Diff
Modified: trunk/Source/WebKit/ChangeLog (281031 => 281032)
--- trunk/Source/WebKit/ChangeLog 2021-08-13 20:14:07 UTC (rev 281031)
+++ trunk/Source/WebKit/ChangeLog 2021-08-13 20:53:03 UTC (rev 281032)
@@ -1,3 +1,174 @@
+2021-08-13 Alex Christensen <achristen...@webkit.org>
+
+ SandboxExtension::Handle creation should return std::optional instead of bool
+ https://bugs.webkit.org/show_bug.cgi?id=228875
+
+ Reviewed by Youenn Fablet.
+
+ This modernizes the code somewhat.
+ This makes it easier to write code that realizes that handle creation can fail.
+ This is a step towards removing the unnecessary abstraction HandleArray.
+
+ * NetworkProcess/NetworkResourceLoadParameters.cpp:
+ (WebKit::NetworkResourceLoadParameters::encode const):
+ * Platform/IPC/FormDataReference.h:
+ (IPC::FormDataReference::encode const):
+ * Shared/Cocoa/SandboxExtensionCocoa.mm:
+ (WebKit::SandboxExtension::createHandleWithoutResolvingPath):
+ (WebKit::SandboxExtension::createHandle):
+ (WebKit::createHandlesForResources):
+ (WebKit::SandboxExtension::createReadOnlyHandlesForFiles):
+ (WebKit::SandboxExtension::createHandleForReadWriteDirectory):
+ (WebKit::SandboxExtension::createHandleForTemporaryFile):
+ (WebKit::SandboxExtension::createHandleForGenericExtension):
+ (WebKit::SandboxExtension::createHandleForMachLookup):
+ (WebKit::SandboxExtension::createHandlesForMachLookup):
+ (WebKit::SandboxExtension::createHandleForReadByAuditToken):
+ (WebKit::SandboxExtension::createHandleForIOKitClassExtension):
+ (WebKit::SandboxExtension::createHandlesForIOKitClassExtensions):
+ * Shared/SandboxExtension.h:
+ (WebKit::SandboxExtension::createHandle):
+ (WebKit::SandboxExtension::createHandleWithoutResolvingPath):
+ (WebKit::SandboxExtension::createHandleForReadWriteDirectory):
+ (WebKit::SandboxExtension::createHandleForTemporaryFile):
+ (WebKit::SandboxExtension::createHandleForGenericExtension):
+ * UIProcess/Cocoa/WebPageProxyCocoa.mm:
+ (WebKit::WebPageProxy::addPlatformLoadParameters):
+ (WebKit::WebPageProxy::createSandboxExtensionsIfNeeded): Deleted.
+ (WebKit::WebPageProxy::scrollingUpdatesDisabledForTesting): Deleted.
+ (WebKit::WebPageProxy::startDrag): Deleted.
+ (WebKit::WebPageProxy::setPromisedDataForImage): Deleted.
+ (WebKit::WebPageProxy::setDragCaretRect): Deleted.
+ (WebKit::WebPageProxy::platformRegisterAttachment): Deleted.
+ (WebKit::WebPageProxy::platformCloneAttachment): Deleted.
+ (WebKit::WebPageProxy::performDictionaryLookupAtLocation): Deleted.
+ (WebKit::WebPageProxy::performDictionaryLookupOfCurrentSelection): Deleted.
+ (WebKit::WebPageProxy::insertDictatedTextAsync): Deleted.
+ (WebKit::WebPageProxy::platformDictationAlternatives): Deleted.
+ (WebKit::WebPageProxy::errorForUnpermittedAppBoundDomainNavigation): Deleted.
+ (WebKit::WebPageProxy::paymentCoordinatorConnection): Deleted.
+ (WebKit::WebPageProxy::paymentCoordinatorBoundInterfaceIdentifier): Deleted.
+ (WebKit::WebPageProxy::paymentCoordinatorSourceApplicationBundleIdentifier): Deleted.
+ (WebKit::WebPageProxy::paymentCoordinatorSourceApplicationSecondaryIdentifier): Deleted.
+ (WebKit::WebPageProxy::paymentCoordinatorAddMessageReceiver): Deleted.
+ (WebKit::WebPageProxy::paymentCoordinatorRemoveMessageReceiver): Deleted.
+ (WebKit::WebPageProxy::didStartSpeaking): Deleted.
+ (WebKit::WebPageProxy::didFinishSpeaking): Deleted.
+ (WebKit::WebPageProxy::didPauseSpeaking): Deleted.
+ (WebKit::WebPageProxy::didResumeSpeaking): Deleted.
+ (WebKit::WebPageProxy::speakingErrorOccurred): Deleted.
+ (WebKit::WebPageProxy::boundaryEventOccurred): Deleted.
+ (WebKit::WebPageProxy::voicesDidChange): Deleted.
+ (WebKit::WebPageProxy::didCreateContextInWebProcessForVisibilityPropagation): Deleted.
+ (WebKit::WebPageProxy::didCreateContextInGPUProcessForVisibilityPropagation): Deleted.
+ (WebKit::WebPageProxy::grantAccessToPreferenceService): Deleted.
+ (WebKit::WebPageProxy::mediaUsageManager): Deleted.
+ (WebKit::WebPageProxy::addMediaUsageManagerSession): Deleted.
+ (WebKit::WebPageProxy::updateMediaUsageManagerSessionState): Deleted.
+ (WebKit::WebPageProxy::removeMediaUsageManagerSession): Deleted.
+ (WebKit::convertPlatformImageToBitmap): Deleted.
+ (WebKit::WebPageProxy::requestThumbnailWithOperation): Deleted.
+ (WebKit::WebPageProxy::requestThumbnailWithFileWrapper): Deleted.
+ (WebKit::WebPageProxy::requestThumbnailWithPath): Deleted.
+ (WebKit::WebPageProxy::scheduleActivityStateUpdate): Deleted.
+ (WebKit::WebPageProxy::addActivityStateUpdateCompletionHandler): Deleted.
+ (WebKit::WebPageProxy::createAppHighlightInSelectedRange): Deleted.
+ (WebKit::WebPageProxy::restoreAppHighlightsAndScrollToIndex): Deleted.
+ (WebKit::WebPageProxy::setAppHighlightsVisibility): Deleted.
+ (WebKit::WebPageProxy::appHighlightsVisibility): Deleted.
+ (WebKit::WebPageProxy::appHighlightsOverlayRect): Deleted.
+ (WebKit::WebPageProxy::setUpHighlightsObserver): Deleted.
+ (WebKit::WebPageProxy::createNetworkExtensionsSandboxExtensions): Deleted.
+ (WebKit::WebPageProxy::canHandleContextMenuTranslation const): Deleted.
+ (WebKit::WebPageProxy::handleContextMenuTranslation): Deleted.
+ (WebKit::WebPageProxy::requestActiveNowPlayingSessionInfo): Deleted.
+ (WebKit::WebPageProxy::setLastNavigationWasAppInitiated): Deleted.
+ (WebKit::WebPageProxy::lastNavigationWasAppInitiated): Deleted.
+ (WebKit::WebPageProxy::grantAccessToAssetServices): Deleted.
+ (WebKit::WebPageProxy::revokeAccessToAssetServices): Deleted.
+ (WebKit::WebPageProxy::switchFromStaticFontRegistryToUserFontRegistry): Deleted.
+ (WebKit::WebPageProxy::fontdMachExtensionHandle): Deleted.
+ (WebKit::WebPageProxy::contentsOfUserInterfaceItem): Deleted.
+ * UIProcess/Cocoa/WebPasteboardProxyCocoa.mm:
+ (WebKit::WebPasteboardProxy::getPasteboardPathnamesForType):
+ * UIProcess/Cocoa/WebProcessPoolCocoa.mm:
+ (WebKit::WebProcessPool::platformInitializeWebProcess):
+ (WebKit::WebProcessPool::platformInitializeNetworkProcess): Deleted.
+ (WebKit::WebProcessPool::platformInvalidateContext): Deleted.
+ (WebKit::WebProcessPool::parentBundleDirectory): Deleted.
+ (WebKit::WebProcessPool::networkingCachesDirectory): Deleted.
+ (WebKit::WebProcessPool::webContentCachesDirectory): Deleted.
+ (WebKit::WebProcessPool::containerTemporaryDirectory): Deleted.
+ (WebKit::WebProcessPool::setJavaScriptConfigurationFileEnabledFromDefaults): Deleted.
+ (WebKit::WebProcessPool::omitPDFSupport): Deleted.
+ (WebKit::WebProcessPool::processSuppressionEnabled const): Deleted.
+ (WebKit::WebProcessPool::displayBrightness): Deleted.
+ (WebKit::WebProcessPool::backlightLevelDidChangeCallback): Deleted.
+ (WebKit::WebProcessPool::accessibilityPreferencesChangedCallback): Deleted.
+ (WebKit::WebProcessPool::mediaAccessibilityPreferencesChangedCallback): Deleted.
+ (WebKit::WebProcessPool::colorPreferencesDidChangeCallback): Deleted.
+ (WebKit::WebProcessPool::remoteWebInspectorEnabledCallback): Deleted.
+ (WebKit::WebProcessPool::startObservingPreferenceChanges): Deleted.
+ (WebKit::WebProcessPool::registerNotificationObservers): Deleted.
+ (WebKit::WebProcessPool::unregisterNotificationObservers): Deleted.
+ (WebKit::WebProcessPool::isURLKnownHSTSHost const): Deleted.
+ (WebKit::WebProcessPool::nominalFramesPerSecondForDisplay): Deleted.
+ (WebKit::WebProcessPool::startDisplayLink): Deleted.
+ (WebKit::WebProcessPool::stopDisplayLink): Deleted.
+ (WebKit::WebProcessPool::stopDisplayLinks): Deleted.
+ (WebKit::WebProcessPool::setDisplayLinkPreferredFramesPerSecond): Deleted.
+ (WebKit::WebProcessPool::setDisplayLinkForDisplayWantsFullSpeedUpdates): Deleted.
+ (WebKit::WebProcessPool::setCookieStoragePartitioningEnabled): Deleted.
+ (WebKit::WebProcessPool::clearPermanentCredentialsForProtectionSpace): Deleted.
+ (WebKit::networkProcessLatencyQOS): Deleted.
+ (WebKit::networkProcessThroughputQOS): Deleted.
+ (WebKit::webProcessLatencyQOS): Deleted.
+ (WebKit::webProcessThroughputQOS): Deleted.
+ (WebKit::WebProcessPool::applicationIsAboutToSuspend): Deleted.
+ (WebKit::WebProcessPool::notifyProcessPoolsApplicationIsAboutToSuspend): Deleted.
+ (WebKit::WebProcessPool::initializeClassesForParameterCoding): Deleted.
+ (WebKit::WebProcessPool::allowedClassesForParameterCoding const): Deleted.
+ (WebKit::WebProcessPool::notifyPreferencesChanged): Deleted.
