Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 40d5429223cabe6e37ca0fdc31c7ad6d76ad541d
https://github.com/WebKit/WebKit/commit/40d5429223cabe6e37ca0fdc31c7ad6d76ad541d
Author: Ian Gower <[email protected]>
Date: 2026-07-23 (Thu, 23 Jul 2026)
Changed paths:
M Source/WebCore/Modules/fetch/IPAddressSpace.cpp
M Source/WebCore/Modules/fetch/IPAddressSpace.h
M Source/WebCore/platform/network/ResourceResponseBase.cpp
M Source/WebCore/platform/network/ResourceResponseBase.h
M Source/WebKit/NetworkProcess/cocoa/NetworkDataTaskCocoa.mm
M Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in
M Tools/TestWebKitAPI/Tests/WebCore/IPAddressSpaceTests.cpp
Log Message:
-----------
Classify the real resolved connection IP for Local Network Access on Cocoa
https://bugs.webkit.org/show_bug.cgi?id=319906
rdar://182830220
Reviewed by Alex Christensen.
Adds classifyIPAddressSpace(const IPAddress&) and wires it into
NetworkDataTaskCocoa so the resolved connection address, not the request
URL's host, is what gets classified into an IPAddressSpace. The request
URL's host is attacker-controlled (a DNS-rebinding server can point a
public-looking hostname at 127.0.0.1), so any local-network access policy
decision needs to be based on what actually got connected to. Both the
final response (didReceiveResponse) and each redirect hop
(willPerformHTTPRedirection) are classified, since a redirect is a
separate connection that could target a local/loopback address on its own.
When the connection address cannot be classified (no resolved address, or
one that is neither IPv4 nor IPv6) the space is left as
IPAddressSpace::Unknown, which ranks as the least public space so the local
network access check fails closed instead of defaulting to Public. Unknown
is kept last in the enum so the web-exposed { public, local, loopback }
values in IPAddressSpace.idl keep their indices.
* Source/WebCore/Modules/fetch/IPAddressSpace.cpp:
(WebCore::classifyIPAddressSpace):
* Source/WebCore/Modules/fetch/IPAddressSpace.h:
(WebCore::publicnessRank):
* Source/WebCore/platform/network/ResourceResponseBase.cpp:
(WebCore::ResourceResponseBase::ResourceResponseBase):
* Source/WebCore/platform/network/ResourceResponseBase.h:
(WebCore::ResourceResponseBase::ipAddressSpace const):
* Source/WebKit/NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:
(WebKit::NetworkDataTaskCocoa::didReceiveResponse):
(WebKit::NetworkDataTaskCocoa::willPerformHTTPRedirection):
* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:
* Tools/TestWebKitAPI/Tests/WebCore/IPAddressSpaceTests.cpp:
(TestWebKitAPI::TEST(IPAddressSpace,
ClassifyIPAddressSpaceFromResolvedAddress)):
(TestWebKitAPI::TEST(IPAddressSpace, ClassifyUnclassifiableAddressIsUnknown)):
(TestWebKitAPI::TEST(IPAddressSpace,
ResourceResponseAddressSpaceDefaultsToUnknown)):
Canonical link: https://commits.webkit.org/317821@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
