Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 019c43fd5de39b7d45fc2c9bfa821802535f9009
https://github.com/WebKit/WebKit/commit/019c43fd5de39b7d45fc2c9bfa821802535f9009
Author: Basuke Suzuki <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
M Source/WebKit/NetworkProcess/SharedWorker/WebSharedWorkerServer.cpp
Log Message:
-----------
[SharedWorker] Add MESSAGE_CHECK to establishSharedWorkerContextConnection
rdar://174708287
Reviewed by Per Arne Vollan (OOPS\!).
establishSharedWorkerContextConnection accepts a WebContent-supplied Site with
no
MESSAGE_CHECK, allowing a compromised web process to hijack SharedWorker context
connections for arbitrary domains. This mirrors the fix applied to the
ServiceWorker
equivalent (establishSWContextConnection) in rdar://107063897.
Two changes:
1. Add allowsFirstPartyForCookies validation with MESSAGE_CHECK_COMPLETION
before
creating the context connection, matching the ServiceWorker pattern.
2. In WebSharedWorkerServer::addContextConnection, skip
contextConnectionCreated when
the domain already has a registered connection (replace debug-only ASSERT
with
runtime guard).
No new tests. Covered by existing SharedWorker tests.
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::establishSharedWorkerContextConnection):
* Source/WebKit/NetworkProcess/SharedWorker/WebSharedWorkerServer.cpp:
(WebKit::WebSharedWorkerServer::addContextConnection):
Originally-landed-as: 305413.712@safari-7624-branch (701d9d99f21d).
rdar://180428538
Canonical link: https://commits.webkit.org/316191@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
