Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 1759ab219c63940ba1c80bae6ba3df1afa6eec43
https://github.com/WebKit/WebKit/commit/1759ab219c63940ba1c80bae6ba3df1afa6eec43
Author: Timothy Hatcher <[email protected]>
Date: 2026-07-01 (Wed, 01 Jul 2026)
Changed paths:
M
Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIDevToolsExtensionPanelCocoa.mm
M Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIPortCocoa.mm
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIRuntime.mm
Log Message:
-----------
Cherry-pick 95c175bca8d0. rdar://176570738
Extension WebContent process UAF via WebExtension port listener iterator
invalidation.
https://webkit.org/b/314642
rdar://176570738
Reviewed by Brian Weinstein.
Calling a port's `onMessage` or `onDisconnect` listener back into
JavaScript is not safe while iterating
the live listener list, because extensions are allowed to add or remove
listeners during dispatch. Adding
a listener can reallocate the underlying vector, freeing the buffer the
iterator still points into and
causing a heap use-after-free. The same hazard existed in the DevTools
panel `onShown` dispatch. The
`WebExtensionAPIEvent::invokeListeners()` family already guards against
this.
Test: Tools/TestWebKitAPI/Tests/WebKitCocoa/WKWebExtensionAPIRuntime.mm
*
Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIDevToolsExtensionPanelCocoa.mm:
(WebKit::WebExtensionContextProxy::dispatchDevToolsExtensionPanelShownEvent):
Copy `onShown().listeners()`
before iterating so mutations during dispatch do not invalidate the loop.
* Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIPortCocoa.mm:
(WebKit::WebExtensionAPIPort::fireMessageEventIfNeeded): Copy
`m_onMessage->listeners()` before iterating.
(WebKit::WebExtensionAPIPort::fireDisconnectEventIfNeeded): Copy
`m_onDisconnect->listeners()` before iterating.
* Tools/TestWebKitAPI/Tests/WebKitCocoa/WKWebExtensionAPIRuntime.mm:
(TestWebKitAPI::TEST(WKWebExtensionAPIRuntime,
PortMutateListenersDuringDispatch)): Added. Registers listeners
on `onMessage` and `onDisconnect` that each add 1024 new listeners during
dispatch to force vector reallocation,
then asserts only the pre-dispatch listeners were invoked.
Identifier: 305413.886@safari-7624-branch
Originally-landed-as: [email protected] (b8d709d285c1).
rdar://180437594
Canonical link: https://commits.webkit.org/316295@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
