Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 6ed0b1c35498b3782df524e693e313b611e20f99
https://github.com/WebKit/WebKit/commit/6ed0b1c35498b3782df524e693e313b611e20f99
Author: Anthony Tarbinian <[email protected]>
Date: 2026-09-23 (Wed, 23 Sep 2026)
Changed paths:
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.h
M Source/WebKit/NetworkProcess/NetworkProcess.cpp
M Source/WebKit/NetworkProcess/NetworkProcess.h
M Source/WebKit/NetworkProcess/NetworkProcess.messages.in
M Source/WebKit/Shared/NetworkProcessConnectionParameters.h
M Source/WebKit/Shared/NetworkProcessConnectionParameters.serialization.in
M Source/WebKit/UIProcess/API/Cocoa/WKWebViewPrivateForTesting.h
M Source/WebKit/UIProcess/API/Cocoa/WKWebViewTesting.mm
M Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp
M Source/WebKit/UIProcess/Network/NetworkProcessProxy.h
M Source/WebKit/UIProcess/WebFrameProxy.cpp
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/UIProcess/WebPageProxy.h
M Source/WebKit/UIProcess/WebProcessPool.cpp
M Source/WebKit/UIProcess/WebProcessProxy.cpp
M Source/WebKit/UIProcess/WebProcessProxy.h
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm
Log Message:
-----------
Validate WebPageProxyIdentifier supplied by WebContent process against
per-process allow-list
https://bugs.webkit.org/show_bug.cgi?id=316212
rdar://176917371
Reviewed by Charlie Wolfe.
A malicious WebContent process can attempt to impersonate another page
over IPC by guessing another page's WebPageProxyIdentifier. The network
process accepts this as authoritative.
This is problematic if a WebContent process impersonates a page which
has been granted the _shouldRelaxThirdPartyCookieBlocking setting.
Then, it can access cross-origin cookies using the relaxed origin checks
that are entailed with the _shouldRelaxThirdPartyCookieBlocking setting.
Normally, the NetworkProcess will deny a request for cookies where
firstParty != url. However, if the setting _shouldRelaxThirdPartyCookieBlocking
is enabled, this check is relaxed. This is a WKWebView setting normally
meant for WebExtension pages that want to opt-out of the strict cookie
domain checks.
This _shouldRelaxThirdPartyCookieBlocking setting is not able to be set
by web content. However, the malicious WebContent process can pretend to
be another page which does have this setting enabled.
This patch introduces a per-process allow-list of WebPageProxyIdentifiers
the WebContent process is permitted to reference, and validates the
identifier supplied with each cookie/load IPC against it. The allow-list
is maintained by the (trusted) UIProcess, which adds an entry whenever it
associates a process with a page (performs a call to
WebPageProxy::addAllwedFirstPartyForCookies during initial main frame,
navigation, and site isolation process swap).
This patch also adds an early return to every cookie endpoint
plus ScheduleResourceLoad / PerformSynchronousLoad /
CreateSocketChannel to reject messages sent with an unowned identifier.
This was originally a MESSAGE_CHECK, but an early return was chosen
instead to prevent the web process from being terminated if it sent a
stale page ID during page teardown.
Under site isolation, a page's WebPageProxyIdentifier is legitimately
owned by every process hosting any of its frames (main frame and any
cross-origin subframes). A process is added to the page's allow-list at
exactly the moment it is granted that page's first-party cookie access,
so WebPageProxy::addAllowedFirstPartyForCookies now also sends
AddAllowedWebPageProxyIdentifier for that (process, page) pair on
certain navigation functions and browsing context group switches. The
allow-list entry is removed when the process exits or the page is
destroyed.
Service-worker and shared-worker processes are established outside the
WebPageProxy path:
WebProcessPool::establishRemoteWorkerContextConnectionToNetworkProcess
calls NetworkProcessProxy::addAllowedFirstPartyForCookies directly
(skipping the WebPageProxy wrapper), and the worker process is given a
synthetic WebPageProxyIdentifier
(RemoteWorkerInformation::remoteWorkerPageProxyID)
which it then supplies on its own ScheduleResourceLoad / CreateSocketChannel
IPCs.
WebProcessPool::establishRemoteWorkerContextConnectionToNetworkProcess
also feeds the allow-list with that identifier so legitimate worker
loads successfully.
This patch also adds two site-isolation API tests:
RelaxThirdPartyCookieBlockingSubframe:
Ensures that the relaxation setting is maintained for cross-site
iframes in different processes. We make sure that an iframe can
send its own cookies across network requests (they are not allowed
if the relaxation setting is disabled since the iframe's cookies are
seen as third party with respect to the page's top document).
i.e. that the new allow-list does not over-block the legitimate
case where a page can belong to multiple processes.
ThirdPartyCookieBlockingSpoofedWebPageProxyID:
Tests that a malicious web process cannot guess a
WebPageProxyIdentifier that it doesn't legitimately own.
