Diff
Modified: branches/safari-609-branch/Source/WebKit/ChangeLog (260368 => 260369)
--- branches/safari-609-branch/Source/WebKit/ChangeLog 2020-04-20 16:16:19 UTC (rev 260368)
+++ branches/safari-609-branch/Source/WebKit/ChangeLog 2020-04-20 16:23:25 UTC (rev 260369)
@@ -1,3 +1,58 @@
+2020-04-20 Alan Coon <[email protected]>
+
+ Apply patch. rdar://problem/61950472
+
+ 2020-04-20 Brady Eidson <[email protected]>
+
+ Pass sandbox extensions for back/forward list navigations after the policy is decided at process-swap time.
+ <rdar://problem/59535167> and https://bugs.webkit.org/show_bug.cgi?id=210623
+
+ Reviewed by Geoff Garen.
+
+ Covered by almost all existing tests, and a new API test.
+
+ Instead of granting a sandbox extension when updating the back/forward cursor for a pending
+ back/forward list traversal, do so after the client decides the policy.
+ (Which is also along with a process swap in interesting cases)
+
+ * Shared/PolicyDecision.h:
+ (WebKit::PolicyDecision::encode const):
+ (WebKit::PolicyDecision::decode):
+
+ * Shared/WebPageCreationParameters.h:
+
+ * UIProcess/API/APINavigation.cpp:
+ (API::Navigation::Navigation):
+ * UIProcess/API/APINavigation.h:
+ (API::Navigation::create):
+ (API::Navigation::reloadItem const):
+
+ * UIProcess/ProvisionalPageProxy.cpp:
+ (WebKit::ProvisionalPageProxy::backForwardGoToItem):
+ * UIProcess/ProvisionalPageProxy.h:
+
+ * UIProcess/WebNavigationState.cpp:
+ (WebKit::WebNavigationState::createReloadNavigation):
+ * UIProcess/WebNavigationState.h:
+
+ * UIProcess/WebPageProxy.cpp:
+ (WebKit::WebPageProxy::launchProcessForReload):
+ (WebKit::WebPageProxy::reload):
+ (WebKit::WebPageProxy::receivedNavigationPolicyDecision):
+ (WebKit::WebPageProxy::receivedPolicyDecision):
+ * UIProcess/WebPageProxy.h:
+ (WebKit::WebPageProxy::receivedPolicyDecision):
+ * UIProcess/WebPageProxy.messages.in:
+
+ * WebProcess/WebPage/WebBackForwardListProxy.cpp:
+ (WebKit::WebBackForwardListProxy::goToItem):
+
+ * WebProcess/WebPage/WebFrame.cpp:
+ (WebKit::WebFrame::didReceivePolicyDecision):
+
+ * WebProcess/WebPage/WebPage.cpp:
+ (WebKit::WebPage::SandboxExtensionTracker::didStartProvisionalLoad):
+
2020-04-17 Alan Coon <[email protected]>
Cherry-pick r260278. rdar://problem/61950220
Modified: branches/safari-609-branch/Source/WebKit/Shared/WebPageCreationParameters.h (260368 => 260369)
--- branches/safari-609-branch/Source/WebKit/Shared/WebPageCreationParameters.h 2020-04-20 16:16:19 UTC (rev 260368)
+++ branches/safari-609-branch/Source/WebKit/Shared/WebPageCreationParameters.h 2020-04-20 16:23:25 UTC (rev 260369)
@@ -27,6 +27,7 @@
#include "DrawingAreaInfo.h"
#include "LayerTreeContext.h"
+#include "SandboxExtension.h"
#include "SessionState.h"
#include "WebCompiledContentRuleListData.h"
#include "WebCoreArgumentCoders.h"
Modified: branches/safari-609-branch/Source/WebKit/UIProcess/API/APINavigation.cpp (260368 => 260369)
--- branches/safari-609-branch/Source/WebKit/UIProcess/API/APINavigation.cpp 2020-04-20 16:16:19 UTC (rev 260368)
+++ branches/safari-609-branch/Source/WebKit/UIProcess/API/APINavigation.cpp 2020-04-20 16:23:25 UTC (rev 260369)
@@ -40,6 +40,12 @@
{
}
+Navigation::Navigation(WebNavigationState& state, WebBackForwardListItem* currentAndTargetItem)
+ : m_navigationID(state.generateNavigationID())
+ , m_reloadItem(currentAndTargetItem)
+{
+}
+
Navigation::Navigation(WebNavigationState& state, WebCore::ResourceRequest&& request, WebBackForwardListItem* fromItem)
: m_navigationID(state.generateNavigationID())
, m_originalRequest(WTFMove(request))
Modified: branches/safari-609-branch/Source/WebKit/UIProcess/API/APINavigation.h (260368 => 260369)
--- branches/safari-609-branch/Source/WebKit/UIProcess/API/APINavigation.h 2020-04-20 16:16:19 UTC (rev 260368)
+++ branches/safari-609-branch/Source/WebKit/UIProcess/API/APINavigation.h 2020-04-20 16:23:25 UTC (rev 260369)
@@ -70,9 +70,9 @@
class Navigation : public ObjectImpl<Object::Type::Navigation> {
WTF_MAKE_NONCOPYABLE(Navigation);
public:
- static Ref<Navigation> create(WebKit::WebNavigationState& state)
+ static Ref<Navigation> create(WebKit::WebNavigationState& state, WebKit::WebBackForwardListItem* currentAndTargetItem)
