Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 07d83d0d699eedc4e80908d99470a5fca06acdc8
https://github.com/WebKit/WebKit/commit/07d83d0d699eedc4e80908d99470a5fca06acdc8
Author: Sihui Liu <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
M Source/WebKit/NetworkProcess/storage/FileSystemStorageHandle.cpp
M Source/WebKit/NetworkProcess/storage/FileSystemStorageHandle.h
M Source/WebKit/NetworkProcess/storage/FileSystemStorageManager.cpp
M Source/WebKit/NetworkProcess/storage/FileSystemStorageManager.h
M Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp
M Source/WebKit/NetworkProcess/storage/NetworkStorageManager.h
M Source/WebKit/NetworkProcess/storage/OriginStorageManager.cpp
M Source/WebKit/NetworkProcess/storage/OriginStorageManager.h
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/IPCTestingAPI.mm
Log Message:
-----------
Validate connection access to FileSystem storage with
FileSystemHandleIdentifier
rdar://176773267
Reviewed by Chris Dumez.
Many FileSystem-related messages sent to NetworkStorageManager only carries
FileSystemHandleIdentifier when asking to
operate on FileSystem storage, and NetworkStorageManager does not check whether
the sender process actually has access
to requested handle. This lets a compromised process forge
FileSystemHandleIdentifier and access data from other
origins. To fix it, this patch stores the origin in FileSystemStorageManager
and adding an origin accessor to
FileSystemStorageHandle, so that NetworkStorageManager can run
isSiteAllowedForConnection in FileSystem-related message
handlers.
API test: IPCTestingAPI.FileSystemForgedHandleIdentifierRejected
* Source/WebKit/NetworkProcess/storage/FileSystemStorageHandle.cpp:
(WebKit::FileSystemStorageHandle::origin const):
* Source/WebKit/NetworkProcess/storage/FileSystemStorageHandle.h:
* Source/WebKit/NetworkProcess/storage/FileSystemStorageManager.cpp:
(WebKit::FileSystemStorageManager::create):
(WebKit::FileSystemStorageManager::FileSystemStorageManager):
* Source/WebKit/NetworkProcess/storage/FileSystemStorageManager.h:
* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp:
(WebKit::NetworkStorageManager::fileSystemGetDirectory):
(WebKit::NetworkStorageManager::closeHandle):
(WebKit::NetworkStorageManager::isSameEntry):
(WebKit::NetworkStorageManager::move):
(WebKit::NetworkStorageManager::getFileHandle):
(WebKit::NetworkStorageManager::getDirectoryHandle):
(WebKit::NetworkStorageManager::removeEntry):
(WebKit::NetworkStorageManager::resolve):
(WebKit::NetworkStorageManager::getFile):
(WebKit::NetworkStorageManager::createSyncAccessHandle):
(WebKit::NetworkStorageManager::closeSyncAccessHandle):
(WebKit::NetworkStorageManager::requestNewCapacityForSyncAccessHandle):
(WebKit::NetworkStorageManager::createWritable):
(WebKit::NetworkStorageManager::closeWritable):
(WebKit::NetworkStorageManager::executeCommandForWritable):
(WebKit::NetworkStorageManager::getHandleNames):
(WebKit::NetworkStorageManager::getHandle):
(WebKit::NetworkStorageManager::addGlobalIdentifierReference):
(WebKit::NetworkStorageManager::removeGlobalIdentifierReferences):
(WebKit::NetworkStorageManager::resolveGlobalIdentifier):
(WebKit::NetworkStorageManager::canConnectionAccessFileSystemHandle const):
(WebKit::NetworkStorageManager::registerFileSystemHandleRecordsForOrigin):
(WebKit::NetworkStorageManager::putOrAdd):
* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.h:
* Source/WebKit/NetworkProcess/storage/OriginStorageManager.cpp:
(WebKit::OriginStorageManager::StorageBucket::fileSystemStorageManager):
(WebKit::OriginStorageManager::fileSystemStorageManager):
* Source/WebKit/NetworkProcess/storage/OriginStorageManager.h:
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/IPCTestingAPI.mm
(function):
((IPCTestingAPI, FileSystemForgedHandleIdentifierRejected)):
(NSURLWithBaseURLInNSSecureCoding)): Deleted.
Canonical link: https://commits.webkit.org/319116@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
