Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 43379f45ae41cedf2b1046e66a818dd85bbfe1f2
https://github.com/WebKit/WebKit/commit/43379f45ae41cedf2b1046e66a818dd85bbfe1f2
Author: Adrian Taylor <[email protected]>
Date: 2026-09-02 (Wed, 02 Sep 2026)
Changed paths:
M LayoutTests/ipc/coreipc.js
M LayoutTests/ipc/serialized-type-info.html
M Source/WebKit/CMakeLists.txt
M Source/WebKit/DerivedSources-input.xcfilelist
M Source/WebKit/DerivedSources.make
M Source/WebKit/Scripts/generate-message-receiver.py
M Source/WebKit/Scripts/webkit/messages.py
M Source/WebKit/Scripts/webkit/model.py
M Source/WebKit/Scripts/webkit/opaque_ipc_types.py
M Source/WebKit/Scripts/webkit/tests/Makefile
M Source/WebKit/Scripts/webkit/tests/MessageArgumentDescriptions.cpp
M Source/WebKit/Scripts/webkit/tests/MessageNames.cpp
M Source/WebKit/Scripts/webkit/tests/MessageNames.h
M Source/WebKit/Scripts/webkit/tests/TestWithDispatchedFromAndTo.messages.in
M
Source/WebKit/Scripts/webkit/tests/TestWithDispatchedFromAndToMessageReceiver.cpp
M Source/WebKit/Scripts/webkit/tests/TestWithDispatchedFromAndToMessages.h
A
Source/WebKit/Scripts/webkit/tests/TestWithUntrackedUntrustedOrigin.messages.in
A Source/WebKit/Scripts/webkit/untrusted_origins.py
M Source/WebKit/UIProcess/Automation/WebAutomationSession.cpp
M Source/WebKit/UIProcess/Automation/WebAutomationSession.h
M Source/WebKit/UIProcess/Automation/WebAutomationSession.messages.in
M Source/WebKit/UIProcess/Inspector/Agents/ProxyingPageAgent.cpp
M Source/WebKit/UIProcess/Inspector/Agents/ProxyingPageAgent.h
M Source/WebKit/UIProcess/Inspector/Agents/ProxyingPageAgent.messages.in
M Source/WebKit/UIProcess/ProvisionalPageProxy.cpp
M Source/WebKit/UIProcess/ProvisionalPageProxy.h
M Source/WebKit/UIProcess/SpeechRecognitionServer.cpp
M Source/WebKit/UIProcess/SpeechRecognitionServer.h
M Source/WebKit/UIProcess/SpeechRecognitionServer.messages.in
M
Source/WebKit/UIProcess/WebAuthentication/Cocoa/WebAuthenticatorCoordinatorProxy.mm
M
Source/WebKit/UIProcess/WebAuthentication/WebAuthenticatorCoordinatorProxy.cpp
M
Source/WebKit/UIProcess/WebAuthentication/WebAuthenticatorCoordinatorProxy.h
M
Source/WebKit/UIProcess/WebAuthentication/WebAuthenticatorCoordinatorProxy.messages.in
M Source/WebKit/UIProcess/WebFrameProxy.cpp
M Source/WebKit/UIProcess/WebFrameProxy.h
M Source/WebKit/UIProcess/WebFrameProxy.messages.in
M Source/WebKit/UIProcess/WebGeolocationManagerProxy.cpp
M Source/WebKit/UIProcess/WebGeolocationManagerProxy.h
M Source/WebKit/UIProcess/WebGeolocationManagerProxy.messages.in
M Source/WebKit/UIProcess/WebLockRegistryProxy.cpp
M Source/WebKit/UIProcess/WebLockRegistryProxy.h
M Source/WebKit/UIProcess/WebLockRegistryProxy.messages.in
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/UIProcess/WebPageProxy.h
M Source/WebKit/UIProcess/WebPageProxy.messages.in
M Source/WebKit/UIProcess/WebPermissionControllerProxy.cpp
M Source/WebKit/UIProcess/WebPermissionControllerProxy.h
M Source/WebKit/UIProcess/WebPermissionControllerProxy.messages.in
M Source/WebKit/UIProcess/WebProcessProxy.cpp
M Source/WebKit/UIProcess/WebProcessProxy.h
M Source/WebKit/UIProcess/WebProcessProxy.messages.in
M Source/WebKit/UIProcess/XR/PlatformXRSystem.cpp
M Source/WebKit/UIProcess/XR/PlatformXRSystem.h
M Source/WebKit/UIProcess/XR/PlatformXRSystem.messages.in
M Source/WebKit/WebKit.xcodeproj/project.pbxproj
M Tools/TestWebKitAPI/Resources/cocoa/coreipc.js
Log Message:
-----------
[IPC] Require origins reaching the UI process to be declared IPC::Untrusted
https://bugs.webkit.org/show_bug.cgi?id=323110
Reviewed by Zak Ridouh.