+ (WebKit::webProcessPoolHighDynamicRangeDidChangeCallback): Deleted.
+ (WebKit::WebProcessPool::registerHighDynamicRangeChangeCallback): Deleted.
+ (WebKit::WebProcessPool::systemWillSleep): Deleted.
+ (WebKit::WebProcessPool::systemDidWake): Deleted.
+ * UIProcess/Downloads/DownloadProxy.cpp:
+ (WebKit::DownloadProxy::publishProgress):
+ (WebKit::DownloadProxy::decideDestinationWithSuggestedFilename):
+ * UIProcess/GPU/GPUProcessProxy.cpp:
+ (WebKit::GPUProcessProxy::GPUProcessProxy):
+ (WebKit::addCameraSandboxExtensions):
+ (WebKit::addMicrophoneSandboxExtension):
+ (WebKit::addTCCDSandboxExtension):
+ (WebKit::gpuProcessSessionParameters):
+ * UIProcess/Network/NetworkProcessProxy.cpp:
+ (WebKit::NetworkProcessProxy::sendCreationParametersToNewProcess):
+ (WebKit::NetworkProcessProxy::retrieveCacheStorageParameters):
+ * UIProcess/SpeechRecognitionRemoteRealtimeMediaSourceManager.cpp:
+ (WebKit::SpeechRecognitionRemoteRealtimeMediaSourceManager::addSource):
+ * UIProcess/UserMediaPermissionRequestManagerProxy.cpp:
+ (WebKit::UserMediaPermissionRequestManagerProxy::finishGrantingRequest):
+ * UIProcess/UserMediaProcessManager.cpp:
+ (WebKit::UserMediaProcessManager::willCreateMediaStream):
+ * UIProcess/WebPageProxy.cpp:
+ (WebKit::WebPageProxy::maybeInitializeSandboxExtensionHandle):
+ (WebKit::WebPageProxy::didChooseFilesForOpenPanelWithDisplayStringAndIcon):
+ * UIProcess/WebProcessPool.cpp:
+ (WebKit::WebProcessPool::webProcessDataStoreParameters):
+ (WebKit::WebProcessPool::initializeNewWebProcess):
+ (WebKit::WebProcessPool::processDidFinishLaunching):
+ (WebKit::WebProcessPool::resumeDownload):
+ (WebKit::WebProcessPool::startMemorySampler):
+ * UIProcess/WebsiteData/Cocoa/WebsiteDataStoreCocoa.mm:
+ (WebKit::WebsiteDataStore::platformSetNetworkParameters):
+ * UIProcess/WebsiteData/WebsiteDataStore.cpp:
+ (WebKit::WebsiteDataStore::parameters):
+ * WebProcess/FileAPI/BlobRegistryProxy.cpp:
+ (WebKit::BlobRegistryProxy::registerFileBlobURL):
+ * WebProcess/GPU/media/MediaPlayerPrivateRemote.cpp:
+ (WebKit::MediaPlayerPrivateRemote::load):
+
2021-08-13 Youenn Fablet <you...@apple.com>
Overly verbose catchable fetch error messages lead to cross-origin leaks
Modified: trunk/Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.cpp (281031 => 281032)
--- trunk/Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.cpp 2021-08-13 20:14:07 UTC (rev 281031)
+++ trunk/Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.cpp 2021-08-13 20:53:03 UTC (rev 281032)
@@ -65,7 +65,8 @@
const FormDataElement& element = elements[i];
if (auto* fileData = WTF::get_if<FormDataElement::EncodedFileData>(element.data)) {
const String& path = fileData->filename;
- SandboxExtension::createHandle(path, SandboxExtension::Type::ReadOnly, requestBodySandboxExtensions[extensionIndex++]);
+ if (auto handle = SandboxExtension::createHandle(path, SandboxExtension::Type::ReadOnly))
+ requestBodySandboxExtensions[extensionIndex++] = WTFMove(*handle);
}
}
encoder << requestBodySandboxExtensions;
@@ -74,11 +75,15 @@
if (request.url().isLocalFile()) {
SandboxExtension::Handle requestSandboxExtension;
#if HAVE(AUDIT_TOKEN)
- if (networkProcessAuditToken)
- SandboxExtension::createHandleForReadByAuditToken(request.url().fileSystemPath(), *networkProcessAuditToken, requestSandboxExtension);
- else
+ if (networkProcessAuditToken) {
+ if (auto handle = SandboxExtension::createHandleForReadByAuditToken(request.url().fileSystemPath(), *networkProcessAuditToken))
+ requestSandboxExtension = WTFMove(*handle);
+ } else
#endif
- SandboxExtension::createHandle(request.url().fileSystemPath(), SandboxExtension::Type::ReadOnly, requestSandboxExtension);
+ {
+ if (auto handle = SandboxExtension::createHandle(request.url().fileSystemPath(), SandboxExtension::Type::ReadOnly))
+ requestSandboxExtension = WTFMove(*handle);
+ }
encoder << requestSandboxExtension;
}
Modified: trunk/Source/WebKit/Platform/IPC/FormDataReference.h (281031 => 281032)
--- trunk/Source/WebKit/Platform/IPC/FormDataReference.h 2021-08-13 20:14:07 UTC (rev 281031)
+++ trunk/Source/WebKit/Platform/IPC/FormDataReference.h 2021-08-13 20:53:03 UTC (rev 281032)
@@ -61,7 +61,8 @@
for (auto& element : elements) {
if (auto* fileData = WTF::get_if<WebCore::FormDataElement::EncodedFileData>(element.data)) {
const String& path = fileData->filename;
- WebKit::SandboxExtension::createHandle(path, WebKit::SandboxExtension::Type::ReadOnly, sandboxExtensionHandles[extensionIndex++]);
+ if (auto handle = WebKit::SandboxExtension::createHandle(path, WebKit::SandboxExtension::Type::ReadOnly))
+ sandboxExtensionHandles[extensionIndex++] = WTFMove(*handle);
}
}
encoder << sandboxExtensionHandles;
Modified: trunk/Source/WebKit/Shared/Cocoa/SandboxExtensionCocoa.mm (281031 => 281032)
--- trunk/Source/WebKit/Shared/Cocoa/SandboxExtensionCocoa.mm 2021-08-13 20:14:07 UTC (rev 281031)
+++ trunk/Source/WebKit/Shared/Cocoa/SandboxExtensionCocoa.mm 2021-08-13 20:53:03 UTC (rev 281032)
@@ -276,27 +276,26 @@
return resolvedPath;
}
-bool SandboxExtension::createHandleWithoutResolvingPath(const String& path, Type type, Handle& handle)
+auto SandboxExtension::createHandleWithoutResolvingPath(const String& path, Type type) -> std::optional<Handle>
{
+ Handle handle;
ASSERT(!handle.m_sandboxExtension);
handle.m_sandboxExtension = SandboxExtensionImpl::create(path.utf8().data(), type, std::nullopt, SandboxExtension::Flags::DoNotCanonicalize);
if (!handle.m_sandboxExtension) {
LOG_ERROR("Could not create a sandbox extension for '%s'", path.utf8().data());
- return false;
+ return std::nullopt;
}
- return true;
+ return WTFMove(handle);
}
-bool SandboxExtension::createHandle(const String& path, Type type, Handle& handle)
+auto SandboxExtension::createHandle(const String& path, Type type) -> std::optional<Handle>
{
- ASSERT(!handle.m_sandboxExtension);
-
- return createHandleWithoutResolvingPath(resolvePathForSandboxExtension(path), type, handle);
+ return createHandleWithoutResolvingPath(resolvePathForSandboxExtension(path), type);
}
template <typename T>
-static SandboxExtension::HandleArray createHandlesForResources(const Vector<T>& resources, Function<bool(const T&, SandboxExtension::Handle& handle)>&& createFunction)
+static SandboxExtension::HandleArray createHandlesForResources(const Vector<T>& resources, Function<std::optional<SandboxExtension::Handle>(const T&)>&& createFunction)
{
SandboxExtension::HandleArray handleArray;
@@ -305,8 +304,10 @@
size_t currentHandle = 0;
for (const auto& resource : resources) {
- if (!createFunction(resource, handleArray[currentHandle]))
+ auto handle = createFunction(resource);
+ if (!handle)
continue;
+ handleArray[currentHandle] = WTFMove(*handle);
++currentHandle;
}
@@ -315,34 +316,34 @@
SandboxExtension::HandleArray SandboxExtension::createReadOnlyHandlesForFiles(ASCIILiteral logLabel, const Vector<String>& paths)
{
- return createHandlesForResources(paths, Function<bool(const String&, Handle&)>([&logLabel] (const String& path, Handle& handle) {
- if (!SandboxExtension::createHandle(path, SandboxExtension::Type::ReadOnly, handle)) {
+ return createHandlesForResources<String>(paths, [&logLabel] (const String& path) {
+ auto handle = SandboxExtension::createHandle(path, SandboxExtension::Type::ReadOnly);
+ if (!handle) {
// This can legitimately fail if a directory containing the file is deleted after the file was chosen.
// We also have reports of cases where this likely fails for some unknown reason, <rdar://problem/10156710>.
WTFLogAlways("%s: could not create a sandbox extension for '%s'\n", logLabel.characters(), path.utf8().data());
ASSERT_NOT_REACHED();
- return false;
}
- return true;
- }));
+ return handle;
+ });
}
-bool SandboxExtension::createHandleForReadWriteDirectory(const String& path, SandboxExtension::Handle& handle)
+auto SandboxExtension::createHandleForReadWriteDirectory(const String& path) -> std::optional<Handle>
{
String resolvedPath = resolveAndCreateReadWriteDirectoryForSandboxExtension(path);
if (resolvedPath.isNull())
- return false;
-
- return SandboxExtension::createHandleWithoutResolvingPath(resolvedPath, SandboxExtension::Type::ReadWrite, handle);
+ return std::nullopt;
+ return SandboxExtension::createHandleWithoutResolvingPath(resolvedPath, SandboxExtension::Type::ReadWrite);
}
-String SandboxExtension::createHandleForTemporaryFile(const String& prefix, Type type, Handle& handle)
+auto SandboxExtension::createHandleForTemporaryFile(const String& prefix, Type type) -> std::optional<std::pair<Handle, String>>
{
+ Handle handle;
ASSERT(!handle.m_sandboxExtension);
Vector<char> path(PATH_MAX);
if (!confstr(_CS_DARWIN_USER_TEMP_DIR, path.data(), path.size()))
- return String();
+ return std::nullopt;
// Shrink the vector.
