Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: a18c0a8d15801b652cd1db8724d3d07e129f14bd
https://github.com/WebKit/WebKit/commit/a18c0a8d15801b652cd1db8724d3d07e129f14bd
Author: Rupin Mittal <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
Log Message:
-----------
Unvalidated replacementPath in
NetworkConnectionToWebProcess::registerInternalFileBlobURL() could lead to
wrongful file deletion
https://bugs.webkit.org/show_bug.cgi?id=314149
rdar://175677292
Reviewed by Brady Eidson and Per Arne Vollan.
NetworkConnectionToWebProcess::registerInternalFileBlobURL() takes in a a file
path called replacementPath and a SandboxExtensionHandle. If the web process
sends an empty handle, then the only validation done on replacementPath is
isFilePathAllowed(), which may be too permissive. Later on, the web process
could
send the IPC NetworkConnectionToWebProcess::unregisterBlobURL() with a null
topOrigin, which kicks off this chain: BlobData destroyed, BlobDataFileReference
destroyed, FileSystem::deleteFile(m_replacementPath) which deleted the file at
the replacementPath that was passed in.
This may allow the web process to delete a file that it shouldn't be able to.
To prevent this, we add a message check which confirms that if the web process
would like to use the file at the replacementPath it specifies, it must have
a sandbox extension allowing it to do so. Otherwise, the web process will be
terminated.
We also add a fixme comment to note that in the future, we should look into
ensuring that the web process does not send file paths to the network process
at all.
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::registerInternalFileBlobURL):
Originally-landed-as: 305413.843@safari-7624-branch (32b29db38205).
rdar://180437008
Canonical link: https://commits.webkit.org/316166@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