This is the third in a series of four commits which aim to prove that any
origin flowing from a Web Contents Process to a privileged process MUST go
through some validation procedure before it's used. The next commit after
this one actually switches on that validation. This one is still an
infrastructural no-op.
generate-message-receiver.py now refuses to generate a receiver if a message
from a web content process into the UI process carries a bare
WebCore::SecurityOriginData, ClientOrigin, RegistrableDomain, Site or
SecurityOrigin. The parameter must be declared IPC::Untrusted<T>, at which
point the decoder produces the wrapper and the handler's signature has to
accept it, so the value cannot be used without either validating it or
explicitly declining to.
Every one of the 37 affected UI-process parameters is wrapped here, and every
handler calls unsafeExtractWithoutValidation(NeedsReview). That is deliberate:
this commit changes no behavior at all, so the mechanism can be reviewed
separately from the argument about what each origin should be checked against.
The validation policy arrives in the next commit and the bypasses are burnt down
in the one after.
Notes on the design:
- The wrapping is written out in the .messages.in files rather than applied
invisibly by the generator. Either would guarantee coverage, but the IDL is
where a reviewer looks to see what a privileged process is being told, so it
is
worth the 37 lines of noise to have it visible there.
- Only WebContent -> UI is gated, and only origins. Networking and GPU follow in
later commits, each of which needs its own notion of process authority, and
URLs
follow after that.
- Senders are untouched. The generated message class still takes and encodes a
T;
only the Arguments tuple, and therefore the receiver's signature, changes. The
wire format is identical, so this is not a serialization change.
The EXTRACT_WITH_MESSAGE_CHECK family is defined here, rather than in the
commit that chooses the validators, so that the mechanism is reviewed once and
the next commit is only about which procedure applies where. Each is defined in
the translation unit that uses it, over that file's own MESSAGE_CHECK: a single
shared definition is not possible because the argument order varies -
WebPageProxy takes the process first, other receivers take the assertion first
- and they are #undef'd at the end of each file because unified sources would
otherwise collide.
Every value here is extracted with UnvalidatedReason::NeedsReview, so this
commit changes no behaviour: it only makes the types state what must not be
trusted. The next commit resolves every one of those, and a later commit
deletes NeedsReview so that the compiler enforces that none were missed.
Drive-by: adds TestWithMultipleDispatchedFrom to the TESTS list in
Scripts/webkit/tests/Makefile. It was added with checked-in expectations but
never
listed, so regenerating them silently deleted its entries.
