Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b12f122d84409745fa49aa45e2776aa59fdda5aa
https://github.com/WebKit/WebKit/commit/b12f122d84409745fa49aa45e2776aa59fdda5aa
Author: Abrar Rahman Protyasha <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
M Source/WebKit/UIProcess/mac/WebPageProxyMac.mm
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/UIDelegate.mm
Log Message:
-----------
Compromised web content processes can use percent-encoded path separators in
PDF suggested filenames to write outside temporary directory
rdar://174079512
Reviewed by Wenson Hsieh.
The pdfOpenWithPreview IPC response sanitizes the WCP supplied filename
while it is still percent encoded. Then, pathToPDFOnDisk percent decodes
the assembled path. As such, a %2F (`/`) sequence can pass through
sanitization but still decodes to `/` after assembly.
This means that a compromised web content process could write to a PDF
file outside of the temporary WebKit PDF directory with a properly
crafted IPC message.
In this patch, we address this asymmetry by percent decoding the
filename before sanitization. We also remove the percent decoding that
happens post joining. Instead, we enforce an invariant that rejects any
sanitized filename that is not its own last path component.
Tests: TestWebKitAPI.WebKit.OpenPDFWithPreviewIPCTraversalEncodedFilename
TestWebKitAPI.WebKit.OpenPDFWithPreviewIPCTraversalUnencodedFilename
* Source/WebKit/UIProcess/mac/WebPageProxyMac.mm:
(WebKit::pathToPDFOnDisk):
(WebKit::WebPageProxy::savePDFToTemporaryFolderAndOpenWithNativeApplication):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/UIDelegate.mm:
(-[OpenPDFWithPreviewDelegate
_webView:shouldAllowPDFAtURL:toOpenFromFrame:completionHandler:]):
((WebKit, OpenPDFWithPreviewIPCTraversalEncodedFilename)):
((WebKit, OpenPDFWithPreviewIPCTraversalUnencodedFilename)):
Originally-landed-as: 305413.948@safari-7624-branch (06ccfa7d7a2d).
rdar://180438093
Canonical link: https://commits.webkit.org/316182@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