{
- return adoptRef(*new Navigation(state));
+ return adoptRef(*new Navigation(state, currentAndTargetItem));
}
static Ref<Navigation> create(WebKit::WebNavigationState& state, WebKit::WebBackForwardListItem& targetItem, WebKit::WebBackForwardListItem* fromItem, WebCore::FrameLoadType backForwardFrameLoadType)
@@ -104,6 +104,7 @@
WebKit::WebBackForwardListItem* targetItem() const { return m_targetItem.get(); }
WebKit::WebBackForwardListItem* fromItem() const { return m_fromItem.get(); }
Optional<WebCore::FrameLoadType> backForwardFrameLoadType() const { return m_backForwardFrameLoadType; }
+ WebKit::WebBackForwardListItem* reloadItem() const { return m_reloadItem.get(); }
void appendRedirectionURL(const WTF::URL&);
Vector<WTF::URL> takeRedirectChain() { return WTFMove(m_redirectChain); }
@@ -158,6 +159,7 @@
private:
explicit Navigation(WebKit::WebNavigationState&);
+ Navigation(WebKit::WebNavigationState&, WebKit::WebBackForwardListItem*);
Navigation(WebKit::WebNavigationState&, WebCore::ResourceRequest&&, WebKit::WebBackForwardListItem* fromItem);
Navigation(WebKit::WebNavigationState&, WebKit::WebBackForwardListItem& targetItem, WebKit::WebBackForwardListItem* fromItem, WebCore::FrameLoadType);
Navigation(WebKit::WebNavigationState&, std::unique_ptr<SubstituteData>&&);
@@ -170,6 +172,7 @@
RefPtr<WebKit::WebBackForwardListItem> m_targetItem;
RefPtr<WebKit::WebBackForwardListItem> m_fromItem;
+ RefPtr<WebKit::WebBackForwardListItem> m_reloadItem;
Optional<WebCore::FrameLoadType> m_backForwardFrameLoadType;
std::unique_ptr<SubstituteData> m_substituteData;
WebKit::NavigationActionData m_lastNavigationAction;
Modified: branches/safari-609-branch/Source/WebKit/UIProcess/ProvisionalPageProxy.cpp (260368 => 260369)
--- branches/safari-609-branch/Source/WebKit/UIProcess/ProvisionalPageProxy.cpp 2020-04-20 16:16:19 UTC (rev 260368)
+++ branches/safari-609-branch/Source/WebKit/UIProcess/ProvisionalPageProxy.cpp 2020-04-20 16:23:25 UTC (rev 260369)
@@ -334,7 +334,7 @@
m_page.startURLSchemeTaskShared(m_process.copyRef(), m_webPageID, WTFMove(parameters));
}
-void ProvisionalPageProxy::backForwardGoToItem(const WebCore::BackForwardItemIdentifier& identifier, CompletionHandler<void(SandboxExtension::Handle&&)>&& completionHandler)
+void ProvisionalPageProxy::backForwardGoToItem(const WebCore::BackForwardItemIdentifier& identifier, CompletionHandler<void()>&& completionHandler)
{
m_page.backForwardGoToItemShared(m_process.copyRef(), identifier, WTFMove(completionHandler));
}
@@ -345,7 +345,7 @@
const UserData& userData, Messages::WebPageProxy::DecidePolicyForNavigationActionSync::DelayedReply&& reply)
{
if (!isMainFrame || (m_mainFrame && m_mainFrame->frameID() != frameID) || navigationID != m_navigationID) {
- reply(identifier, WebCore::PolicyAction::Ignore, navigationID, DownloadID(), WTF::nullopt);
+ reply(identifier, WebCore::PolicyAction::Ignore, navigationID, DownloadID(), WTF::nullopt, WTF::nullopt);
return;
}
Modified: branches/safari-609-branch/Source/WebKit/UIProcess/ProvisionalPageProxy.h (260368 => 260369)
--- branches/safari-609-branch/Source/WebKit/UIProcess/ProvisionalPageProxy.h 2020-04-20 16:16:19 UTC (rev 260368)
+++ branches/safari-609-branch/Source/WebKit/UIProcess/ProvisionalPageProxy.h 2020-04-20 16:23:25 UTC (rev 260369)
@@ -125,7 +125,7 @@
void didCommitLoadForFrame(WebCore::FrameIdentifier, uint64_t navigationID, const String& mimeType, bool frameHasCustomContentProvider, uint32_t frameLoadType, const WebCore::CertificateInfo&, bool usedLegacyTLS, bool containsPluginDocument, Optional<WebCore::HasInsecureContent> forcedHasInsecureContent, const UserData&);
void didFailProvisionalLoadForFrame(WebCore::FrameIdentifier, WebCore::SecurityOriginData&& frameSecurityOrigin, uint64_t navigationID, const String& provisionalURL, const WebCore::ResourceError&, WebCore::WillContinueLoading, const UserData&);
void startURLSchemeTask(URLSchemeTaskParameters&&);
- void backForwardGoToItem(const WebCore::BackForwardItemIdentifier&, CompletionHandler<void(SandboxExtension::Handle&&)>&&);