* Source/WebKit/CMakeLists.txt:
* Source/WebKit/DerivedSources-input.xcfilelist:
* Source/WebKit/DerivedSources.make:
* Source/WebKit/Scripts/generate-message-receiver.py:
(main):
* Source/WebKit/Scripts/webkit/messages.py:
(function_parameter_type):
(function_parameter_requires_suppress_forward_decl):
(arguments_constructor_name):
(message_to_struct_declaration):
(forward_declarations_and_headers):
(class_template_headers):
* Source/WebKit/Scripts/webkit/model.py:
(MessageReceiver.enforce_opaque_ipc_types_usage):
(MessageReceiver):
(MessageReceiver.enforce_untrusted_origin_usage):
* Source/WebKit/Scripts/webkit/tests/Makefile:
* Source/WebKit/Scripts/webkit/tests/MessageArgumentDescriptions.cpp:
(IPC::jsValueForArguments):
(IPC::messageArgumentDescriptions):
* Source/WebKit/Scripts/webkit/tests/MessageNames.cpp:
* Source/WebKit/Scripts/webkit/tests/MessageNames.h:
* Source/WebKit/Scripts/webkit/tests/TestWithDispatchedFromAndTo.messages.in:
*
Source/WebKit/Scripts/webkit/tests/TestWithDispatchedFromAndToMessageReceiver.cpp:
(WebKit::TestWithDispatchedFromAndTo::didReceiveMessage):
(IPC::jsValueForDecodedMessage<MessageName::TestWithDispatchedFromAndTo_UntrustedOrigin>):
* Source/WebKit/Scripts/webkit/tests/TestWithDispatchedFromAndToMessages.h:
(Messages::TestWithDispatchedFromAndTo::UntrustedOrigin::name):
(Messages::TestWithDispatchedFromAndTo::UntrustedOrigin::UntrustedOrigin):
(Messages::TestWithDispatchedFromAndTo::UntrustedOrigin::encode):
*
Source/WebKit/Scripts/webkit/tests/TestWithUntrackedUntrustedOrigin.messages.in:
Copied from
Source/WebKit/Scripts/webkit/tests/TestWithDispatchedFromAndTo.messages.in.
* Source/WebKit/Scripts/webkit/untrusted_origins.py: Added.
(_strip_const_and_whitespace):
(_split_template_parameters):
(_split_container):
(unwrap_untrusted):
(unwrap_if_untrusted):
(conveys_untrusted_value):
(_process_names):
(is_privileged_receiver):
(TestUntrustedOrigins):
(TestUntrustedOrigins.test_direct_untrusted_types):
(TestUntrustedOrigins.test_non_untrusted_types):
(TestUntrustedOrigins.test_containers):
(TestUntrustedOrigins.test_unknown_containers_are_not_traversed):
(TestUntrustedOrigins.test_wrapper_is_transparent_to_detection):
(TestUntrustedOrigins.test_unwrap_untrusted):
(TestUntrustedOrigins.test_unwrap_if_untrusted):
(TestUntrustedOrigins.test_bad_formatting):
(TestUntrustedOrigins.test_split_template_parameters):
(TestUntrustedOrigins.test_validation_procedures_are_confined):
(TestUntrustedOrigins.test_unknown_containers_are_traversed):
* Source/WebKit/UIProcess/Automation/WebAutomationSession.cpp:
(WebKit::WebAutomationSession::scriptRealmCreated):
* Source/WebKit/UIProcess/Automation/WebAutomationSession.h:
* Source/WebKit/UIProcess/Automation/WebAutomationSession.messages.in:
* Source/WebKit/UIProcess/Inspector/Agents/ProxyingPageAgent.cpp:
(Inspector::ProxyingPageAgent::frameNavigated):
* Source/WebKit/UIProcess/Inspector/Agents/ProxyingPageAgent.h:
* Source/WebKit/UIProcess/Inspector/Agents/ProxyingPageAgent.messages.in:
* Source/WebKit/UIProcess/ProvisionalPageProxy.cpp:
(WebKit::ProvisionalPageProxy::didCommitLoadForFrame):
* Source/WebKit/UIProcess/ProvisionalPageProxy.h:
* Source/WebKit/UIProcess/SpeechRecognitionServer.cpp:
(WebKit::SpeechRecognitionServer::start):
* Source/WebKit/UIProcess/SpeechRecognitionServer.h:
* Source/WebKit/UIProcess/SpeechRecognitionServer.messages.in:
*