path.shrink(strlen(path.data()));
@@ -360,83 +361,83 @@
if (!handle.m_sandboxExtension) {
WTFLogAlways("Could not create a sandbox extension for temporary file '%s'", path.data());
- return String();
+ return std::nullopt;
}
- return String(path.data());
+ return {{ WTFMove(handle), String(path.data()) }};
}
-bool SandboxExtension::createHandleForGenericExtension(ASCIILiteral extensionClass, Handle& handle)
+auto SandboxExtension::createHandleForGenericExtension(ASCIILiteral extensionClass) -> std::optional<Handle>
{
+ Handle handle;
ASSERT(!handle.m_sandboxExtension);
handle.m_sandboxExtension = SandboxExtensionImpl::create(extensionClass.characters(), Type::Generic);
if (!handle.m_sandboxExtension) {
WTFLogAlways("Could not create a '%s' sandbox extension", extensionClass.characters());
- return false;
+ return std::nullopt;
}
- return true;
+ return WTFMove(handle);
}
-bool SandboxExtension::createHandleForMachLookup(ASCIILiteral service, std::optional<audit_token_t> auditToken, Handle& handle, OptionSet<Flags> flags)
+auto SandboxExtension::createHandleForMachLookup(ASCIILiteral service, std::optional<audit_token_t> auditToken, OptionSet<Flags> flags) -> std::optional<Handle>
{
+ Handle handle;
ASSERT(!handle.m_sandboxExtension);
handle.m_sandboxExtension = SandboxExtensionImpl::create(service.characters(), Type::Mach, auditToken, flags);
if (!handle.m_sandboxExtension) {
WTFLogAlways("Could not create a '%s' sandbox extension", service.characters());
- return false;
+ return std::nullopt;
}
- return true;
+ return WTFMove(handle);
}
SandboxExtension::HandleArray SandboxExtension::createHandlesForMachLookup(const Vector<ASCIILiteral>& services, std::optional<audit_token_t> auditToken, OptionSet<Flags> flags)
{
- return createHandlesForResources(services, Function<bool(const ASCIILiteral&, Handle&)>([auditToken, flags] (const ASCIILiteral& service, Handle& handle) {
- if (!SandboxExtension::createHandleForMachLookup(service, auditToken, handle, flags)) {
- ASSERT_NOT_REACHED();
- return false;
- }
- return true;
- }));
+ return createHandlesForResources<ASCIILiteral>(services, [auditToken, flags] (const ASCIILiteral& service) -> std::optional<Handle> {
+ auto handle = SandboxExtension::createHandleForMachLookup(service, auditToken, flags);
+ ASSERT(handle);
+ return handle;
+ });
}
-bool SandboxExtension::createHandleForReadByAuditToken(const String& path, audit_token_t auditToken, Handle& handle)
+auto SandboxExtension::createHandleForReadByAuditToken(const String& path, audit_token_t auditToken) -> std::optional<Handle>
{
+ Handle handle;
ASSERT(!handle.m_sandboxExtension);
handle.m_sandboxExtension = SandboxExtensionImpl::create(path.utf8().data(), Type::ReadByProcess, auditToken);
if (!handle.m_sandboxExtension) {
LOG_ERROR("Could not create a sandbox extension for '%s'", path.utf8().data());
- return false;
+ return std::nullopt;
}
- return true;
+ return WTFMove(handle);
}
-bool SandboxExtension::createHandleForIOKitClassExtension(ASCIILiteral ioKitClass, std::optional<audit_token_t> auditToken, Handle& handle, OptionSet<Flags> flags)
+auto SandboxExtension::createHandleForIOKitClassExtension(ASCIILiteral ioKitClass, std::optional<audit_token_t> auditToken, OptionSet<Flags> flags) -> std::optional<Handle>
{
+ Handle handle;
ASSERT(!handle.m_sandboxExtension);
handle.m_sandboxExtension = SandboxExtensionImpl::create(ioKitClass.characters(), Type::IOKit, auditToken);
if (!handle.m_sandboxExtension) {
LOG_ERROR("Could not create a sandbox extension for '%s'", ioKitClass.characters());
- return false;
+ return std::nullopt;
}
- return true;
+ return WTFMove(handle);
}
SandboxExtension::HandleArray SandboxExtension::createHandlesForIOKitClassExtensions(const Vector<ASCIILiteral>& iokitClasses, std::optional<audit_token_t> auditToken, OptionSet<Flags> flags)
{
- return createHandlesForResources(iokitClasses, Function<bool(const ASCIILiteral&, Handle&)>([auditToken, flags] (const ASCIILiteral& iokitClass, Handle& handle) {
- if (!SandboxExtension::createHandleForIOKitClassExtension(iokitClass, auditToken, handle, flags)) {
- ASSERT_NOT_REACHED();
- return false;
- }
- return true;
- }));
+ return createHandlesForResources<ASCIILiteral>(iokitClasses, [auditToken, flags] (const ASCIILiteral& iokitClass) {
+ auto handle = SandboxExtension::createHandleForIOKitClassExtension(iokitClass, auditToken, flags);
+ ASSERT(handle);
+ return handle;
+ });
}
SandboxExtension::SandboxExtension(const Handle& handle)
Modified: trunk/Source/WebKit/Shared/SandboxExtension.h (281031 => 281032)
--- trunk/Source/WebKit/Shared/SandboxExtension.h 2021-08-13 20:14:07 UTC (rev 281031)
+++ trunk/Source/WebKit/Shared/SandboxExtension.h 2021-08-13 20:53:03 UTC (rev 281032)
@@ -112,17 +112,17 @@
};
static RefPtr<SandboxExtension> create(Handle&&);
- static bool createHandle(const String& path, Type, Handle&);
+ static std::optional<Handle> createHandle(const String& path, Type);
static SandboxExtension::HandleArray createReadOnlyHandlesForFiles(ASCIILiteral logLabel, const Vector<String>& paths);
- static bool createHandleWithoutResolvingPath(const String& path, Type, Handle&);
- static bool createHandleForReadWriteDirectory(const String& path, Handle&); // Will attempt to create the directory.
- static String createHandleForTemporaryFile(const String& prefix, Type, Handle&);
- static bool createHandleForGenericExtension(ASCIILiteral extensionClass, Handle&);
+ static std::optional<Handle> createHandleWithoutResolvingPath(const String& path, Type);
+ static std::optional<Handle> createHandleForReadWriteDirectory(const String& path); // Will attempt to create the directory.
+ static std::optional<std::pair<Handle, String>> createHandleForTemporaryFile(const String& prefix, Type);
+ static std::optional<Handle> createHandleForGenericExtension(ASCIILiteral extensionClass);
#if HAVE(AUDIT_TOKEN)
- static bool createHandleForMachLookup(ASCIILiteral service, std::optional<audit_token_t>, Handle&, OptionSet<Flags> = Flags::Default);
+ static std::optional<Handle> createHandleForMachLookup(ASCIILiteral service, std::optional<audit_token_t>, OptionSet<Flags> = Flags::Default);
static HandleArray createHandlesForMachLookup(const Vector<ASCIILiteral>& services, std::optional<audit_token_t>, OptionSet<Flags> = Flags::Default);
- static bool createHandleForReadByAuditToken(const String& path, audit_token_t, Handle&);
- static bool createHandleForIOKitClassExtension(ASCIILiteral iokitClass, std::optional<audit_token_t>, Handle&, OptionSet<Flags> = Flags::Default);
+ static std::optional<Handle> createHandleForReadByAuditToken(const String& path, audit_token_t);
+ static std::optional<Handle> createHandleForIOKitClassExtension(ASCIILiteral iokitClass, std::optional<audit_token_t>, OptionSet<Flags> = Flags::Default);
static HandleArray createHandlesForIOKitClassExtensions(const Vector<ASCIILiteral>& iokitClasses, std::optional<audit_token_t>, OptionSet<Flags> = Flags::Default);
#endif
~SandboxExtension();
@@ -162,12 +162,12 @@
inline void SandboxExtension::HandleArray::encode(IPC::Encoder&) const { }
inline auto SandboxExtension::HandleArray::decode(IPC::Decoder&) -> std::optional<HandleArray> { return { HandleArray() }; }
inline RefPtr<SandboxExtension> SandboxExtension::create(Handle&&) { return nullptr; }
-inline bool SandboxExtension::createHandle(const String&, Type, Handle&) { return true; }
+inline auto SandboxExtension::createHandle(const String&, Type) -> std::optional<Handle> { return {{ }}; }
inline SandboxExtension::HandleArray SandboxExtension::createReadOnlyHandlesForFiles(ASCIILiteral, const Vector<String>&) { return { }; }
-inline bool SandboxExtension::createHandleWithoutResolvingPath(const String&, Type, Handle&) { return true; }
-inline bool SandboxExtension::createHandleForReadWriteDirectory(const String&, Handle&) { return true; }
-inline String SandboxExtension::createHandleForTemporaryFile(const String& /*prefix*/, Type, Handle&) {return String();}
-inline bool SandboxExtension::createHandleForGenericExtension(ASCIILiteral /*extensionClass*/, Handle&) { return true; }
+inline auto SandboxExtension::createHandleWithoutResolvingPath(const String&, Type) -> std::optional<Handle> { return {{ }}; }
+inline auto SandboxExtension::createHandleForReadWriteDirectory(const String&) -> std::optional<Handle> { return {{ }}; }
+inline auto SandboxExtension::createHandleForTemporaryFile(const String& /*prefix*/, Type) -> std::optional<std::pair<Handle, String>> { return std::optional<std::pair<Handle, String>> { std::pair<Handle, String> { Handle { }, String { } } }; }
+inline auto SandboxExtension::createHandleForGenericExtension(ASCIILiteral /*extensionClass*/) -> std::optional<Handle> { return {{ }}; }
inline SandboxExtension::~SandboxExtension() { }
inline bool SandboxExtension::revoke() { return true; }
inline bool SandboxExtension::consume() { return true; }
Modified: trunk/Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm (281031 => 281032)
--- trunk/Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm 2021-08-13 20:14:07 UTC (rev 281031)
+++ trunk/Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm 2021-08-13 20:53:03 UTC (rev 281032)
@@ -177,13 +177,11 @@
#if PLATFORM(IOS)
if (!process.hasManagedSessionSandboxAccess() && [getWebFilterEvaluatorClass() isManagedSession]) {
- SandboxExtension::Handle handle;
- SandboxExtension::createHandleForMachLookup("com.apple.uikit.viewservice.com.apple.WebContentFilter.remoteUI"_s, std::nullopt, handle);
- loadParameters.contentFilterExtensionHandle = WTFMove(handle);
+ if (auto handle = SandboxExtension::createHandleForMachLookup("com.apple.uikit.viewservice.com.apple.WebContentFilter.remoteUI"_s, std::nullopt))
+ loadParameters.contentFilterExtensionHandle = WTFMove(*handle);
- SandboxExtension::Handle frontboardServiceExtensionHandle;
- if (SandboxExtension::createHandleForMachLookup("com.apple.frontboard.systemappservices"_s, std::nullopt, frontboardServiceExtensionHandle))
- loadParameters.frontboardServiceExtensionHandle = WTFMove(frontboardServiceExtensionHandle);
+ if (auto handle = SandboxExtension::createHandleForMachLookup("com.apple.frontboard.systemappservices"_s, std::nullopt))
+ loadParameters.frontboardServiceExtensionHandle = WTFMove(*handle);
process.markHasManagedSessionSandboxAccess();
}
@@ -199,10 +197,11 @@
BOOL isDirectory;
if ([[NSFileManager defaultManager] fileExistsAtPath:files[0] isDirectory:&isDirectory] && !isDirectory) {