+ void backForwardGoToItem(const WebCore::BackForwardItemIdentifier&, CompletionHandler<void()>&&);
void decidePolicyForNavigationActionSync(WebCore::FrameIdentifier, bool isMainFrame, WebCore::SecurityOriginData&&, WebCore::PolicyCheckIdentifier, uint64_t navigationID, NavigationActionData&&,
FrameInfoData&&, Optional<WebPageProxyIdentifier> originatingPageID, const WebCore::ResourceRequest& originalRequest, WebCore::ResourceRequest&&, IPC::FormDataReference&& requestBody,
WebCore::ResourceResponse&& redirectResponse, const UserData&, Messages::WebPageProxy::DecidePolicyForNavigationActionSyncDelayedReply&&);
Modified: branches/safari-609-branch/Source/WebKit/UIProcess/WebNavigationState.cpp (260368 => 260369)
--- branches/safari-609-branch/Source/WebKit/UIProcess/WebNavigationState.cpp 2020-04-20 16:16:19 UTC (rev 260368)
+++ branches/safari-609-branch/Source/WebKit/UIProcess/WebNavigationState.cpp 2020-04-20 16:23:25 UTC (rev 260369)
@@ -59,9 +59,9 @@
return navigation;
}
-Ref<API::Navigation> WebNavigationState::createReloadNavigation()
+Ref<API::Navigation> WebNavigationState::createReloadNavigation(WebBackForwardListItem* currentAndTargetItem)
{
- auto navigation = API::Navigation::create(*this);
+ auto navigation = API::Navigation::create(*this, currentAndTargetItem);
m_navigations.set(navigation->navigationID(), navigation.ptr());
Modified: branches/safari-609-branch/Source/WebKit/UIProcess/WebNavigationState.h (260368 => 260369)
--- branches/safari-609-branch/Source/WebKit/UIProcess/WebNavigationState.h 2020-04-20 16:16:19 UTC (rev 260368)
+++ branches/safari-609-branch/Source/WebKit/UIProcess/WebNavigationState.h 2020-04-20 16:23:25 UTC (rev 260369)
@@ -52,7 +52,7 @@
Ref<API::Navigation> createBackForwardNavigation(WebBackForwardListItem& targetItem, WebBackForwardListItem* currentItem, WebCore::FrameLoadType);
Ref<API::Navigation> createLoadRequestNavigation(WebCore::ResourceRequest&&, WebBackForwardListItem* currentItem);
- Ref<API::Navigation> createReloadNavigation();
+ Ref<API::Navigation> createReloadNavigation(WebBackForwardListItem* currentAndTargetItem);
Ref<API::Navigation> createLoadDataNavigation(std::unique_ptr<API::SubstituteData>&&);
bool hasNavigation(uint64_t navigationID) const { return m_navigations.contains(navigationID); }
Modified: branches/safari-609-branch/Source/WebKit/UIProcess/WebPageProxy.cpp (260368 => 260369)
--- branches/safari-609-branch/Source/WebKit/UIProcess/WebPageProxy.cpp 2020-04-20 16:16:19 UTC (rev 260368)
+++ branches/safari-609-branch/Source/WebKit/UIProcess/WebPageProxy.cpp 2020-04-20 16:23:25 UTC (rev 260369)
@@ -953,7 +953,7 @@
return nullptr;
}
- auto navigation = m_navigationState->createReloadNavigation();
+ auto navigation = m_navigationState->createReloadNavigation(m_backForwardList->currentItem());
String url = ""
if (!url.isEmpty()) {
@@ -1516,7 +1516,7 @@
if (!hasRunningProcess())
return launchProcessForReload();
- auto navigation = m_navigationState->createReloadNavigation();
+ auto navigation = m_navigationState->createReloadNavigation(m_backForwardList->currentItem());
if (!url.isEmpty()) {
auto transaction = m_pageLoadState.transaction();
@@ -3013,7 +3013,7 @@
class WebPageProxy::PolicyDecisionSender : public RefCounted<PolicyDecisionSender> {
public:
- using SendFunction = CompletionHandler<void(PolicyCheckIdentifier, PolicyAction, uint64_t newNavigationID, DownloadID, Optional<WebsitePoliciesData>)>;
+ using SendFunction = CompletionHandler<void(PolicyCheckIdentifier, PolicyAction, uint64_t newNavigationID, DownloadID, Optional<WebsitePoliciesData>, Optional<SandboxExtension::Handle>)>;
static Ref<PolicyDecisionSender> create(PolicyCheckIdentifier identifier, SendFunction&& sendFunction)
{
@@ -3102,6 +3102,7 @@
} else
RELEASE_LOG_IF_ALLOWED(ProcessSwapping, "decidePolicyForNavigationAction: keep using process %i for navigation, reason: %{public}s", processIdentifier(), reason.utf8().data());
+ Optional<SandboxExtension::Handle> optionalHandle;
if (shouldProcessSwap) {
// Make sure the process to be used for the navigation does not get shutDown now due to destroying SuspendedPageProxy or ProvisionalPageProxy objects.
