavaScriptParameters.h:
(WebCore::RunJavaScriptParameters::RunJavaScriptParameters):
* Source/WebCore/bindings/js/ScheduledAction.cpp:
(WebCore::ScheduledAction::ScheduledAction):
* Source/WebCore/bindings/js/ScheduledAction.h:
* Source/WebCore/bindings/js/ScriptController.cpp:
(WebCore::ScriptController::executeScriptIgnoringException):
(WebCore::ScriptController::executeScriptInWorldIgnoringException):
* Source/WebCore/bindings/js/ScriptController.h:
* Source/WebCore/bindings/js/ScriptSourceCode.h:
(WebCore::ScriptSourceCode::ScriptSourceCode):
(WebCore::ScriptSourceCode::provider const):
(WebCore::ScriptSourceCode::provider): Deleted.
* Source/WebCore/dom/ScriptElement.cpp:
(WebCore::ScriptElement::ScriptElement):
(WebCore::ScriptElement::updateTaintedOriginFromSourceURL):
(WebCore::markSourceAsPrevalentDomainTaintedIfNeeded):
(WebCore::ScriptElement::executeClassicScript):
* Source/WebCore/dom/ScriptElement.h:
(WebCore::ScriptElement::sourceTaintedOrigin const):
* Source/WebCore/dom/ScriptExecutionContext.cpp:
* Source/WebCore/platform/network/ResourceResponseBase.cpp:
(WebCore::ResourceResponseData::isolatedCopy const):
(WebCore::ResourceResponseBase::crossThreadData const):
(WebCore::ResourceResponseBase::fromCrossThreadData):
(WebCore::ResourceResponseBase::getResponseData const):
(WTF::Persistence::Coder<WebCore::ResourceResponseData>::decodeForPersistence):
* Source/WebCore/platform/network/ResourceResponseBase.h:
(WebCore::ResourceResponseBase::isFromPrevalentDomain const):
(WebCore::ResourceResponseBase::setIsFromPrevalentDomain):
(WebCore::ResourceResponseData::ResourceResponseData):
* Source/WebCore/testing/Internals.cpp:
(WebCore::Internals::isPrevalentDomainScriptOnStack const):
* Source/WebCore/testing/Internals.h:
* Source/WebCore/testing/Internals.idl:
* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:
(WebKit::NetworkResourceLoader::continueDidReceiveResponseAfterLocalNetworkAccessCheck):
(WebKit::NetworkResourceLoader::setIsFromPrevalentDomainIfNeeded const):
(WebKit::NetworkResourceLoader::continueDidRetrieveCacheEntryAfterLocalNetworkAccessCheck):
* Source/WebKit/NetworkProcess/NetworkResourceLoader.h:
* Source/WebKit/NetworkProcess/NetworkSession.cpp:
(WebKit::NetworkSession::isPrevalentDomain const):
* Source/WebKit/NetworkProcess/NetworkSession.h:
* Source/WebKit/Shared/JavaScriptCore.serialization.in:
* Source/WebKit/Shared/WebCoreArgumentCodersNetwork.serialization.in:
* Source/WebKit/WebKitPrefix.h:
* Source/WebKit/WebProcess/Automation/WebAutomationSessionProxy.cpp:
Canonical link: https://commits.webkit.org/323174@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