Without this patch, the malicious web process can guess another
process's WebPageProxyIdentifier and access cross-origin cookies by
inheriting their _shouldRelaxThirdPartyCookieBlocking setting.
Tests: Tools/TestWebKitAPI/Tests/WebKitCocoa/SiteIsolation.mm
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::createSocketChannel):
(WebKit::NetworkConnectionToWebProcess::scheduleResourceLoad):
(WebKit::NetworkConnectionToWebProcess::performSynchronousLoad):
(WebKit::NetworkConnectionToWebProcess::loadPing):
(WebKit::NetworkConnectionToWebProcess::cookiesForDOM):
(WebKit::NetworkConnectionToWebProcess::setCookiesFromDOM):
(WebKit::NetworkConnectionToWebProcess::cookiesEnabled):
(WebKit::NetworkConnectionToWebProcess::cookieRequestHeaderFieldValue):
(WebKit::NetworkConnectionToWebProcess::getRawCookies):
(WebKit::NetworkConnectionToWebProcess::cookiesForDOMAsync):
(WebKit::NetworkConnectionToWebProcess::setCookieFromDOMAsync):
(WebKit::NetworkConnectionToWebProcess::subscribeToCookieChangeNotifications):
The several code paths above were updated with a MESSAGE_CHECK which
verifies that WebContent process can claim ownership of a
given WebPageProxyIdentifier before giving it relaxed cross-origin
cookie access.
* Source/WebKit/NetworkProcess/NetworkProcess.cpp:
(WebKit::NetworkProcess::removeNetworkConnectionToWebProcess):
When connection to a web process dies,
cleanup all WebPageProxyIdentifiers which were
allowed for that web process.
(WebKit::NetworkProcess::createNetworkConnectionToWebProcess):
Add allowed WebPageProxyIdentifiers on creation
of NetworkProcess connection to the web content
process.
(WebKit::NetworkProcess::addAllowedWebPageProxyIdentifier):
Helper to add an allowed page for a web process
(WebKit::NetworkProcess::allowsWebPageProxyIdentifier const):
Helper which verifies if a given web process
is allowed to access a given page.
(WebKit::NetworkProcess::removeWebPageNetworkParameters):
Remove a pageID from every process's bucket
* Source/WebKit/NetworkProcess/NetworkProcess.h:
* Source/WebKit/NetworkProcess/NetworkProcess.messages.in:
* Source/WebKit/Shared/NetworkProcessConnectionParameters.h:
* Source/WebKit/Shared/NetworkProcessConnectionParameters.serialization.in:
* Source/WebKit/UIProcess/API/Cocoa/WKWebViewPrivateForTesting.h:
* Source/WebKit/UIProcess/API/Cocoa/WKWebViewTesting.mm:
(-[WKWebView _webPageProxyIdentifierForTesting]):
* Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp:
(WebKit::NetworkProcessProxy::getNetworkProcessConnection):
(WebKit::NetworkProcessProxy::addAllowedWebPageProxyIdentifier):
* Source/WebKit/UIProcess/Network/NetworkProcessProxy.h:
* Source/WebKit/UIProcess/WebFrameProxy.cpp:
(WebKit::WebFrameProxy::prepareForProvisionalLoadInProcess):
Update to use helper WebPageProxy::addAllowedFirstPartyForCookies
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::addAllowedFirstPartyForCookies):
(WebKit::WebPageProxy::initializeWebPage):
Add the new web page which is being initialized
to the allow list for this web process.
(WebKit::WebPageProxy::loadAlternateHTML):
(WebKit::WebPageProxy::receivedNavigationActionPolicyDecision):
(WebKit::WebPageProxy::continueNavigationInNewProcess):
(WebKit::WebPageProxy::performProcessSwapForNavigationResponse):
* Source/WebKit/UIProcess/WebPageProxy.h:
* Source/WebKit/UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::establishRemoteWorkerContextConnectionToNetworkProcess):
Feed the allow-list with the remote worker process's
WebPageProxyIdentifier so legitimate ScheduleResourceLoad /
CreateSocketChannel IPCs from the worker pass MESSAGE_CHECK.
(WebKit::WebProcessPool::processForNavigation):
Update to use helper WebPageProxy::addAllowedFirstPartyForCookies
(WebKit::WebProcessPool::prepareProcessForNavigation):
Update to use helper WebPageProxy::addAllowedFirstPartyForCookies
* Source/WebKit/UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::remoteWorkerPageProxyID const):
Accessor for the WebPageProxyIdentifier assigned to a remote worker
process, consumed by establishRemoteWorkerContextConnectionToNetworkProcess
when feeding the allow-list.
* Source/WebKit/UIProcess/WebProcessProxy.h:
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:
(TestWebKitAPI::(SiteIsolation, RelaxThirdPartyCookieBlockingSubframe)):
(TestWebKitAPI::(SiteIsolation, ThirdPartyCookieBlockingSpoofedWebPageProxyID)):
Originally-landed-as: 316606.138@safari-7625-branch (385caad4d69f).
rdar://187507033
Canonical link: https://commits.webkit.org/321717@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