auto preventNavigationProcessShutdown = processForNavigation->makeScopePreventingShutdown();
@@ -3113,16 +3114,26 @@
suspendedPage = nullptr;
continueNavigationInNewProcess(navigation, WTFMove(suspendedPage), WTFMove(processForNavigation), processSwapRequestedByClient, WTFMove(data));
+ } else {
+ auto item = navigation->reloadItem() ? navigation->reloadItem() : navigation->targetItem();
+ if (policyAction == PolicyAction::Use && item) {
+ auto fullURL = URL { URL(), item->url() };
+ if (fullURL.protocolIs("file"_s)) {
+ SandboxExtension::Handle sandboxExtensionHandle;
+ maybeInitializeSandboxExtensionHandle(processForNavigation.get(), fullURL, item->resourceDirectoryURL(), sandboxExtensionHandle);
+ optionalHandle = WTFMove(sandboxExtensionHandle);
+ }
+ }
}
- receivedPolicyDecision(policyAction, navigation.ptr(), shouldProcessSwap ? WTF::nullopt : WTFMove(data), WTFMove(sender), shouldProcessSwap ? WillContinueLoadInNewProcess::Yes : WillContinueLoadInNewProcess::No);
+ receivedPolicyDecision(policyAction, navigation.ptr(), shouldProcessSwap ? WTF::nullopt : WTFMove(data), WTFMove(sender), WTFMove(optionalHandle), shouldProcessSwap ? WillContinueLoadInNewProcess::Yes : WillContinueLoadInNewProcess::No);
});
}
-void WebPageProxy::receivedPolicyDecision(PolicyAction action, API::Navigation* navigation, Optional<WebsitePoliciesData>&& websitePolicies, Ref<PolicyDecisionSender>&& sender, WillContinueLoadInNewProcess willContinueLoadInNewProcess)
+void WebPageProxy::receivedPolicyDecision(PolicyAction action, API::Navigation* navigation, Optional<WebsitePoliciesData>&& websitePolicies, Ref<PolicyDecisionSender>&& sender, Optional<SandboxExtension::Handle> sandboxExtensionHandle, WillContinueLoadInNewProcess willContinueLoadInNewProcess)
{
if (!hasRunningProcess()) {
- sender->send(PolicyAction::Ignore, 0, DownloadID(), WTF::nullopt);
+ sender->send(PolicyAction::Ignore, 0, DownloadID(), WTF::nullopt, WTF::nullopt);
return;
}
@@ -3145,7 +3156,7 @@
m_decidePolicyForResponseRequest = { };
}
- sender->send(action, navigation ? navigation->navigationID() : 0, downloadID, WTFMove(websitePolicies));
+ sender->send(action, navigation ? navigation->navigationID() : 0, downloadID, WTFMove(websitePolicies), WTFMove(sandboxExtensionHandle));
}
void WebPageProxy::commitProvisionalPage(FrameIdentifier frameID, uint64_t navigationID, const String& mimeType, bool frameHasCustomContentProvider, uint32_t frameLoadType, const WebCore::CertificateInfo& certificateInfo, bool usedLegacyTLS, bool containsPluginDocument, Optional<WebCore::HasInsecureContent> forcedHasInsecureContent, const UserData& userData)
@@ -4921,7 +4932,7 @@
if (!checkURLReceivedFromCurrentOrPreviousWebProcess(process, request.url())) {
RELEASE_LOG_ERROR_IF_ALLOWED(Process, "Ignoring request to load this main resource because it is outside the sandbox");
- sender->send(PolicyAction::Ignore, 0, DownloadID(), WTF::nullopt);
+ sender->send(PolicyAction::Ignore, 0, DownloadID(), WTF::nullopt, WTF::nullopt);
return;
}
@@ -5148,7 +5159,7 @@
originatingPageID, originalRequest, WTFMove(request), WTFMove(requestBody), WTFMove(redirectResponse), userData, sender.copyRef());
// If the client did not respond synchronously, proceed with the load.
- sender->send(PolicyAction::Use, navigationID, DownloadID(), WTF::nullopt);
+ sender->send(PolicyAction::Use, navigationID, DownloadID(), WTF::nullopt, WTF::nullopt);
}
void WebPageProxy::decidePolicyForNewWindowAction(FrameIdentifier frameID, SecurityOriginData&& frameSecurityOrigin, PolicyCheckIdentifier identifier,
@@ -6033,30 +6044,28 @@
m_backForwardList->addItem(WTFMove(item));
}
-void WebPageProxy::backForwardGoToItem(const BackForwardItemIdentifier& itemID, CompletionHandler<void(SandboxExtension::Handle&&)>&& completionHandler)
+void WebPageProxy::backForwardGoToItem(const BackForwardItemIdentifier& itemID, CompletionHandler<void()>&& completionHandler)
{
// On process swap, we tell the previous process to ignore the load, which causes it so restore its current back forward item to its previous
// value. Since the load is really going on in a new provisional process, we want to ignore such requests from the committed process.
// Any real new load in the committed process would have cleared m_provisionalPage.
if (m_provisionalPage)
- return completionHandler({ });
+ return completionHandler();
SandboxExtension::Handle sandboxExtensionHandle;
backForwardGoToItemShared(m_process.copyRef(), itemID, WTFMove(completionHandler));
}
-void WebPageProxy::backForwardGoToItemShared(Ref<WebProcessProxy>&& process, const BackForwardItemIdentifier& itemID, CompletionHandler<void(SandboxExtension::Handle&&)>&& completionHandler)
+void WebPageProxy::backForwardGoToItemShared(Ref<WebProcessProxy>&& process, const BackForwardItemIdentifier& itemID, CompletionHandler<void()>&& completionHandler)
{