Source/WebKit/UIProcess/WebAuthentication/Cocoa/WebAuthenticatorCoordinatorProxy.mm:
*
Source/WebKit/UIProcess/WebAuthentication/WebAuthenticatorCoordinatorProxy.cpp:
(WebKit::WebAuthenticatorCoordinatorProxy::getAssertion):
(WebKit::WebAuthenticatorCoordinatorProxy::isUserVerifyingPlatformAuthenticatorAvailable):
(WebKit::WebAuthenticatorCoordinatorProxy::isConditionalMediationAvailable):
* Source/WebKit/UIProcess/WebAuthentication/WebAuthenticatorCoordinatorProxy.h:
*
Source/WebKit/UIProcess/WebAuthentication/WebAuthenticatorCoordinatorProxy.messages.in:
* Source/WebKit/UIProcess/WebFrameProxy.cpp:
(WebKit::WebFrameProxy::commitProvisionalFrame):
(WebKit::WebFrameProxy::setAppBadge):
(WebKit::WebFrameProxy::didChangeCSPOriginsThatUpgradeInsecureNavigations):
* Source/WebKit/UIProcess/WebFrameProxy.h:
* Source/WebKit/UIProcess/WebFrameProxy.messages.in:
* Source/WebKit/UIProcess/WebGeolocationManagerProxy.cpp:
(WebKit::WebGeolocationManagerProxy::startUpdating):
(WebKit::WebGeolocationManagerProxy::stopUpdating):
(WebKit::WebGeolocationManagerProxy::setEnableHighAccuracy):
* Source/WebKit/UIProcess/WebGeolocationManagerProxy.h:
* Source/WebKit/UIProcess/WebGeolocationManagerProxy.messages.in:
* Source/WebKit/UIProcess/WebLockRegistryProxy.cpp:
(WebKit::WebLockRegistryProxy::requestLock):
(WebKit::WebLockRegistryProxy::releaseLock):
(WebKit::WebLockRegistryProxy::abortLockRequest):
(WebKit::WebLockRegistryProxy::snapshot):
(WebKit::WebLockRegistryProxy::clientIsGoingAway):
* Source/WebKit/UIProcess/WebLockRegistryProxy.h:
* Source/WebKit/UIProcess/WebLockRegistryProxy.messages.in:
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::commitProvisionalPage):
(WebKit::WebPageProxy::didCommitLoadForFrame):
(WebKit::WebPageProxy::requestUserMediaPermissionForFrame):
(WebKit::WebPageProxy::enumerateMediaDevicesForFrame):
(WebKit::WebPageProxy::validateCaptureStateUpdate):
(WebKit::WebPageProxy::requestMediaKeySystemPermissionForFrame):
(WebKit::WebPageProxy::beginSystemPreview):
(WebKit::WebPageProxy::postMessageToRemote):
(WebKit::WebPageProxy::dispatchCrossOriginBeforeUnloadCheckForFrame):
* Source/WebKit/UIProcess/WebPageProxy.h:
* Source/WebKit/UIProcess/WebPageProxy.messages.in:
* Source/WebKit/UIProcess/WebPermissionControllerProxy.cpp:
(WebKit::WebPermissionControllerProxy::query):
* Source/WebKit/UIProcess/WebPermissionControllerProxy.h:
* Source/WebKit/UIProcess/WebPermissionControllerProxy.messages.in:
* Source/WebKit/UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::didCollectPrewarmInformation):
(WebKit::WebProcessProxy::didCompleteAutofill):
(WebKit::WebProcessProxy::didObserveFirstPartyUserGesture):
(WebKit::WebProcessProxy::setAppBadgeFromWorker):
* Source/WebKit/UIProcess/WebProcessProxy.h:
* Source/WebKit/UIProcess/WebProcessProxy.messages.in:
* Source/WebKit/UIProcess/XR/PlatformXRSystem.cpp:
(WebKit::PlatformXRSystem::requestPermissionOnSessionFeatures):
* Source/WebKit/UIProcess/XR/PlatformXRSystem.h:
* Source/WebKit/UIProcess/XR/PlatformXRSystem.messages.in:
* Source/WebKit/WebKit.xcodeproj/project.pbxproj:
* LayoutTests/ipc/coreipc.js:
(export.ArgumentSerializer):
* LayoutTests/ipc/serialized-type-info.html:
* Source/WebKit/Scripts/webkit/opaque_ipc_types.py:
* Tools/TestWebKitAPI/Resources/cocoa/coreipc.js:
(ArgumentSerializer):
Canonical link: https://commits.webkit.org/320329@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