ASSERT(process().connection() && process().connection()->getAuditToken());
- if (process().connection() && process().connection()->getAuditToken())
- SandboxExtension::createHandleForReadByAuditToken("/", *(process().connection()->getAuditToken()), fileReadHandle);
- else
- SandboxExtension::createHandle("/", SandboxExtension::Type::ReadOnly, fileReadHandle);
+ if (process().connection() && process().connection()->getAuditToken()) {
+ if (auto handle = SandboxExtension::createHandleForReadByAuditToken("/", *(process().connection()->getAuditToken())))
+ fileReadHandle = WTFMove(*handle);
+ } else if (auto handle = SandboxExtension::createHandle("/", SandboxExtension::Type::ReadOnly))
+ fileReadHandle = WTFMove(*handle);
willAcquireUniversalFileReadSandboxExtension(m_process);
}
}
@@ -212,7 +211,8 @@
NSString *file = files[i];
if (![[NSFileManager defaultManager] fileExistsAtPath:file])
continue;
- SandboxExtension::createHandle(file, SandboxExtension::Type::ReadOnly, fileUploadHandles[i]);
+ if (auto handle = SandboxExtension::createHandle(file, SandboxExtension::Type::ReadOnly))
+ fileUploadHandles[i] = WTFMove(*handle);
}
}
@@ -685,7 +685,8 @@
void WebPageProxy::grantAccessToAssetServices()
{
SandboxExtension::Handle mobileAssetHandleV2;
- SandboxExtension::createHandleForMachLookup("com.apple.mobileassetd.v2"_s, std::nullopt, mobileAssetHandleV2);
+ if (auto handle = SandboxExtension::createHandleForMachLookup("com.apple.mobileassetd.v2"_s, std::nullopt))
+ mobileAssetHandleV2 = WTFMove(*handle);
process().send(Messages::WebProcess::GrantAccessToAssetServices(mobileAssetHandleV2), 0);
}
@@ -702,7 +703,8 @@
SandboxExtension::Handle WebPageProxy::fontdMachExtensionHandle()
{
SandboxExtension::Handle fontMachExtensionHandle;
- SandboxExtension::createHandleForMachLookup("com.apple.fonts"_s, std::nullopt, fontMachExtensionHandle);
+ if (auto handle = SandboxExtension::createHandleForMachLookup("com.apple.fonts"_s, std::nullopt))
+ fontMachExtensionHandle = WTFMove(*handle);
return fontMachExtensionHandle;
}
Modified: trunk/Source/WebKit/UIProcess/Cocoa/WebPasteboardProxyCocoa.mm (281031 => 281032)
--- trunk/Source/WebKit/UIProcess/Cocoa/WebPasteboardProxyCocoa.mm 2021-08-13 20:14:07 UTC (rev 281031)
+++ trunk/Source/WebKit/UIProcess/Cocoa/WebPasteboardProxyCocoa.mm 2021-08-13 20:53:03 UTC (rev 281032)
@@ -178,7 +178,8 @@
auto& filename = pathnames[i];
if (![[NSFileManager defaultManager] fileExistsAtPath:filename])
continue;
- SandboxExtension::createHandle(filename, SandboxExtension::Type::ReadOnly, sandboxExtensions[i]);
+ if (auto handle = SandboxExtension::createHandle(filename, SandboxExtension::Type::ReadOnly))
+ sandboxExtensions[i] = WTFMove(*handle);
}
#endif
}
Modified: trunk/Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm (281031 => 281032)
--- trunk/Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm 2021-08-13 20:14:07 UTC (rev 281031)
+++ trunk/Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm 2021-08-13 20:53:03 UTC (rev 281032)
@@ -328,7 +328,8 @@
// FIXME: This should really be configurable; we shouldn't just blindly allow read access to the UI process bundle.
parameters.uiProcessBundleResourcePath = m_resolvedPaths.uiProcessBundleResourcePath;
- SandboxExtension::createHandleWithoutResolvingPath(parameters.uiProcessBundleResourcePath, SandboxExtension::Type::ReadOnly, parameters.uiProcessBundleResourcePathExtensionHandle);
+ if (auto handle = SandboxExtension::createHandleWithoutResolvingPath(parameters.uiProcessBundleResourcePath, SandboxExtension::Type::ReadOnly))
+ parameters.uiProcessBundleResourcePathExtensionHandle = WTFMove(*handle);
parameters.uiProcessBundleIdentifier = applicationBundleIdentifier();
@@ -336,20 +337,25 @@
parameters.throughputQOS = webProcessThroughputQOS();
#if PLATFORM(IOS_FAMILY)
- if (!m_resolvedPaths.cookieStorageDirectory.isEmpty())
- SandboxExtension::createHandleWithoutResolvingPath(m_resolvedPaths.cookieStorageDirectory, SandboxExtension::Type::ReadWrite, parameters.cookieStorageDirectoryExtensionHandle);
+ if (!m_resolvedPaths.cookieStorageDirectory.isEmpty()) {
+ if (auto handle = SandboxExtension::createHandleWithoutResolvingPath(m_resolvedPaths.cookieStorageDirectory, SandboxExtension::Type::ReadWrite))
+ parameters.cookieStorageDirectoryExtensionHandle = WTFMove(*handle);
+ }
- if (!m_resolvedPaths.containerCachesDirectory.isEmpty())
- SandboxExtension::createHandleWithoutResolvingPath(m_resolvedPaths.containerCachesDirectory, SandboxExtension::Type::ReadWrite, parameters.containerCachesDirectoryExtensionHandle);
+ if (!m_resolvedPaths.containerCachesDirectory.isEmpty()) {
+ if (auto handle = SandboxExtension::createHandleWithoutResolvingPath(m_resolvedPaths.containerCachesDirectory, SandboxExtension::Type::ReadWrite))
+ parameters.containerCachesDirectoryExtensionHandle = WTFMove(*handle);
+ }
- if (!m_resolvedPaths.containerTemporaryDirectory.isEmpty())
- SandboxExtension::createHandleWithoutResolvingPath(m_resolvedPaths.containerTemporaryDirectory, SandboxExtension::Type::ReadWrite, parameters.containerTemporaryDirectoryExtensionHandle);
+ if (!m_resolvedPaths.containerTemporaryDirectory.isEmpty()) {
+ if (auto handle = SandboxExtension::createHandleWithoutResolvingPath(m_resolvedPaths.containerTemporaryDirectory, SandboxExtension::Type::ReadWrite))
+ parameters.containerTemporaryDirectoryExtensionHandle = WTFMove(*handle);
+ }
#endif
#if PLATFORM(COCOA) && ENABLE(REMOTE_INSPECTOR)
if (WebProcessProxy::shouldEnableRemoteInspector()) {
- SandboxExtension::Handle enableRemoteWebInspectorExtensionHandle;
- if (SandboxExtension::createHandleForMachLookup("com.apple.webinspector"_s, std::nullopt, enableRemoteWebInspectorExtensionHandle))
- parameters.enableRemoteWebInspectorExtensionHandle = WTFMove(enableRemoteWebInspectorExtensionHandle);
+ if (auto handle = SandboxExtension::createHandleForMachLookup("com.apple.webinspector"_s, std::nullopt))
+ parameters.enableRemoteWebInspectorExtensionHandle = WTFMove(*handle);
}
#endif
@@ -395,8 +401,10 @@
#if PLATFORM(MAC) || PLATFORM(MACCATALYST)
// FIXME: Remove this and related parameter when <rdar://problem/29448368> is fixed.
- if (isSafari && mediaDevicesEnabled && !m_defaultPageGroup->preferences().captureAudioInUIProcessEnabled() && !m_defaultPageGroup->preferences().captureAudioInGPUProcessEnabled())
- SandboxExtension::createHandleForGenericExtension("com.apple.webkit.microphone"_s, parameters.audioCaptureExtensionHandle);
+ if (isSafari && mediaDevicesEnabled && !m_defaultPageGroup->preferences().captureAudioInUIProcessEnabled() && !m_defaultPageGroup->preferences().captureAudioInGPUProcessEnabled()) {
+ if (auto handle = SandboxExtension::createHandleForGenericExtension("com.apple.webkit.microphone"_s))
+ parameters.audioCaptureExtensionHandle = WTFMove(*handle);
+ }
#else
UNUSED_PARAM(mediaDevicesEnabled);
#endif
@@ -432,9 +440,8 @@
parameters.systemHasAC = cachedSystemHasAC().value_or(true);
if (requiresContainerManagerAccess()) {
- SandboxExtension::Handle handle;
- SandboxExtension::createHandleForMachLookup("com.apple.containermanagerd"_s, std::nullopt, handle);
- parameters.containerManagerExtensionHandle = WTFMove(handle);
+ if (auto handle = SandboxExtension::createHandleForMachLookup("com.apple.containermanagerd"_s, std::nullopt))
+ parameters.containerManagerExtensionHandle = WTFMove(*handle);
}
#if PLATFORM(IOS_FAMILY)
@@ -453,16 +460,14 @@
#if PLATFORM(IOS_FAMILY) && !PLATFORM(MACCATALYST)
if (!_MGCacheValid()) {
- SandboxExtension::Handle handle;
- SandboxExtension::createHandleForMachLookup("com.apple.mobilegestalt.xpc"_s, std::nullopt, handle);
- parameters.mobileGestaltExtensionHandle = WTFMove(handle);
+ if (auto handle = SandboxExtension::createHandleForMachLookup("com.apple.mobilegestalt.xpc"_s, std::nullopt))
+ parameters.mobileGestaltExtensionHandle = WTFMove(*handle);
}
#endif
#if PLATFORM(MAC)
- SandboxExtension::Handle launchServicesExtensionHandle;
- SandboxExtension::createHandleForMachLookup("com.apple.coreservices.launchservicesd"_s, std::nullopt, launchServicesExtensionHandle);
- parameters.launchServicesExtensionHandle = WTFMove(launchServicesExtensionHandle);
+ if (auto launchServicesExtensionHandle = SandboxExtension::createHandleForMachLookup("com.apple.coreservices.launchservicesd"_s, std::nullopt))
+ parameters.launchServicesExtensionHandle = WTFMove(*launchServicesExtensionHandle);
#endif
#if HAVE(VIDEO_RESTRICTED_DECODING)
Modified: trunk/Source/WebKit/UIProcess/Downloads/DownloadProxy.cpp (281031 => 281032)
--- trunk/Source/WebKit/UIProcess/Downloads/DownloadProxy.cpp 2021-08-13 20:14:07 UTC (rev 281031)
+++ trunk/Source/WebKit/UIProcess/Downloads/DownloadProxy.cpp 2021-08-13 20:53:03 UTC (rev 281032)
@@ -107,8 +107,11 @@
return;
SandboxExtension::Handle handle;
- bool createdSandboxExtension = SandboxExtension::createHandle(URL.fileSystemPath(), SandboxExtension::Type::ReadWrite, handle);
- ASSERT_UNUSED(createdSandboxExtension, createdSandboxExtension);
+ if (auto createdHandle = SandboxExtension::createHandle(URL.fileSystemPath(), SandboxExtension::Type::ReadWrite))
+ handle = WTFMove(*createdHandle);
+ else
+ ASSERT_NOT_REACHED();
+
m_dataStore->networkProcess().send(Messages::NetworkProcess::PublishDownloadProgress(m_downloadID, URL, handle), 0);
}
#endif // PLATFORM(COCOA)
@@ -163,8 +166,10 @@
m_client->decideDestinationWithSuggestedFilename(*this, response, ResourceResponseBase::sanitizeSuggestedFilename(suggestedFilename), [this, protectedThis = makeRef(*this), completionHandler = WTFMove(completionHandler)] (AllowOverwrite allowOverwrite, String destination) mutable {
SandboxExtension::Handle sandboxExtensionHandle;
- if (!destination.isNull())
- SandboxExtension::createHandle(destination, SandboxExtension::Type::ReadWrite, sandboxExtensionHandle);
+ if (!destination.isNull()) {
+ if (auto handle = SandboxExtension::createHandle(destination, SandboxExtension::Type::ReadWrite))
+ sandboxExtensionHandle = WTFMove(*handle);
+ }
setDestinationFilename(destination);
completionHandler(destination, WTFMove(sandboxExtensionHandle), allowOverwrite);
Modified: trunk/Source/WebKit/UIProcess/GPU/GPUProcessProxy.cpp (281031 => 281032)
--- trunk/Source/WebKit/UIProcess/GPU/GPUProcessProxy.cpp 2021-08-13 20:14:07 UTC (rev 281031)
+++ trunk/Source/WebKit/UIProcess/GPU/GPUProcessProxy.cpp 2021-08-13 20:53:03 UTC (rev 281032)
@@ -143,7 +143,8 @@
#if PLATFORM(MAC)
// FIXME: Remove this and related parameter when <rdar://problem/29448368> is fixed.