- MESSAGE_CHECK_COMPLETION(m_process, !WebKit::isInspectorPage(*this), completionHandler({ }));
+ MESSAGE_CHECK_COMPLETION(m_process, !WebKit::isInspectorPage(*this), completionHandler());
auto* item = m_backForwardList->itemForID(itemID);
if (!item)
- return completionHandler({ });
+ return completionHandler();
- SandboxExtension::Handle sandboxExtensionHandle;
- maybeInitializeSandboxExtensionHandle(process, URL(URL(), item->url()), item->resourceDirectoryURL(), sandboxExtensionHandle);
m_backForwardList->goToItem(*item);
- completionHandler(WTFMove(sandboxExtensionHandle));
+ completionHandler();
}
void WebPageProxy::backForwardItemAtIndex(int32_t index, CompletionHandler<void(Optional<BackForwardItemIdentifier>&&)>&& completionHandler)
Modified: branches/safari-609-branch/Source/WebKit/UIProcess/WebPageProxy.h (260368 => 260369)
--- branches/safari-609-branch/Source/WebKit/UIProcess/WebPageProxy.h 2020-04-20 16:16:19 UTC (rev 260368)
+++ branches/safari-609-branch/Source/WebKit/UIProcess/WebPageProxy.h 2020-04-20 16:23:25 UTC (rev 260369)
@@ -1092,7 +1092,7 @@
class PolicyDecisionSender;
enum class WillContinueLoadInNewProcess : bool { No, Yes };
- void receivedPolicyDecision(WebCore::PolicyAction, API::Navigation*, Optional<WebsitePoliciesData>&&, Ref<PolicyDecisionSender>&&, WillContinueLoadInNewProcess = WillContinueLoadInNewProcess::No);
+ void receivedPolicyDecision(WebCore::PolicyAction, API::Navigation*, Optional<WebsitePoliciesData>&&, Ref<PolicyDecisionSender>&&, Optional<SandboxExtension::Handle> = { }, WillContinueLoadInNewProcess = WillContinueLoadInNewProcess::No);
void receivedNavigationPolicyDecision(WebCore::PolicyAction, API::Navigation*, ProcessSwapRequestedByClient, WebFrameProxy&, API::WebsitePolicies*, Ref<PolicyDecisionSender>&&);
void backForwardRemovedItem(const WebCore::BackForwardItemIdentifier&);
@@ -1579,10 +1579,11 @@
void startURLSchemeTaskShared(Ref<WebProcessProxy>&&, WebCore::PageIdentifier, URLSchemeTaskParameters&&);
void loadDataWithNavigationShared(Ref<WebProcessProxy>&&, WebCore::PageIdentifier, API::Navigation&, const IPC::DataReference&, const String& MIMEType, const String& encoding, const String& baseURL, API::Object* userData, WebCore::ShouldTreatAsContinuingLoad, Optional<WebsitePoliciesData>&& = WTF::nullopt, WebCore::ShouldOpenExternalURLsPolicy = WebCore::ShouldOpenExternalURLsPolicy::ShouldNotAllow);
void loadRequestWithNavigationShared(Ref<WebProcessProxy>&&, WebCore::PageIdentifier, API::Navigation&, WebCore::ResourceRequest&&, WebCore::ShouldOpenExternalURLsPolicy, API::Object* userData, WebCore::ShouldTreatAsContinuingLoad, Optional<WebsitePoliciesData>&& = WTF::nullopt);
- void backForwardGoToItemShared(Ref<WebProcessProxy>&&, const WebCore::BackForwardItemIdentifier&, CompletionHandler<void(SandboxExtension::Handle&&)>&&);
+ void backForwardGoToItemShared(Ref<WebProcessProxy>&&, const WebCore::BackForwardItemIdentifier&, CompletionHandler<void()>&&);
void decidePolicyForNavigationActionSyncShared(Ref<WebProcessProxy>&&, WebCore::FrameIdentifier, bool isMainFrame, WebCore::SecurityOriginData&&, WebCore::PolicyCheckIdentifier, uint64_t navigationID, NavigationActionData&&,
FrameInfoData&&, Optional<WebPageProxyIdentifier> originatingPageID, const WebCore::ResourceRequest& originalRequest, WebCore::ResourceRequest&&, IPC::FormDataReference&& requestBody,
WebCore::ResourceResponse&& redirectResponse, const UserData&, Messages::WebPageProxy::DecidePolicyForNavigationActionSyncDelayedReply&&);
+
#if USE(QUICK_LOOK)
void requestPasswordForQuickLookDocumentInMainFrameShared(const String& fileName, CompletionHandler<void(const String&)>&&);
#endif
@@ -1870,7 +1871,7 @@
// Back/Forward list management
void backForwardAddItem(BackForwardListItemState&&);
- void backForwardGoToItem(const WebCore::BackForwardItemIdentifier&, CompletionHandler<void(SandboxExtension::Handle&&)>&&);
+ void backForwardGoToItem(const WebCore::BackForwardItemIdentifier&, CompletionHandler<void()>&&);
void backForwardItemAtIndex(int32_t index, CompletionHandler<void(Optional<WebCore::BackForwardItemIdentifier>&&)>&&);
void backForwardBackListCount(CompletionHandler<void(uint32_t)>&&);
void backForwardForwardListCount(CompletionHandler<void(uint32_t)>&&);
Modified: branches/safari-609-branch/Source/WebKit/UIProcess/WebPageProxy.messages.in (260368 => 260369)
--- branches/safari-609-branch/Source/WebKit/UIProcess/WebPageProxy.messages.in 2020-04-20 16:16:19 UTC (rev 260368)
+++ branches/safari-609-branch/Source/WebKit/UIProcess/WebPageProxy.messages.in 2020-04-20 16:23:25 UTC (rev 260369)
@@ -102,7 +102,7 @@
# Policy messages
DecidePolicyForResponse(WebCore::FrameIdentifier frameID, struct WebCore::SecurityOriginData frameSecurityOrigin, WebCore::PolicyCheckIdentifier policyCheckIdentifier, uint64_t navigationID, WebCore::ResourceResponse response, WebCore::ResourceRequest request, bool canShowMIMEType, String downloadAttribute, uint64_t listenerID, WebKit::UserData userData)
