Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 5044a542fff2e6738265591c28b44eedf72c6bd8
https://github.com/WebKit/WebKit/commit/5044a542fff2e6738265591c28b44eedf72c6bd8
Author: Charlie Wolfe <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
A
LayoutTests/ipc/forged-resource-load-statistics-storage-access-expected.txt
A LayoutTests/ipc/forged-resource-load-statistics-storage-access.html
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
Log Message:
-----------
Validate several ITP and storage access IPC messages
https://bugs.webkit.org/show_bug.cgi?id=312798
rdar://174708437
Reviewed by Matthew Finkel.
ResourceLoadStatisticsUpdated, LogUserInteraction, and
RequestStorageAccessUnderOpener accept
WebContent-supplied data with no validation. A WCP can forge
storageAccessUnderTopFrameDomains and
isPrevalentResource in the ITP database, then obtain cross-origin cookie access
without a user
prompt.
Verify that ResourceLoadStatisticsUpdated only contains fields the WebContent
process legitimately
observes, and that LogUserInteraction and RequestStorageAccessUnderOpener are
called with domains
the process owns.
Test: ipc/forged-resource-load-statistics-storage-access.html
* LayoutTests/ipc/forged-resource-load-statistics-storage-access-expected.txt:
Added.
* LayoutTests/ipc/forged-resource-load-statistics-storage-access.html: Added.
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::logUserInteraction):
(WebKit::resourceLoadStatisticsContainsOnlyObservableFields):
(WebKit::NetworkConnectionToWebProcess::resourceLoadStatisticsUpdated):
(WebKit::NetworkConnectionToWebProcess::requestStorageAccessUnderOpener):
Originally-landed-as: 305413.716@safari-7624-branch (9d8f969c538a).
rdar://180428563
Canonical link: https://commits.webkit.org/316149@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