if (MacApplication::isSafari()) {
- SandboxExtension::createHandleForGenericExtension("com.apple.webkit.microphone"_s, parameters.microphoneSandboxExtensionHandle);
+ if (auto handle = SandboxExtension::createHandleForGenericExtension("com.apple.webkit.microphone"_s))
+ parameters.microphoneSandboxExtensionHandle = WTFMove(*handle);
m_hasSentMicrophoneSandboxExtension = true;
}
#endif
@@ -155,11 +156,15 @@
auto containerCachesDirectory = resolveAndCreateReadWriteDirectoryForSandboxExtension(gpuProcessCachesDirectory());
auto containerTemporaryDirectory = resolveAndCreateReadWriteDirectoryForSandboxExtension(WebProcessPool::containerTemporaryDirectory());
- if (!containerCachesDirectory.isEmpty())
- SandboxExtension::createHandleWithoutResolvingPath(containerCachesDirectory, SandboxExtension::Type::ReadWrite, parameters.containerCachesDirectoryExtensionHandle);
+ if (!containerCachesDirectory.isEmpty()) {
+ if (auto handle = SandboxExtension::createHandleWithoutResolvingPath(containerCachesDirectory, SandboxExtension::Type::ReadWrite))
+ parameters.containerCachesDirectoryExtensionHandle = WTFMove(*handle);
+ }
- if (!containerTemporaryDirectory.isEmpty())
- SandboxExtension::createHandleWithoutResolvingPath(containerTemporaryDirectory, SandboxExtension::Type::ReadWrite, parameters.containerTemporaryDirectoryExtensionHandle);
+ if (!containerTemporaryDirectory.isEmpty()) {
+ if (auto handle = SandboxExtension::createHandleWithoutResolvingPath(containerTemporaryDirectory, SandboxExtension::Type::ReadWrite))
+ parameters.containerTemporaryDirectoryExtensionHandle = WTFMove(*handle);
+ }
#endif
#if PLATFORM(IOS_FAMILY)
if (WebCore::deviceHasAGXCompilerService()) {
@@ -199,42 +204,42 @@
static inline bool addCameraSandboxExtensions(Vector<SandboxExtension::Handle>& extensions)
{
- SandboxExtension::Handle sandboxExtensionHandle;
- if (!SandboxExtension::createHandleForGenericExtension("com.apple.webkit.camera"_s, sandboxExtensionHandle)) {
+ auto sandboxExtensionHandle = SandboxExtension::createHandleForGenericExtension("com.apple.webkit.camera"_s);
+ if (!sandboxExtensionHandle) {
RELEASE_LOG_ERROR(WebRTC, "Unable to create com.apple.webkit.camera sandbox extension");
return false;
}
#if HAVE(AUDIT_TOKEN)
if (shouldCreateAppleCameraServiceSandboxExtension()) {
- SandboxExtension::Handle appleCameraServicePathSandboxExtensionHandle;
- if (!SandboxExtension::createHandleForMachLookup("com.apple.applecamerad"_s, std::nullopt, appleCameraServicePathSandboxExtensionHandle)) {
+ auto appleCameraServicePathSandboxExtensionHandle = SandboxExtension::createHandleForMachLookup("com.apple.applecamerad"_s, std::nullopt);
+ if (!appleCameraServicePathSandboxExtensionHandle) {
RELEASE_LOG_ERROR(WebRTC, "Unable to create com.apple.applecamerad sandbox extension");
return false;
}
#if HAVE(ADDITIONAL_APPLE_CAMERA_SERVICE)
- SandboxExtension::Handle additionalAppleCameraServicePathSandboxExtensionHandle;
- if (!SandboxExtension::createHandleForMachLookup("com.apple.appleh13camerad"_s, std::nullopt, additionalAppleCameraServicePathSandboxExtensionHandle)) {
+ auto additionalAppleCameraServicePathSandboxExtensionHandle = SandboxExtension::createHandleForMachLookup("com.apple.appleh13camerad"_s, std::nullopt);
+ if (!additionalAppleCameraServicePathSandboxExtensionHandle) {
RELEASE_LOG_ERROR(WebRTC, "Unable to create com.apple.appleh13camerad sandbox extension");
return false;
}
- extensions.append(WTFMove(additionalAppleCameraServicePathSandboxExtensionHandle));
+ extensions.append(WTFMove(*additionalAppleCameraServicePathSandboxExtensionHandle));
#endif
- extensions.append(WTFMove(appleCameraServicePathSandboxExtensionHandle));
+ extensions.append(WTFMove(*appleCameraServicePathSandboxExtensionHandle));
}
#endif // HAVE(AUDIT_TOKEN)
- extensions.append(WTFMove(sandboxExtensionHandle));
+ extensions.append(WTFMove(*sandboxExtensionHandle));
return true;
}
static inline bool addMicrophoneSandboxExtension(Vector<SandboxExtension::Handle>& extensions)
{
- SandboxExtension::Handle sandboxExtensionHandle;
- if (!SandboxExtension::createHandleForGenericExtension("com.apple.webkit.microphone"_s, sandboxExtensionHandle)) {
+ auto sandboxExtensionHandle = SandboxExtension::createHandleForGenericExtension("com.apple.webkit.microphone"_s);
+ if (!sandboxExtensionHandle) {
RELEASE_LOG_ERROR(WebRTC, "Unable to create com.apple.webkit.microphone sandbox extension");
return false;
}
- extensions.append(WTFMove(sandboxExtensionHandle));
+ extensions.append(WTFMove(*sandboxExtensionHandle));
return true;
}
@@ -241,12 +246,12 @@
#if PLATFORM(IOS)
static inline bool addTCCDSandboxExtension(Vector<SandboxExtension::Handle>& extensions)
{
- SandboxExtension::Handle sandboxExtensionHandle;
- if (!SandboxExtension::createHandleForMachLookup("com.apple.tccd"_s, std::nullopt, sandboxExtensionHandle)) {
+ auto handle = SandboxExtension::createHandleForMachLookup("com.apple.tccd"_s, std::nullopt);
+ if (!handle) {
RELEASE_LOG_ERROR(WebRTC, "Unable to create com.apple.tccd sandbox extension");
return false;
}
- extensions.append(WTFMove(sandboxExtensionHandle));
+ extensions.append(WTFMove(*handle));
return true;
}
#endif
@@ -454,14 +459,18 @@
parameters.mediaCacheDirectory = store.resolvedMediaCacheDirectory();
SandboxExtension::Handle mediaCacheDirectoryExtensionHandle;
- if (!parameters.mediaCacheDirectory.isEmpty())
- SandboxExtension::createHandleWithoutResolvingPath(parameters.mediaCacheDirectory, SandboxExtension::Type::ReadWrite, parameters.mediaCacheDirectorySandboxExtensionHandle);
+ if (!parameters.mediaCacheDirectory.isEmpty()) {
+ if (auto handle = SandboxExtension::createHandleWithoutResolvingPath(parameters.mediaCacheDirectory, SandboxExtension::Type::ReadWrite))
+ parameters.mediaCacheDirectorySandboxExtensionHandle = WTFMove(*handle);
+ }
#if ENABLE(LEGACY_ENCRYPTED_MEDIA)
parameters.mediaKeysStorageDirectory = store.resolvedMediaKeysDirectory();
SandboxExtension::Handle mediaKeysStorageDirectorySandboxExtensionHandle;
- if (!parameters.mediaKeysStorageDirectory.isEmpty())
- SandboxExtension::createHandleWithoutResolvingPath(parameters.mediaKeysStorageDirectory, SandboxExtension::Type::ReadWrite, parameters.mediaKeysStorageDirectorySandboxExtensionHandle);
+ if (!parameters.mediaKeysStorageDirectory.isEmpty()) {
+ if (auto handle = SandboxExtension::createHandleWithoutResolvingPath(parameters.mediaKeysStorageDirectory, SandboxExtension::Type::ReadWrite))
+ parameters.mediaKeysStorageDirectorySandboxExtensionHandle = WTFMove(*handle);
+ }
#endif
return parameters;
Modified: trunk/Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp (281031 => 281032)
--- trunk/Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp 2021-08-13 20:14:07 UTC (rev 281031)
+++ trunk/Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp 2021-08-13 20:53:03 UTC (rev 281032)
@@ -150,13 +150,20 @@
for (auto& scheme : WebProcessPool::urlSchemesWithCustomProtocolHandlers())
parameters.urlSchemesRegisteredForCustomProtocols.append(scheme);
#if PLATFORM(IOS_FAMILY)
- if (String cookieStorageDirectory = WebProcessPool::cookieStorageDirectory(); !cookieStorageDirectory.isEmpty())
- SandboxExtension::createHandleForReadWriteDirectory(cookieStorageDirectory, parameters.cookieStorageDirectoryExtensionHandle);
- if (String containerCachesDirectory = WebProcessPool::networkingCachesDirectory(); !containerCachesDirectory.isEmpty())
- SandboxExtension::createHandleForReadWriteDirectory(containerCachesDirectory, parameters.containerCachesDirectoryExtensionHandle);
- if (String parentBundleDirectory = WebProcessPool::parentBundleDirectory(); !parentBundleDirectory.isEmpty())
- SandboxExtension::createHandle(parentBundleDirectory, SandboxExtension::Type::ReadOnly, parameters.parentBundleDirectoryExtensionHandle);
- SandboxExtension::createHandleForTemporaryFile(emptyString(), SandboxExtension::Type::ReadWrite, parameters.tempDirectoryExtensionHandle);
+ if (String cookieStorageDirectory = WebProcessPool::cookieStorageDirectory(); !cookieStorageDirectory.isEmpty()) {
+ if (auto handle = SandboxExtension::createHandleForReadWriteDirectory(cookieStorageDirectory))
+ parameters.cookieStorageDirectoryExtensionHandle = WTFMove(*handle);
+ }
+ if (String containerCachesDirectory = WebProcessPool::networkingCachesDirectory(); !containerCachesDirectory.isEmpty()) {
+ if (auto handle = SandboxExtension::createHandleForReadWriteDirectory(containerCachesDirectory))
+ parameters.containerCachesDirectoryExtensionHandle = WTFMove(*handle);
+ }
+ if (String parentBundleDirectory = WebProcessPool::parentBundleDirectory(); !parentBundleDirectory.isEmpty()) {
+ if (auto handle = SandboxExtension::createHandle(parentBundleDirectory, SandboxExtension::Type::ReadOnly))
+ parameters.parentBundleDirectoryExtensionHandle = WTFMove(*handle);
+ }