DecidePolicyForNavigationActionAsync(WebCore::FrameIdentifier frameID, struct WebCore::SecurityOriginData frameSecurityOrigin, WebCore::PolicyCheckIdentifier policyCheckIdentifier, uint64_t navigationID, struct WebKit::NavigationActionData navigationActionData, struct WebKit::FrameInfoData originatingFrameInfoData, Optional<WebKit::WebPageProxyIdentifier> originatingPageID, WebCore::ResourceRequest originalRequest, WebCore::ResourceRequest request, IPC::FormDataReference requestBody, WebCore::ResourceResponse redirectResponse, WebKit::UserData userData, uint64_t listenerID)
- DecidePolicyForNavigationActionSync(WebCore::FrameIdentifier frameID, bool isMainFrame, struct WebCore::SecurityOriginData frameSecurityOrigin, WebCore::PolicyCheckIdentifier policyCheckIdentifier, uint64_t navigationID, struct WebKit::NavigationActionData navigationActionData, struct WebKit::FrameInfoData originatingFrameInfoData, Optional<WebKit::WebPageProxyIdentifier> originatingPageID, WebCore::ResourceRequest originalRequest, WebCore::ResourceRequest request, IPC::FormDataReference requestBody, WebCore::ResourceResponse redirectResponse, WebKit::UserData userData) -> (WebCore::PolicyCheckIdentifier policyCheckIdentifier, enum:uint8_t WebCore::PolicyAction policyAction, uint64_t newNavigationID, WebKit::DownloadID downloadID, Optional<WebKit::WebsitePoliciesData> websitePolicies) Synchronous
+ DecidePolicyForNavigationActionSync(WebCore::FrameIdentifier frameID, bool isMainFrame, struct WebCore::SecurityOriginData frameSecurityOrigin, WebCore::PolicyCheckIdentifier policyCheckIdentifier, uint64_t navigationID, struct WebKit::NavigationActionData navigationActionData, struct WebKit::FrameInfoData originatingFrameInfoData, Optional<WebKit::WebPageProxyIdentifier> originatingPageID, WebCore::ResourceRequest originalRequest, WebCore::ResourceRequest request, IPC::FormDataReference requestBody, WebCore::ResourceResponse redirectResponse, WebKit::UserData userData) -> (WebCore::PolicyCheckIdentifier policyCheckIdentifier, enum:uint8_t WebCore::PolicyAction policyAction, uint64_t newNavigationID, WebKit::DownloadID downloadID, Optional<WebKit::WebsitePoliciesData> websitePolicies, Optional<WebKit::SandboxExtension::Handle> sandboxExtensionHandle) Synchronous
DecidePolicyForNewWindowAction(WebCore::FrameIdentifier frameID, struct WebCore::SecurityOriginData frameSecurityOrigin, WebCore::PolicyCheckIdentifier policyCheckIdentifier, struct WebKit::NavigationActionData navigationActionData, WebCore::ResourceRequest request, String frameName, uint64_t listenerID, WebKit::UserData userData)
UnableToImplementPolicy(WebCore::FrameIdentifier frameID, WebCore::ResourceError error, WebKit::UserData userData)
@@ -224,7 +224,7 @@
# BackForward messages
BackForwardAddItem(struct WebKit::BackForwardListItemState itemState)
- BackForwardGoToItem(struct WebCore::BackForwardItemIdentifier itemID) -> (WebKit::SandboxExtension::Handle sandboxExtensionHandle) Synchronous
+ BackForwardGoToItem(struct WebCore::BackForwardItemIdentifier itemID) -> () Synchronous
BackForwardItemAtIndex(int32_t itemIndex) -> (Optional<WebCore::BackForwardItemIdentifier> itemID) Synchronous
BackForwardBackListCount() -> (uint32_t count) Synchronous
BackForwardForwardListCount() -> (uint32_t count) Synchronous
Modified: branches/safari-609-branch/Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp (260368 => 260369)
--- branches/safari-609-branch/Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp 2020-04-20 16:16:19 UTC (rev 260368)
+++ branches/safari-609-branch/Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp 2020-04-20 16:23:25 UTC (rev 260369)
@@ -835,7 +835,7 @@
uint64_t listenerID = m_frame->setUpPolicyListener(identifier, WTFMove(function), WebFrame::ForNavigationAction::No);
if (!webPage->send(Messages::WebPageProxy::DecidePolicyForResponse(m_frame->frameID(), SecurityOriginData::fromFrame(coreFrame), identifier, navigationID, response, request,
canShowResponse, downloadAttribute, listenerID, UserData(WebProcess::singleton().transformObjectsToHandles(userData.get()).get()))))
- m_frame->didReceivePolicyDecision(listenerID, identifier, PolicyAction::Ignore, 0, { }, { });
+ m_frame->didReceivePolicyDecision(listenerID, identifier, PolicyAction::Ignore, 0, { }, { }, { });
}
void WebFrameLoaderClient::dispatchDecidePolicyForNewWindowAction(const NavigationAction& navigationAction, const ResourceRequest& request,
@@ -985,16 +985,17 @@
PolicyAction policyAction;
DownloadID downloadID;
Optional<WebsitePoliciesData> websitePolicies;
+ Optional<SandboxExtension::Handle> sandboxExtensionHandle;
if (!webPage->sendSync(Messages::WebPageProxy::DecidePolicyForNavigationActionSync(m_frame->frameID(), m_frame->isMainFrame(), SecurityOriginData::fromFrame(coreFrame),
