Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 1dc6a86a7e770aa1b6b20e5268d4f507ca19926b
https://github.com/WebKit/WebKit/commit/1dc6a86a7e770aa1b6b20e5268d4f507ca19926b
Author: Chris Dumez <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
M LayoutTests/TestExpectations
A LayoutTests/ipc/ios/pasteboard-read-disallowed-uikit-type-expected.txt
A LayoutTests/ipc/ios/pasteboard-read-disallowed-uikit-type.html
M LayoutTests/platform/ios/TestExpectations
M Source/WebCore/platform/ios/PlatformPasteboardIOS.mm
Log Message:
-----------
[WebKit Process Model | All] isDisallowedTypeForReadBuffer uses
case-sensitive isEqualToString: while UIPasteboard resolves type identifiers
case-insensitively; readString has no gate
https://bugs.webkit.org/show_bug.cgi?id=315350
rdar://177401683
Reviewed by Wenson Hsieh.
isDisallowedTypeForReadBuffer compared the IPC-supplied pasteboard type against
UIImagePboardType using -isEqualToString:, which is case-sensitive, while
UIPasteboard / UTType / PBCoercionRegistry resolve type identifiers
case-insensitively. A compromised WebContent process could therefore send a
case-variant such as "Com.Apple.UIKit.Image" or
"Com.Apple.UIKit.AttributedString"
to WebPasteboardProxy::ReadBufferFromPasteboard and have UIPasteboard coerce
attacker-controlled bytes through NSKeyedUnarchiver / ImageIO inside the UI
process, re-opening the parser surface that 260681@main intended to close.
PlatformPasteboard::readString (reached by ReadStringFromPasteboard,
GetPasteboardStringForType, GetPasteboardStringsForType, and
ContainsStringSafeForDOMToReadForType) called -valuesForPasteboardType: /
-dataForPasteboardType: with the IPC-supplied type and no gate at all.
Replace the case-sensitive equality check with a case-insensitive prefix match
against "com.apple.uikit." so that every UIKit private object type (image,
attributedstring, color) is rejected regardless of case, and apply the same
gate to readString. WebKit never reads these types as raw NSData via the
pasteboard strategy; it uses dedicated typed accessors instead.
Test: ipc/pasteboard-read-disallowed-uikit-type.html
* LayoutTests/ipc/pasteboard-read-disallowed-uikit-type-expected.txt: Added.
* LayoutTests/ipc/pasteboard-read-disallowed-uikit-type.html: Added.
* Source/WebCore/platform/ios/PlatformPasteboardIOS.mm:
(WebCore::isDisallowedReadType):
(WebCore::PlatformPasteboard::readBuffer const):
(WebCore::PlatformPasteboard::readString const):
(WebCore::isDisallowedTypeForReadBuffer): Deleted.
Originally-landed-as: 305413.956@safari-7624-branch (5d1f95d6b4aa).
rdar://180438330
Canonical link: https://commits.webkit.org/316215@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