+ if (auto handleAndFilePath = SandboxExtension::createHandleForTemporaryFile(emptyString(), SandboxExtension::Type::ReadWrite))
+ parameters.tempDirectoryExtensionHandle = WTFMove(handleAndFilePath->first);
#endif
#if !PLATFORM(GTK) && !PLATFORM(WPE) // GTK and WPE don't use defaultNetworkProcess
@@ -1301,8 +1308,10 @@
auto& cacheStorageDirectory = store->configuration().cacheStorageDirectory();
SandboxExtension::Handle cacheStorageDirectoryExtensionHandle;
- if (!cacheStorageDirectory.isEmpty())
- SandboxExtension::createHandleForReadWriteDirectory(cacheStorageDirectory, cacheStorageDirectoryExtensionHandle);
+ if (!cacheStorageDirectory.isEmpty()) {
+ if (auto handle = SandboxExtension::createHandleForReadWriteDirectory(cacheStorageDirectory))
+ cacheStorageDirectoryExtensionHandle = WTFMove(*handle);
+ }
send(Messages::NetworkProcess::SetCacheStorageParameters { sessionID, cacheStorageDirectory, cacheStorageDirectoryExtensionHandle }, 0);
}
Modified: trunk/Source/WebKit/UIProcess/SpeechRecognitionRemoteRealtimeMediaSourceManager.cpp (281031 => 281032)
--- trunk/Source/WebKit/UIProcess/SpeechRecognitionRemoteRealtimeMediaSourceManager.cpp 2021-08-13 20:14:07 UTC (rev 281031)
+++ trunk/Source/WebKit/UIProcess/SpeechRecognitionRemoteRealtimeMediaSourceManager.cpp 2021-08-13 20:53:03 UTC (rev 281032)
@@ -49,9 +49,11 @@
m_sourcesNeedingSandboxExtension.add(identifier);
if (m_sourcesNeedingSandboxExtension.size() == 1) {
SandboxExtension::Handle handleForTCCD;
- SandboxExtension::createHandleForMachLookup("com.apple.tccd"_s, m_connection->getAuditToken(), handleForTCCD);
+ if (auto handle = SandboxExtension::createHandleForMachLookup("com.apple.tccd"_s, m_connection->getAuditToken()))
+ handleForTCCD = WTFMove(*handle);
SandboxExtension::Handle handleForMicrophone;
- SandboxExtension::createHandleForGenericExtension("com.apple.webkit.microphone"_s, handleForMicrophone);
+ if (auto handle = SandboxExtension::createHandleForGenericExtension("com.apple.webkit.microphone"_s))
+ handleForMicrophone = WTFMove(*handle);
send(Messages::SpeechRecognitionRealtimeMediaSourceManager::GrantSandboxExtensions(handleForTCCD, handleForMicrophone));
}
}
Modified: trunk/Source/WebKit/UIProcess/UserMediaPermissionRequestManagerProxy.cpp (281031 => 281032)
--- trunk/Source/WebKit/UIProcess/UserMediaPermissionRequestManagerProxy.cpp 2021-08-13 20:14:07 UTC (rev 281031)
+++ trunk/Source/WebKit/UIProcess/UserMediaPermissionRequestManagerProxy.cpp 2021-08-13 20:53:03 UTC (rev 281032)
@@ -292,7 +292,8 @@
SandboxExtension::Handle handle;
#if PLATFORM(COCOA)
if (!m_hasCreatedSandboxExtensionForTCCD && doesPageNeedTCCD(m_page)) {
- SandboxExtension::createHandleForMachLookup("com.apple.tccd"_s, m_page.process().connection()->getAuditToken(), handle);
+ if (auto createdHandle = SandboxExtension::createHandleForMachLookup("com.apple.tccd"_s, m_page.process().connection()->getAuditToken()))
+ handle = WTFMove(*createdHandle);
m_hasCreatedSandboxExtensionForTCCD = true;
}
#endif
Modified: trunk/Source/WebKit/UIProcess/UserMediaProcessManager.cpp (281031 => 281032)
--- trunk/Source/WebKit/UIProcess/UserMediaProcessManager.cpp 2021-08-13 20:14:07 UTC (rev 281031)
+++ trunk/Source/WebKit/UIProcess/UserMediaProcessManager.cpp 2021-08-13 20:53:03 UTC (rev 281032)
@@ -100,18 +100,30 @@
handles.allocate(extensionCount);
ids.reserveInitialCapacity(extensionCount);
- if (needsAudioSandboxExtension && SandboxExtension::createHandleForGenericExtension(audioExtensionPath, handles[--extensionCount]))
- ids.uncheckedAppend(audioExtensionPath);
+ if (needsAudioSandboxExtension) {
+ if (auto handle = SandboxExtension::createHandleForGenericExtension(audioExtensionPath)) {
+ handles[--extensionCount] = WTFMove(*handle);
+ ids.uncheckedAppend(audioExtensionPath);
+ }
+ }
- if (needsVideoSandboxExtension && SandboxExtension::createHandleForGenericExtension(videoExtensionPath, handles[--extensionCount]))
- ids.uncheckedAppend(videoExtensionPath);
+ if (needsVideoSandboxExtension) {
+ if (auto handle = SandboxExtension::createHandleForGenericExtension(videoExtensionPath)) {
+ handles[--extensionCount] = WTFMove(*handle);
+ ids.uncheckedAppend(videoExtensionPath);
+ }
+ }
if (needsAppleCameraSandboxExtension) {
- if (SandboxExtension::createHandleForMachLookup(appleCameraServicePath, std::nullopt, handles[--extensionCount]))
+ if (auto handle = SandboxExtension::createHandleForMachLookup(appleCameraServicePath, std::nullopt)) {
+ handles[--extensionCount] = WTFMove(*handle);
ids.uncheckedAppend(appleCameraServicePath);
+ }
#if HAVE(ADDITIONAL_APPLE_CAMERA_SERVICE)
- if (SandboxExtension::createHandleForMachLookup(additionalAppleCameraServicePath, std::nullopt, handles[--extensionCount]))
+ if (auto handle = SandboxExtension::createHandleForMachLookup(additionalAppleCameraServicePath, std::nullopt)) {
+ handles[--extensionCount] = WTFMove(*handle);
ids.uncheckedAppend(additionalAppleCameraServicePath);
+ }
#endif
}
Modified: trunk/Source/WebKit/UIProcess/WebPageProxy.cpp (281031 => 281032)
--- trunk/Source/WebKit/UIProcess/WebPageProxy.cpp 2021-08-13 20:14:07 UTC (rev 281031)
+++ trunk/Source/WebKit/UIProcess/WebPageProxy.cpp 2021-08-13 20:53:03 UTC (rev 281032)
@@ -1265,11 +1265,19 @@
bool createdExtension = false;
#if HAVE(AUDIT_TOKEN)
ASSERT(process.connection() && process.connection()->getAuditToken());
- if (process.connection() && process.connection()->getAuditToken())
- createdExtension = SandboxExtension::createHandleForReadByAuditToken(resourceDirectoryURL.fileSystemPath(), *(process.connection()->getAuditToken()), sandboxExtensionHandle);
- else
+ if (process.connection() && process.connection()->getAuditToken()) {
+ if (auto handle = SandboxExtension::createHandleForReadByAuditToken(resourceDirectoryURL.fileSystemPath(), *(process.connection()->getAuditToken()))) {
+ sandboxExtensionHandle = WTFMove(*handle);
+ createdExtension = true;
+ }
+ } else
#endif
- createdExtension = SandboxExtension::createHandle(resourceDirectoryURL.fileSystemPath(), SandboxExtension::Type::ReadOnly, sandboxExtensionHandle);
+ {
+ if (auto handle = SandboxExtension::createHandle(resourceDirectoryURL.fileSystemPath(), SandboxExtension::Type::ReadOnly)) {
+ sandboxExtensionHandle = WTFMove(*handle);
+ createdExtension = true;
+ }
+ }
if (createdExtension) {
process.assumeReadAccessToBaseURL(*this, resourceDirectoryURL.string());
@@ -1286,11 +1294,19 @@
bool createdExtension = false;
#if HAVE(AUDIT_TOKEN)
ASSERT(process.connection() && process.connection()->getAuditToken());
- if (process.connection() && process.connection()->getAuditToken())
- createdExtension = SandboxExtension::createHandleForReadByAuditToken("/", *(process.connection()->getAuditToken()), sandboxExtensionHandle);
- else
+ if (process.connection() && process.connection()->getAuditToken()) {
+ if (auto handle = SandboxExtension::createHandleForReadByAuditToken("/", *(process.connection()->getAuditToken()))) {
+ createdExtension = true;
+ sandboxExtensionHandle = WTFMove(*handle);
+ }
+ } else
#endif
- createdExtension = SandboxExtension::createHandle("/", SandboxExtension::Type::ReadOnly, sandboxExtensionHandle);
+ {
+ if (auto handle = SandboxExtension::createHandle("/", SandboxExtension::Type::ReadOnly)) {
+ createdExtension = true;
+ sandboxExtensionHandle = WTFMove(*handle);
+ }
+ }
if (createdExtension) {
willAcquireUniversalFileReadSandboxExtension(process);
@@ -1308,11 +1324,19 @@
if (basePath.isNull())
return;
#if HAVE(AUDIT_TOKEN)
- if (process.connection() && process.connection()->getAuditToken())
- createdExtension = SandboxExtension::createHandleForReadByAuditToken(basePath, *(process.connection()->getAuditToken()), sandboxExtensionHandle);
- else
+ if (process.connection() && process.connection()->getAuditToken()) {
+ if (auto handle = SandboxExtension::createHandleForReadByAuditToken(basePath, *(process.connection()->getAuditToken()))) {
+ sandboxExtensionHandle = WTFMove(*handle);
+ createdExtension = true;
+ }
+ } else
#endif
- createdExtension = SandboxExtension::createHandle(basePath, SandboxExtension::Type::ReadOnly, sandboxExtensionHandle);
+ {
+ if (auto handle = SandboxExtension::createHandle(basePath, SandboxExtension::Type::ReadOnly)) {
+ sandboxExtensionHandle = WTFMove(*handle);
+ createdExtension = true;
+ }
+ }
if (createdExtension)
process.assumeReadAccessToBaseURL(*this, baseURL.string());
@@ -7001,9 +7025,11 @@
SandboxExtension::Handle frontboardServicesSandboxExtension, iconServicesSandboxExtension;
#if HAVE(FRONTBOARD_SYSTEM_APP_SERVICES)
- SandboxExtension::createHandleForMachLookup("com.apple.frontboard.systemappservices"_s, std::nullopt, frontboardServicesSandboxExtension);
+ if (auto handle = SandboxExtension::createHandleForMachLookup("com.apple.frontboard.systemappservices"_s, std::nullopt))