requestIdentifier, documentLoader->navigationID(), navigationActionData, originatingFrameInfoData, originatingPageID, navigationAction.resourceRequest(), request,
IPC::FormDataReference { request.httpBody() }, redirectResponse, UserData(WebProcess::singleton().transformObjectsToHandles(userData.get()).get())),
- Messages::WebPageProxy::DecidePolicyForNavigationActionSync::Reply(responseIdentifier, policyAction, newNavigationID, downloadID, websitePolicies))) {
- m_frame->didReceivePolicyDecision(listenerID, requestIdentifier, PolicyAction::Ignore, 0, { }, { });
+ Messages::WebPageProxy::DecidePolicyForNavigationActionSync::Reply(responseIdentifier, policyAction, newNavigationID, downloadID, websitePolicies, sandboxExtensionHandle))) {
+ m_frame->didReceivePolicyDecision(listenerID, requestIdentifier, PolicyAction::Ignore, 0, { }, { }, { });
return;
}
- m_frame->didReceivePolicyDecision(listenerID, responseIdentifier, policyAction, 0, downloadID, { });
+ m_frame->didReceivePolicyDecision(listenerID, responseIdentifier, policyAction, 0, downloadID, { }, { });
return;
}
@@ -1002,7 +1003,7 @@
if (!webPage->send(Messages::WebPageProxy::DecidePolicyForNavigationActionAsync(m_frame->frameID(), SecurityOriginData::fromFrame(coreFrame),
requestIdentifier, documentLoader->navigationID(), navigationActionData, originatingFrameInfoData, originatingPageID, navigationAction.resourceRequest(), request,
IPC::FormDataReference { request.httpBody() }, redirectResponse, UserData(WebProcess::singleton().transformObjectsToHandles(userData.get()).get()), listenerID)))
- m_frame->didReceivePolicyDecision(listenerID, requestIdentifier, PolicyAction::Ignore, 0, { }, { });
+ m_frame->didReceivePolicyDecision(listenerID, requestIdentifier, PolicyAction::Ignore, 0, { }, { }, { });
}
void WebFrameLoaderClient::cancelPolicyCheck()
Modified: branches/safari-609-branch/Source/WebKit/WebProcess/WebPage/WebBackForwardListProxy.cpp (260368 => 260369)
--- branches/safari-609-branch/Source/WebKit/WebProcess/WebPage/WebBackForwardListProxy.cpp 2020-04-20 16:16:19 UTC (rev 260368)
+++ branches/safari-609-branch/Source/WebKit/WebProcess/WebPage/WebBackForwardListProxy.cpp 2020-04-20 16:23:25 UTC (rev 260369)
@@ -105,9 +105,7 @@
if (!m_page)
return;
- SandboxExtension::Handle sandboxExtensionHandle;
- m_page->sendSync(Messages::WebPageProxy::BackForwardGoToItem(item.identifier()), Messages::WebPageProxy::BackForwardGoToItem::Reply(sandboxExtensionHandle));
- m_page->sandboxExtensionTracker().beginLoad(m_page->mainWebFrame(), WTFMove(sandboxExtensionHandle));
+ m_page->sendSync(Messages::WebPageProxy::BackForwardGoToItem(item.identifier()), Messages::WebPageProxy::BackForwardGoToItem::Reply());
}
RefPtr<HistoryItem> WebBackForwardListProxy::itemAtIndex(int itemIndex)
Modified: branches/safari-609-branch/Source/WebKit/WebProcess/WebPage/WebFrame.cpp (260368 => 260369)
--- branches/safari-609-branch/Source/WebKit/WebProcess/WebPage/WebFrame.cpp 2020-04-20 16:16:19 UTC (rev 260368)
+++ branches/safari-609-branch/Source/WebKit/WebProcess/WebPage/WebFrame.cpp 2020-04-20 16:23:25 UTC (rev 260369)
@@ -252,7 +252,7 @@
completionHandler();
}
-void WebFrame::didReceivePolicyDecision(uint64_t listenerID, WebCore::PolicyCheckIdentifier identifier, PolicyAction action, uint64_t navigationID, DownloadID downloadID, Optional<WebsitePoliciesData>&& websitePolicies)
+void WebFrame::didReceivePolicyDecision(uint64_t listenerID, WebCore::PolicyCheckIdentifier identifier, PolicyAction action, uint64_t navigationID, DownloadID downloadID, Optional<WebsitePoliciesData>&& websitePolicies, Optional<SandboxExtension::Handle>&& sandboxExtensionHandle)
{
if (!m_coreFrame || !m_policyListenerID || listenerID != m_policyListenerID || !m_policyFunction)
return;
@@ -274,6 +274,11 @@
documentLoader->setNavigationID(navigationID);
}
+ if (action == PolicyAction::Use && sandboxExtensionHandle) {
+ if (auto* page = this->page())
+ page->sandboxExtensionTracker().beginLoad(page->mainWebFrame(), WTFMove(*sandboxExtensionHandle));
+ }
+
function(action, identifier);
}
Modified: branches/safari-609-branch/Source/WebKit/WebProcess/WebPage/WebFrame.h (260368 => 260369)
--- branches/safari-609-branch/Source/WebKit/WebProcess/WebPage/WebFrame.h 2020-04-20 16:16:19 UTC (rev 260368)
+++ branches/safari-609-branch/Source/WebKit/WebProcess/WebPage/WebFrame.h 2020-04-20 16:23:25 UTC (rev 260369)
@@ -27,6 +27,7 @@
#include "APIObject.h"
#include "DownloadID.h"
+#include "SandboxExtension.h"
#include "ShareableBitmap.h"
#include "TransactionID.h"
#include "WKBase.h"
@@ -82,7 +83,7 @@
enum class ForNavigationAction { No, Yes };
uint64_t setUpPolicyListener(WebCore::PolicyCheckIdentifier, WebCore::FramePolicyFunction&&, ForNavigationAction);
void invalidatePolicyListener();
- void didReceivePolicyDecision(uint64_t listenerID, WebCore::PolicyCheckIdentifier, WebCore::PolicyAction, uint64_t navigationID, DownloadID, Optional<WebsitePoliciesData>&&);
