Title: [230827] trunk/Source/WebKit
- Revision
- 230827
- Author
- jiewen_...@apple.com
- Date
- 2018-04-19 16:51:56 -0700 (Thu, 19 Apr 2018)
Log Message
Remove access to keychain from the WebContent process
https://bugs.webkit.org/show_bug.cgi?id=184428
<rdar://problem/13150903>
Reviewed by Brent Fulgham.
Part 1.
Remove com.apple.identities from WebContent-iOS.entitlements, which is needed to encode/decode NSError’s userInfo[NSErrorClientCertificateChainKey]
when the corresponding NSErorr is relayed through WebContent Process from Networking Process to UI Process after a HTTPS client certificate
authentication is rejected becuase of bad certificates. This patch implements corresponding workarounds as well. The workaround works for mac, too.
Sadly, this change can only be tested manually at this moment. Please refer to the radar for testing steps.
* Configurations/WebContent-iOS.entitlements:
* Shared/mac/WebCoreArgumentCodersMac.mm:
(IPC::encodeNSError):
* UIProcess/Cocoa/WebProcessPoolCocoa.mm:
(WebKit::WebProcessPool::platformInitialize):
Modified Paths
Diff
Modified: trunk/Source/WebKit/ChangeLog (230826 => 230827)
--- trunk/Source/WebKit/ChangeLog 2018-04-19 23:30:47 UTC (rev 230826)
+++ trunk/Source/WebKit/ChangeLog 2018-04-19 23:51:56 UTC (rev 230827)
@@ -1,3 +1,25 @@
+2018-04-19 Jiewen Tan <jiewen_...@apple.com>
+
+ Remove access to keychain from the WebContent process
+ https://bugs.webkit.org/show_bug.cgi?id=184428
+ <rdar://problem/13150903>
+
+ Reviewed by Brent Fulgham.
+
+ Part 1.
+
+ Remove com.apple.identities from WebContent-iOS.entitlements, which is needed to encode/decode NSError’s userInfo[NSErrorClientCertificateChainKey]
+ when the corresponding NSErorr is relayed through WebContent Process from Networking Process to UI Process after a HTTPS client certificate
+ authentication is rejected becuase of bad certificates. This patch implements corresponding workarounds as well. The workaround works for mac, too.
+
+ Sadly, this change can only be tested manually at this moment. Please refer to the radar for testing steps.
+
+ * Configurations/WebContent-iOS.entitlements:
+ * Shared/mac/WebCoreArgumentCodersMac.mm:
+ (IPC::encodeNSError):
+ * UIProcess/Cocoa/WebProcessPoolCocoa.mm:
+ (WebKit::WebProcessPool::platformInitialize):
+
2018-04-19 David Kilzer <ddkil...@apple.com>
Enable Objective-C weak references
Modified: trunk/Source/WebKit/Configurations/WebContent-iOS.entitlements (230826 => 230827)
--- trunk/Source/WebKit/Configurations/WebContent-iOS.entitlements 2018-04-19 23:30:47 UTC (rev 230826)
+++ trunk/Source/WebKit/Configurations/WebContent-iOS.entitlements 2018-04-19 23:51:56 UTC (rev 230827)
@@ -2,10 +2,6 @@
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
- <key>keychain-access-groups</key>
- <array>
- <string>com.apple.identities</string>
- </array>
<key>com.apple.private.allow-explicit-graphics-priority</key>
<true/>
<key>com.apple.private.network.socket-delegate</key>
Modified: trunk/Source/WebKit/Shared/mac/WebCoreArgumentCodersMac.mm (230826 => 230827)
--- trunk/Source/WebKit/Shared/mac/WebCoreArgumentCodersMac.mm 2018-04-19 23:30:47 UTC (rev 230826)
+++ trunk/Source/WebKit/Shared/mac/WebCoreArgumentCodersMac.mm 2018-04-19 23:51:56 UTC (rev 230827)
@@ -334,7 +334,26 @@
return true;
}());
- CFDictionarySetValue(filteredUserInfo.get(), @"NSErrorClientCertificateChainKey", clientIdentityAndCertificates);
+ // Turn SecIdentity members into SecCertificate to strip out private key information.
+ id clientCertificates = [NSMutableArray arrayWithCapacity:clientIdentityAndCertificates.count];
+ for (id object in clientIdentityAndCertificates) {
+ if (CFGetTypeID(object) != SecIdentityGetTypeID()) {
+ [clientCertificates addObject:object];
+ continue;
+ }
+ SecCertificateRef certificate = nil;
+ OSStatus status = SecIdentityCopyCertificate((SecIdentityRef)object, &certificate);
+ RetainPtr<SecCertificateRef> retainCertificate = adoptCF(certificate);
+ // The SecIdentity member is the key information of this attribute. Without it, we should nil
+ // the attribute.
+ if (status != errSecSuccess) {
+ LOG_ERROR("Failed to encode nsError.userInfo[NSErrorClientCertificateChainKey]: %d", status);
+ clientCertificates = nil;
+ break;
+ }
+ [clientCertificates addObject:(id)certificate];
+ }
+ CFDictionarySetValue(filteredUserInfo.get(), @"NSErrorClientCertificateChainKey", clientCertificates);
}
id peerCertificateChain = [userInfo objectForKey:@"NSErrorPeerCertificateChainKey"];
Modified: trunk/Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm (230826 => 230827)
--- trunk/Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm 2018-04-19 23:30:47 UTC (rev 230826)
+++ trunk/Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm 2018-04-19 23:51:56 UTC (rev 230827)
@@ -54,7 +54,6 @@
#import <wtf/ProcessPrivilege.h>
#if PLATFORM(IOS)
-#import "ArgumentCodersCF.h"
#import "WebMemoryPressureHandlerIOS.h"
#else
#import <QuartzCore/CARemoteLayerServer.h>
@@ -146,7 +145,6 @@
registerNotificationObservers();
#if PLATFORM(IOS)
- IPC::setAllowsDecodingSecKeyRef(true);
installMemoryPressureHandler();
#endif
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