+ frontboardServicesSandboxExtension = WTFMove(*handle);
#endif
- SandboxExtension::createHandleForMachLookup("com.apple.iconservices"_s, std::nullopt, iconServicesSandboxExtension);
+ if (auto handle = SandboxExtension::createHandleForMachLookup("com.apple.iconservices"_s, std::nullopt))
+ iconServicesSandboxExtension = WTFMove(*handle);
send(Messages::WebPage::DidChooseFilesForOpenPanelWithDisplayStringAndIcon(fileURLs, displayString, iconData ? iconData->dataReference() : IPC::DataReference(), frontboardServicesSandboxExtension, iconServicesSandboxExtension));
Modified: trunk/Source/WebKit/UIProcess/WebProcessPool.cpp (281031 => 281032)
--- trunk/Source/WebKit/UIProcess/WebProcessPool.cpp 2021-08-13 20:14:07 UTC (rev 281031)
+++ trunk/Source/WebKit/UIProcess/WebProcessPool.cpp 2021-08-13 20:53:03 UTC (rev 281032)
@@ -673,20 +673,26 @@
String applicationCacheDirectory = websiteDataStore.resolvedApplicationCacheDirectory();
SandboxExtension::Handle applicationCacheDirectoryExtensionHandle;
- if (!applicationCacheDirectory.isEmpty())
- SandboxExtension::createHandleWithoutResolvingPath(applicationCacheDirectory, SandboxExtension::Type::ReadWrite, applicationCacheDirectoryExtensionHandle);
+ if (!applicationCacheDirectory.isEmpty()) {
+ if (auto handle = SandboxExtension::createHandleWithoutResolvingPath(applicationCacheDirectory, SandboxExtension::Type::ReadWrite))
+ applicationCacheDirectoryExtensionHandle = WTFMove(*handle);
+ }
String applicationCacheFlatFileSubdirectoryName = websiteDataStore.applicationCacheFlatFileSubdirectoryName();
String mediaCacheDirectory = websiteDataStore.resolvedMediaCacheDirectory();
SandboxExtension::Handle mediaCacheDirectoryExtensionHandle;
- if (!mediaCacheDirectory.isEmpty())
- SandboxExtension::createHandleWithoutResolvingPath(mediaCacheDirectory, SandboxExtension::Type::ReadWrite, mediaCacheDirectoryExtensionHandle);
+ if (!mediaCacheDirectory.isEmpty()) {
+ if (auto handle = SandboxExtension::createHandleWithoutResolvingPath(mediaCacheDirectory, SandboxExtension::Type::ReadWrite))
+ mediaCacheDirectoryExtensionHandle = WTFMove(*handle);
+ }
String mediaKeyStorageDirectory = websiteDataStore.resolvedMediaKeysDirectory();
SandboxExtension::Handle mediaKeyStorageDirectoryExtensionHandle;
- if (!mediaKeyStorageDirectory.isEmpty())
- SandboxExtension::createHandleWithoutResolvingPath(mediaKeyStorageDirectory, SandboxExtension::Type::ReadWrite, mediaKeyStorageDirectoryExtensionHandle);
+ if (!mediaKeyStorageDirectory.isEmpty()) {
+ if (auto handle = SandboxExtension::createHandleWithoutResolvingPath(mediaKeyStorageDirectory, SandboxExtension::Type::ReadWrite))
+ mediaKeyStorageDirectoryExtensionHandle = WTFMove(*handle);
+ }
String _javascript_ConfigurationDirectory;
if (!m_javaScriptConfigurationDirectory.isEmpty())
@@ -695,14 +701,18 @@
_javascript_ConfigurationDirectory = websiteDataStore.resolvedJavaScriptConfigurationDirectory();
SandboxExtension::Handle _javascript_ConfigurationDirectoryExtensionHandle;
- if (!_javascript_ConfigurationDirectory.isEmpty())
- SandboxExtension::createHandleWithoutResolvingPath(_javascript_ConfigurationDirectory, SandboxExtension::Type::ReadWrite, _javascript_ConfigurationDirectoryExtensionHandle);
+ if (!_javascript_ConfigurationDirectory.isEmpty()) {
+ if (auto handle = SandboxExtension::createHandleWithoutResolvingPath(_javascript_ConfigurationDirectory, SandboxExtension::Type::ReadWrite))
+ _javascript_ConfigurationDirectoryExtensionHandle = WTFMove(*handle);
+ }
#if HAVE(ARKIT_INLINE_PREVIEW)
auto modelElementCacheDirectory = websiteDataStore.resolvedModelElementCacheDirectory();
SandboxExtension::Handle modelElementCacheDirectoryExtensionHandle;
- if (!modelElementCacheDirectory.isEmpty())
- SandboxExtension::createHandleWithoutResolvingPath(modelElementCacheDirectory, SandboxExtension::Type::ReadWrite, modelElementCacheDirectoryExtensionHandle);
+ if (!modelElementCacheDirectory.isEmpty()) {
+ if (auto handle = SandboxExtension::createHandleWithoutResolvingPath(modelElementCacheDirectory, SandboxExtension::Type::ReadWrite))
+ modelElementCacheDirectoryExtensionHandle = WTFMove(*handle);
+ }
#endif
return WebProcessDataStoreParameters {
@@ -742,12 +752,16 @@
WebProcessCreationParameters parameters;
parameters.injectedBundlePath = m_resolvedPaths.injectedBundlePath;
- if (!parameters.injectedBundlePath.isEmpty())
- SandboxExtension::createHandleWithoutResolvingPath(parameters.injectedBundlePath, SandboxExtension::Type::ReadOnly, parameters.injectedBundlePathExtensionHandle);
+ if (!parameters.injectedBundlePath.isEmpty()) {
+ if (auto handle = SandboxExtension::createHandleWithoutResolvingPath(parameters.injectedBundlePath, SandboxExtension::Type::ReadOnly))
+ parameters.injectedBundlePathExtensionHandle = WTFMove(*handle);
+ }
parameters.additionalSandboxExtensionHandles.allocate(m_resolvedPaths.additionalWebProcessSandboxExtensionPaths.size());
- for (size_t i = 0, size = m_resolvedPaths.additionalWebProcessSandboxExtensionPaths.size(); i < size; ++i)
- SandboxExtension::createHandleWithoutResolvingPath(m_resolvedPaths.additionalWebProcessSandboxExtensionPaths[i], SandboxExtension::Type::ReadOnly, parameters.additionalSandboxExtensionHandles[i]);
+ for (size_t i = 0, size = m_resolvedPaths.additionalWebProcessSandboxExtensionPaths.size(); i < size; ++i) {
+ if (auto handle = SandboxExtension::createHandleWithoutResolvingPath(m_resolvedPaths.additionalWebProcessSandboxExtensionPaths[i], SandboxExtension::Type::ReadOnly))
+ parameters.additionalSandboxExtensionHandles[i] = WTFMove(*handle);
+ }
#if PLATFORM(IOS_FAMILY)
setJavaScriptConfigurationFileEnabledFromDefaults();
@@ -901,7 +915,10 @@
SandboxExtension::Handle sampleLogSandboxHandle;
WallTime now = WallTime::now();
auto sampleLogFilePath = makeString("WebProcess", static_cast<unsigned long long>(now.secondsSinceEpoch().seconds()), "pid", process.processIdentifier());
- sampleLogFilePath = SandboxExtension::createHandleForTemporaryFile(sampleLogFilePath, SandboxExtension::Type::ReadWrite, sampleLogSandboxHandle);
+ if (auto handleAndFilePath = SandboxExtension::createHandleForTemporaryFile(sampleLogFilePath, SandboxExtension::Type::ReadWrite)) {
+ sampleLogSandboxHandle = WTFMove(handleAndFilePath->first);
+ sampleLogFilePath = WTFMove(handleAndFilePath->second);
+ }
process.send(Messages::WebProcess::StartMemorySampler(sampleLogSandboxHandle, sampleLogFilePath, m_memorySamplerInterval), 0);
}
@@ -1160,8 +1177,10 @@
auto& downloadProxy = createDownloadProxy(dataStore, ResourceRequest(), initiatingPage, { });
SandboxExtension::Handle sandboxExtensionHandle;
- if (!path.isEmpty())
- SandboxExtension::createHandle(path, SandboxExtension::Type::ReadWrite, sandboxExtensionHandle);
+ if (!path.isEmpty()) {
+ if (auto handle = SandboxExtension::createHandle(path, SandboxExtension::Type::ReadWrite))
+ sandboxExtensionHandle = WTFMove(*handle);
+ }
dataStore.networkProcess().send(Messages::NetworkProcess::ResumeDownload(dataStore.sessionID(), downloadProxy.downloadID(), resumeData.dataReference(), path, sandboxExtensionHandle, callDownloadDidStart), 0);
return downloadProxy;
@@ -1447,7 +1466,10 @@
SandboxExtension::Handle sampleLogSandboxHandle;
WallTime now = WallTime::now();
auto sampleLogFilePath = makeString("WebProcess", static_cast<unsigned long long>(now.secondsSinceEpoch().seconds()));
- sampleLogFilePath = SandboxExtension::createHandleForTemporaryFile(sampleLogFilePath, SandboxExtension::Type::ReadWrite, sampleLogSandboxHandle);
+ if (auto handleAndFilePath = SandboxExtension::createHandleForTemporaryFile(sampleLogFilePath, SandboxExtension::Type::ReadWrite)) {
+ sampleLogSandboxHandle = WTFMove(handleAndFilePath->first);
+ sampleLogFilePath = WTFMove(handleAndFilePath->second);
+ }
sendToAllProcesses(Messages::WebProcess::StartMemorySampler(sampleLogSandboxHandle, sampleLogFilePath, interval));
}
Modified: trunk/Source/WebKit/UIProcess/WebsiteData/Cocoa/WebsiteDataStoreCocoa.mm (281031 => 281032)
--- trunk/Source/WebKit/UIProcess/WebsiteData/Cocoa/WebsiteDataStoreCocoa.mm 2021-08-13 20:14:07 UTC (rev 281031)
+++ trunk/Source/WebKit/UIProcess/WebsiteData/Cocoa/WebsiteDataStoreCocoa.mm 2021-08-13 20:53:03 UTC (rev 281032)
@@ -150,8 +150,11 @@
bool http3Enabled = WebsiteDataStore::http3Enabled();
SandboxExtension::Handle alternativeServiceStorageDirectoryExtensionHandle;
String alternativeServiceStorageDirectory = resolvedAlternativeServicesStorageDirectory();
- if (!alternativeServiceStorageDirectory.isEmpty())
- SandboxExtension::createHandleForReadWriteDirectory(alternativeServiceStorageDirectory, alternativeServiceStorageDirectoryExtensionHandle);
+ if (!alternativeServiceStorageDirectory.isEmpty()) {
+ // FIXME: SandboxExtension::createHandleForReadWriteDirectory resolves the directory, but that has already been done. Remove this duplicate work.
