Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: d453e9b01d8a5935d007b60f45d5e84594bf0996
https://github.com/WebKit/WebKit/commit/d453e9b01d8a5935d007b60f45d5e84594bf0996
Author: Basuke Suzuki <[email protected]>
Date: 2026-10-09 (Fri, 09 Oct 2026)
Changed paths:
M Source/WebCore/loader/DocumentThreadableLoader.cpp
M Source/WebCore/loader/cache/CachedResourceLoader.cpp
M Source/WebCore/loader/cache/CachedResourceLoader.h
M Source/WebCore/platform/LegacySchemeRegistry.cpp
M Source/WebCore/platform/LegacySchemeRegistry.h
M Source/WebKit/WebProcess/WebPage/WebPage.cpp
M Source/WebKit/WebProcess/WebProcess.cpp
M Source/WebKit/WebProcess/WebProcess.h
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/CreateWebArchive.mm
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKURLSchemeHandler-1.mm
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WebsitePolicies.mm
Log Message:
-----------
Cherry-pick 321782@main (0e878ab17f77).
https://bugs.webkit.org/show_bug.cgi?id=326992
Cherry-pick [email protected] (3fa88516dc20).
rdar://188123167
Revert the app custom-scheme CORS enforcement on safari-7624.5-branch
rdar://182056880
Reviewed by Chris Dumez.
The CORS enforcement added for rdar://178748484 blocks no-cors
subresource
loads whenever the document origin's scheme differs from the subresource
scheme, in both directions. This breaks the legitimate pattern of a page
loaded over http(s) (e.g. via -loadData:...baseURL: or
-loadHTMLString:...)
that then loads subresources from a custom scheme the app itself
registered
with a WKURLSchemeHandler:
Unsafe attempt to load URL custom-scheme://... from origin
https://...
Apple News hits this (rdar://182056880, a LuckG release blocker: Sports
team
logos fail to load in World Cup / Sports feeds), as does a third-party
app
(rdar://182251092). The intended threat model was the opposite
direction only
(a custom-scheme document reaching out to fetch other content), so both
of
these are collateral breakage.
The follow-up relaxations only covered a subset of app content: opaque
and
file: origins (rdar://179999480) and app-provided custom-scheme document
origins (rdar://181845365, Books), but not http(s)-origin app-loaded
documents.
The enforcement is not present on main/trunk and was already reverted
from
the 26.5 branches (rdar://178748484). Align safari-7624.5-branch with
that
state by reverting the enforcement and its relaxations:
Revert 349f00426824 (rdar://181845365)
Revert 111cc2819a4d (rdar://179999480)
Revert 83b41e4ce721 (rdar://178748484)
No new tests (revert of a landed change; removes the tests added with
it).
Identifier: [email protected]
Canonical link: https://commits.webkit.org/321782@main
Canonical link: https://commits.webkit.org/317695.433@webkitglib/2.54
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
