Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 222ccc4aa007cbc105bf864cfcf010e03e877376
https://github.com/WebKit/WebKit/commit/222ccc4aa007cbc105bf864cfcf010e03e877376
Author: Alex Christensen <[email protected]>
Date: 2026-10-09 (Fri, 09 Oct 2026)
Changed paths:
M Source/WebCore/page/DragController.cpp
M Source/WebCore/page/DragController.h
M Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm
M Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm
M Tools/TestWebKitAPI/Helpers/cocoa/DragAndDropSimulator.h
M Tools/TestWebKitAPI/Helpers/ios/DragAndDropSimulatorIOS.mm
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ios/DragAndDropTestsIOS.mm
Log Message:
-----------
[Site Isolation] If drag initiator is in another process, assume it fails the
same-origin check
https://bugs.webkit.org/show_bug.cgi?id=326389
rdar://160891159
Reviewed by Sihui Liu.
As the code was written, if the drag initiator was in another process, we would
not do the origin check
and assume it passes. That was incorrect, causing drag events to happen with
site isolation on that
should not have happened because the source was in a different origin.
To make it work on iOS, I had to add DragApplicationFlags::IsSource to the
flags like we do on macOS.
Before this, the only use of DragApplicationFlags::IsSource was on macOS, so
that won't have any
other side effects.
To keep TestWebKitAPI.DragAndDropTests.AdditionalItemsCanBePreventedOnDragStart
working on iOS, I needed
to make it so that the dragEnded call from
WebPage::requestAdditionalItemsForDragSession doesn't clear
m_dragInitiator.
To keep
TestWebKitAPI.DragAndDropTests.AddLinkFromCrossOriginIframeToDragSession
working, I needed to
update its expectations to expect no cross-origin drops. This matches the
behavior of the test with
site isolation off, which doesn't seem to have been considered in the authoring
of the test last week.
Tests: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm
Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ios/DragAndDropTestsIOS.mm
* Source/WebCore/page/DragController.cpp:
(WebCore::DragController::tryDocumentDrag):
(WebCore::DragController::dragEnded):
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:
(TestWebKitAPI::TEST(SiteIsolation, DragSecurityOriginCheck)):
* Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm:
(-[WKContentView dragDataForDropSession:dragDestinationAction:]):
* Tools/TestWebKitAPI/Helpers/cocoa/DragAndDropSimulator.h:
* Tools/TestWebKitAPI/Helpers/ios/DragAndDropSimulatorIOS.mm:
(-[MockDropSession localDragSession]):
(-[MockDropSession setLocalDragSession:]):
(-[DragAndDropSimulator _advanceProgress]):
(-[DragAndDropSimulator _concludeDropAndPerformOperationIfNecessary]):
* Source/WebCore/page/DragController.h:
* Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm:
(WebKit::WebPage::requestAdditionalItemsForDragSession):
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ios/DragAndDropTestsIOS.mm:
(TestWebKitAPI::TEST(DragAndDropTests,
AddLinkFromCrossOriginIframeToDragSession)):
Canonical link: https://commits.webkit.org/323245@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
