Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: cca8fa6465d064cab9e5048cff55409591e69266
https://github.com/WebKit/WebKit/commit/cca8fa6465d064cab9e5048cff55409591e69266
Author: Alex Christensen <[email protected]>
Date: 2026-10-12 (Mon, 12 Oct 2026)
Changed paths:
M Source/WebKit/Shared/FrameInfoData.cpp
M Source/WebKit/Shared/FrameInfoData.h
M Source/WebKit/Shared/FrameInfoData.serialization.in
M Source/WebKit/UIProcess/Cocoa/UIDelegate.mm
M Source/WebKit/UIProcess/ProvisionalPageProxy.cpp
M Source/WebKit/UIProcess/WebFrameProxy.cpp
M Source/WebKit/UIProcess/WebFrameProxy.h
M
Source/WebKit/UIProcess/WebsiteData/WebDeviceOrientationAndMotionAccessController.cpp
M Source/WebKit/UIProcess/ios/PageClientImplIOS.mm
M Source/WebKit/UIProcess/ios/WKGeolocationProviderIOS.h
M Source/WebKit/UIProcess/ios/WKGeolocationProviderIOS.mm
M Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
M Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.cpp
M Source/WebKit/WebProcess/WebPage/WebFrame.cpp
Log Message:
-----------
Remove FrameInfoData.topOrigin
https://bugs.webkit.org/show_bug.cgi?id=326526
rdar://189318827
Reviewed by Ben Nham.
We shouldn't be trusting a possibly-compromised web content process to correctly
report its top origin. The UI process already has that info. Also, don't use
WebFrameProxy::rootFrame, which is not necessarily the main frame when site
isolation
is enabled.
In order to keep TestWebKitAPI.DeviceOrientation.RememberPermissionForSession
passing,
I need to set m_documentSecurityOrigin to an opaque origin when navigating to
about:blank
whether or not it's for initialization. The test uses WKWebView.loadRequest to
navigate to about:blank, and the main frame's origin should not be kept in that
case.
* Source/WebKit/Shared/FrameInfoData.cpp:
(WebKit::legacyEmptyFrameInfo):
* Source/WebKit/Shared/FrameInfoData.h:
* Source/WebKit/Shared/FrameInfoData.serialization.in:
* Source/WebKit/UIProcess/Cocoa/UIDelegate.mm:
(WebKit::UIDelegate::UIClient::decidePolicyForGeolocationPermissionRequest):
(WebKit::UIDelegate::UIClient::shouldAllowDeviceOrientationAndMotionAccess):
* Source/WebKit/UIProcess/ProvisionalPageProxy.cpp:
(WebKit::ProvisionalPageProxy::cancel):
* Source/WebKit/UIProcess/WebFrameProxy.cpp:
(WebKit::WebFrameProxy::getFrameInfo):
(WebKit::WebFrameProxy::mainFrame):
(WebKit::WebFrameProxy::WebFrameProxy):
(WebKit::WebFrameProxy::updateDocumentSecurityOrigin):
* Source/WebKit/UIProcess/WebFrameProxy.h:
*
Source/WebKit/UIProcess/WebsiteData/WebDeviceOrientationAndMotionAccessController.cpp:
(WebKit::WebDeviceOrientationAndMotionAccessController::shouldAllowAccess):
* Source/WebKit/UIProcess/ios/PageClientImplIOS.mm:
(WebKit::PageClientImpl::decidePolicyForGeolocationPermissionRequest):
* Source/WebKit/UIProcess/ios/WKGeolocationProviderIOS.h:
* Source/WebKit/UIProcess/ios/WKGeolocationProviderIOS.mm:
(-[WKGeolocationProviderIOS
decidePolicyForGeolocationRequestFromOrigin:topOrigin:completionHandler:view:]):
(-[WKGeolocationProviderIOS geolocationAuthorizationGranted]):
(-[WKGeolocationProviderIOS
decidePolicyForGeolocationRequestFromOrigin:completionHandler:view:]): Deleted.
* Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
(WebKit::WebFrameLoaderClient::navigationActionData const):
* Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.cpp:
(WebKit::WebLocalFrameLoaderClient::dispatchDidCommitLoad):
* Source/WebKit/WebProcess/WebPage/WebFrame.cpp:
(WebKit::WebFrame::info const):
Canonical link: https://commits.webkit.org/323489@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