+ if (auto handle = SandboxExtension::createHandleForReadWriteDirectory(alternativeServiceStorageDirectory))
+ alternativeServiceStorageDirectoryExtensionHandle = WTFMove(*handle);
+ }
#endif
bool shouldIncludeLocalhostInResourceLoadStatistics = isSafari;
@@ -185,8 +188,10 @@
parameters.uiProcessCookieStorageIdentifier = m_uiProcessCookieStorageIdentifier;
- if (!cookieFile.isEmpty())
- SandboxExtension::createHandleForReadWriteDirectory(FileSystem::parentPath(cookieFile), parameters.cookieStoragePathExtensionHandle);
+ if (!cookieFile.isEmpty()) {
+ if (auto handle = SandboxExtension::createHandleForReadWriteDirectory(FileSystem::parentPath(cookieFile)))
+ parameters.cookieStoragePathExtensionHandle = WTFMove(*handle);
+ }
}
#if HAVE(CFNETWORK_ALTERNATIVE_SERVICE) || HAVE(NETWORK_LOADER)
Modified: trunk/Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.cpp (281031 => 281032)
--- trunk/Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.cpp 2021-08-13 20:14:07 UTC (rev 281031)
+++ trunk/Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.cpp 2021-08-13 20:53:03 UTC (rev 281032)
@@ -1932,18 +1932,26 @@
auto resourceLoadStatisticsDirectory = m_configuration->resourceLoadStatisticsDirectory();
SandboxExtension::Handle resourceLoadStatisticsDirectoryHandle;
- if (!resourceLoadStatisticsDirectory.isEmpty())
- SandboxExtension::createHandleForReadWriteDirectory(resourceLoadStatisticsDirectory, resourceLoadStatisticsDirectoryHandle);
+ if (!resourceLoadStatisticsDirectory.isEmpty()) {
+ if (auto handle = SandboxExtension::createHandleForReadWriteDirectory(resourceLoadStatisticsDirectory))
+ resourceLoadStatisticsDirectoryHandle = WTFMove(*handle);
+ }
auto networkCacheDirectory = resolvedNetworkCacheDirectory();
SandboxExtension::Handle networkCacheDirectoryExtensionHandle;
- if (!networkCacheDirectory.isEmpty())
- SandboxExtension::createHandleForReadWriteDirectory(networkCacheDirectory, networkCacheDirectoryExtensionHandle);
+ if (!networkCacheDirectory.isEmpty()) {
+ // FIXME: SandboxExtension::createHandleForReadWriteDirectory resolves the directory, but that has already been done. Remove this duplicate work.
+ if (auto handle = SandboxExtension::createHandleForReadWriteDirectory(networkCacheDirectory))
+ networkCacheDirectoryExtensionHandle = WTFMove(*handle);
+ }
auto hstsStorageDirectory = resolvedHSTSStorageDirectory();
SandboxExtension::Handle hstsStorageDirectoryExtensionHandle;
- if (!hstsStorageDirectory.isEmpty())
- SandboxExtension::createHandleForReadWriteDirectory(hstsStorageDirectory, hstsStorageDirectoryExtensionHandle);
+ if (!hstsStorageDirectory.isEmpty()) {
+ // FIXME: SandboxExtension::createHandleForReadWriteDirectory resolves the directory, but that has already been done. Remove this duplicate work.
+ if (auto handle = SandboxExtension::createHandleForReadWriteDirectory(hstsStorageDirectory))
+ hstsStorageDirectoryExtensionHandle = WTFMove(*handle);
+ }
bool shouldIncludeLocalhostInResourceLoadStatistics = false;
bool enableResourceLoadStatisticsDebugMode = false;
@@ -2004,13 +2012,19 @@
parameters.networkSessionParameters = WTFMove(networkSessionParameters);
parameters.indexedDatabaseDirectory = resolvedIndexedDatabaseDirectory();
- if (!parameters.indexedDatabaseDirectory.isEmpty())
- SandboxExtension::createHandleForReadWriteDirectory(parameters.indexedDatabaseDirectory, parameters.indexedDatabaseDirectoryExtensionHandle);
+ if (!parameters.indexedDatabaseDirectory.isEmpty()) {
+ // FIXME: SandboxExtension::createHandleForReadWriteDirectory resolves the directory, but that has already been done. Remove this duplicate work.
+ if (auto handle = SandboxExtension::createHandleForReadWriteDirectory(parameters.indexedDatabaseDirectory))
+ parameters.indexedDatabaseDirectoryExtensionHandle = WTFMove(*handle);
+ }
#if ENABLE(SERVICE_WORKER)
parameters.serviceWorkerRegistrationDirectory = resolvedServiceWorkerRegistrationDirectory();
- if (!parameters.serviceWorkerRegistrationDirectory.isEmpty())
- SandboxExtension::createHandleForReadWriteDirectory(parameters.serviceWorkerRegistrationDirectory, parameters.serviceWorkerRegistrationDirectoryExtensionHandle);
+ if (!parameters.serviceWorkerRegistrationDirectory.isEmpty()) {
+ // FIXME: SandboxExtension::createHandleForReadWriteDirectory resolves the directory, but that has already been done. Remove this duplicate work.
+ if (auto handle = SandboxExtension::createHandleForReadWriteDirectory(parameters.serviceWorkerRegistrationDirectory))
+ parameters.serviceWorkerRegistrationDirectoryExtensionHandle = WTFMove(*handle);
+ }
parameters.serviceWorkerProcessTerminationDelayEnabled = m_configuration->serviceWorkerProcessTerminationDelayEnabled();
#endif
@@ -2017,13 +2031,16 @@
auto localStorageDirectory = resolvedLocalStorageDirectory();
if (!localStorageDirectory.isEmpty()) {
parameters.localStorageDirectory = localStorageDirectory;
- SandboxExtension::createHandleForReadWriteDirectory(localStorageDirectory, parameters.localStorageDirectoryExtensionHandle);
+ // FIXME: SandboxExtension::createHandleForReadWriteDirectory resolves the directory, but that has already been done. Remove this duplicate work.
+ if (auto handle = SandboxExtension::createHandleForReadWriteDirectory(localStorageDirectory))
+ parameters.localStorageDirectoryExtensionHandle = WTFMove(*handle);
}
auto cacheStorageDirectory = this->cacheStorageDirectory();
if (!cacheStorageDirectory.isEmpty()) {
parameters.cacheStorageDirectory = cacheStorageDirectory;
- SandboxExtension::createHandleForReadWriteDirectory(cacheStorageDirectory, parameters.cacheStorageDirectoryExtensionHandle);
+ if (auto handle = SandboxExtension::createHandleForReadWriteDirectory(cacheStorageDirectory))
+ parameters.cacheStorageDirectoryExtensionHandle = WTFMove(*handle);
}
parameters.perOriginStorageQuota = perOriginStorageQuota();
Modified: trunk/Source/WebKit/WebProcess/FileAPI/BlobRegistryProxy.cpp (281031 => 281032)
--- trunk/Source/WebKit/WebProcess/FileAPI/BlobRegistryProxy.cpp 2021-08-13 20:14:07 UTC (rev 281031)
+++ trunk/Source/WebKit/WebProcess/FileAPI/BlobRegistryProxy.cpp 2021-08-13 20:53:03 UTC (rev 281032)
@@ -42,8 +42,10 @@
SandboxExtension::Handle extensionHandle;
// File path can be empty when submitting a form file input without a file, see bug 111778.
- if (!file->path().isEmpty())
- SandboxExtension::createHandle(file->path(), SandboxExtension::Type::ReadOnly, extensionHandle);
+ if (!file->path().isEmpty()) {
+ if (auto handle = SandboxExtension::createHandle(file->path(), SandboxExtension::Type::ReadOnly))
+ extensionHandle = WTFMove(*handle);
+ }
String replacementPath = path == file->path() ? nullString() : file->path();
WebProcess::singleton().ensureNetworkProcessConnection().connection().send(Messages::NetworkConnectionToWebProcess::RegisterFileBlobURL(url, path, replacementPath, extensionHandle, contentType), 0);
Modified: trunk/Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.cpp (281031 => 281032)
--- trunk/Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.cpp 2021-08-13 20:14:07 UTC (rev 281031)
+++ trunk/Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.cpp 2021-08-13 20:53:03 UTC (rev 281032)
@@ -169,11 +169,19 @@
auto createExtension = [&] {
#if HAVE(AUDIT_TOKEN)
- if (auto auditToken = m_manager.gpuProcessConnection().auditToken())
- return SandboxExtension::createHandleForReadByAuditToken(fileSystemPath, auditToken.value(), handle);
+ if (auto auditToken = m_manager.gpuProcessConnection().auditToken()) {
+ if (auto createdHandle = SandboxExtension::createHandleForReadByAuditToken(fileSystemPath, auditToken.value())) {
+ handle = WTFMove(*createdHandle);
+ return true;
+ }
+ return false;
+ }
#endif
-
- return SandboxExtension::createHandle(fileSystemPath, SandboxExtension::Type::ReadOnly, handle);
+ if (auto createdHandle = SandboxExtension::createHandle(fileSystemPath, SandboxExtension::Type::ReadOnly)) {
+ handle = WTFMove(*createdHandle);
+ return true;
+ }
+ return false;
};
if (!createExtension()) {
