Title: [244670] trunk/Source/WebKit
- Revision
- 244670
- Author
- [email protected]
- Date
- 2019-04-25 17:17:23 -0700 (Thu, 25 Apr 2019)
Log Message
Trying to load a main resource outside the sandbox should not crash the WebContent process
https://bugs.webkit.org/show_bug.cgi?id=197299
<rdar://problem/49808042>
Reviewed by Geoffrey Garen.
Trying to load a main resource outside the sandbox should not crash the WebContent process. We should
simply ignore the load and log an error message.
* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::decidePolicyForNavigationAction):
Modified Paths
Diff
Modified: trunk/Source/WebKit/ChangeLog (244669 => 244670)
--- trunk/Source/WebKit/ChangeLog 2019-04-25 23:08:09 UTC (rev 244669)
+++ trunk/Source/WebKit/ChangeLog 2019-04-26 00:17:23 UTC (rev 244670)
@@ -1,3 +1,17 @@
+2019-04-25 Chris Dumez <[email protected]>
+
+ Trying to load a main resource outside the sandbox should not crash the WebContent process
+ https://bugs.webkit.org/show_bug.cgi?id=197299
+ <rdar://problem/49808042>
+
+ Reviewed by Geoffrey Garen.
+
+ Trying to load a main resource outside the sandbox should not crash the WebContent process. We should
+ simply ignore the load and log an error message.
+
+ * UIProcess/WebPageProxy.cpp:
+ (WebKit::WebPageProxy::decidePolicyForNavigationAction):
+
2019-04-25 Timothy Hatcher <[email protected]>
Only send a synthetic mouse out event if synthetic mouse move events were sent.
Modified: trunk/Source/WebKit/UIProcess/WebPageProxy.cpp (244669 => 244670)
--- trunk/Source/WebKit/UIProcess/WebPageProxy.cpp 2019-04-25 23:08:09 UTC (rev 244669)
+++ trunk/Source/WebKit/UIProcess/WebPageProxy.cpp 2019-04-26 00:17:23 UTC (rev 244670)
@@ -4541,7 +4541,12 @@
if (!fromAPI)
m_pageLoadState.clearPendingAPIRequestURL(transaction);
- MESSAGE_CHECK_URL(process, request.url());
+ if (!checkURLReceivedFromCurrentOrPreviousWebProcess(process, request.url())) {
+ RELEASE_LOG_ERROR_IF_ALLOWED(Process, "Ignoring request to load this main resource because it is outside the sandbox");
+ sender->send(PolicyAction::Ignore, 0, DownloadID(), WTF::nullopt);
+ return;
+ }
+
MESSAGE_CHECK_URL(process, originalRequest.url());
RefPtr<API::Navigation> navigation;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