+ void didReceivePolicyDecision(uint64_t listenerID, WebCore::PolicyCheckIdentifier, WebCore::PolicyAction, uint64_t navigationID, DownloadID, Optional<WebsitePoliciesData>&&, Optional<SandboxExtension::Handle>&&);
uint64_t setUpWillSubmitFormListener(CompletionHandler<void()>&&);
void continueWillSubmitForm(uint64_t);
Modified: branches/safari-609-branch/Source/WebKit/WebProcess/WebPage/WebPage.cpp (260368 => 260369)
--- branches/safari-609-branch/Source/WebKit/WebProcess/WebPage/WebPage.cpp 2020-04-20 16:16:19 UTC (rev 260368)
+++ branches/safari-609-branch/Source/WebKit/WebProcess/WebPage/WebPage.cpp 2020-04-20 16:23:25 UTC (rev 260369)
@@ -3238,12 +3238,12 @@
pluginView->setLayerHostingMode(m_layerHostingMode);
}
-void WebPage::didReceivePolicyDecision(FrameIdentifier frameID, uint64_t listenerID, PolicyCheckIdentifier identifier, PolicyAction policyAction, uint64_t navigationID, const DownloadID& downloadID, Optional<WebsitePoliciesData>&& websitePolicies)
+void WebPage::didReceivePolicyDecision(FrameIdentifier frameID, uint64_t listenerID, PolicyCheckIdentifier identifier, PolicyAction policyAction, uint64_t navigationID, const DownloadID& downloadID, Optional<WebsitePoliciesData>&& websitePolicies, Optional<SandboxExtension::Handle>&& sandboxExtensionHandle)
{
WebFrame* frame = WebProcess::singleton().webFrame(frameID);
if (!frame)
return;
- frame->didReceivePolicyDecision(listenerID, identifier, policyAction, navigationID, downloadID, WTFMove(websitePolicies));
+ frame->didReceivePolicyDecision(listenerID, identifier, policyAction, navigationID, downloadID, WTFMove(websitePolicies), WTFMove(sandboxExtensionHandle));
}
void WebPage::continueWillSubmitForm(FrameIdentifier frameID, uint64_t listenerID)
@@ -4587,8 +4587,6 @@
if (!m_provisionalSandboxExtension)
return;
- ASSERT(!m_provisionalSandboxExtension || frame->coreFrame()->loader().provisionalDocumentLoader()->url().isLocalFile());
-
m_provisionalSandboxExtension->consume();
}
Modified: branches/safari-609-branch/Source/WebKit/WebProcess/WebPage/WebPage.h (260368 => 260369)
--- branches/safari-609-branch/Source/WebKit/WebProcess/WebPage/WebPage.h 2020-04-20 16:16:19 UTC (rev 260368)
+++ branches/safari-609-branch/Source/WebKit/WebProcess/WebPage/WebPage.h 2020-04-20 16:23:25 UTC (rev 260369)
@@ -1453,7 +1453,7 @@
bool parentProcessHasServiceWorkerEntitlement() const { return true; }
#endif
- void didReceivePolicyDecision(WebCore::FrameIdentifier, uint64_t listenerID, WebCore::PolicyCheckIdentifier, WebCore::PolicyAction, uint64_t navigationID, const DownloadID&, Optional<WebsitePoliciesData>&&);
+ void didReceivePolicyDecision(WebCore::FrameIdentifier, uint64_t listenerID, WebCore::PolicyCheckIdentifier, WebCore::PolicyAction, uint64_t navigationID, const DownloadID&, Optional<WebsitePoliciesData>&&, Optional<SandboxExtension::Handle>&&);
void continueWillSubmitForm(WebCore::FrameIdentifier, uint64_t listenerID);
void setUserAgent(const String&);
void setCustomTextEncodingName(const String&);
Modified: branches/safari-609-branch/Source/WebKit/WebProcess/WebPage/WebPage.messages.in (260368 => 260369)
--- branches/safari-609-branch/Source/WebKit/WebProcess/WebPage/WebPage.messages.in 2020-04-20 16:16:19 UTC (rev 260368)
+++ branches/safari-609-branch/Source/WebKit/WebProcess/WebPage/WebPage.messages.in 2020-04-20 16:23:25 UTC (rev 260369)
@@ -183,7 +183,7 @@
DidRemoveBackForwardItem(struct WebCore::BackForwardItemIdentifier backForwardItemID)
UpdateWebsitePolicies(struct WebKit::WebsitePoliciesData websitePolicies)
- DidReceivePolicyDecision(WebCore::FrameIdentifier frameID, uint64_t listenerID, WebCore::PolicyCheckIdentifier policyCheckIdentifier, enum:uint8_t WebCore::PolicyAction policyAction, uint64_t navigationID, WebKit::DownloadID downloadID, Optional<WebKit::WebsitePoliciesData> websitePolicies)
+ DidReceivePolicyDecision(WebCore::FrameIdentifier frameID, uint64_t listenerID, WebCore::PolicyCheckIdentifier policyCheckIdentifier, enum:uint8_t WebCore::PolicyAction policyAction, uint64_t navigationID, WebKit::DownloadID downloadID, Optional<WebKit::WebsitePoliciesData> websitePolicies, Optional<WebKit::SandboxExtension::Handle> sandboxExtensionHandle)
ContinueWillSubmitForm(WebCore::FrameIdentifier frameID, uint64_t listenerID)
ClearSelection()
Modified: branches/safari-609-branch/Tools/ChangeLog (260368 => 260369)
--- branches/safari-609-branch/Tools/ChangeLog 2020-04-20 16:16:19 UTC (rev 260368)
+++ branches/safari-609-branch/Tools/ChangeLog 2020-04-20 16:23:25 UTC (rev 260369)
@@ -1,3 +1,16 @@
+2020-04-20 Alan Coon <[email protected]>
+
+ Apply patch. rdar://problem/61950472
+
+ 2020-04-20 Brady Eidson <[email protected]>
+
+ Pass sandbox extensions for back/forward list navigations after the policy is decided at process-swap time.
+ <rdar://problem/59535167> and https://bugs.webkit.org/show_bug.cgi?id=210623
+
+ Reviewed by Geoff Garen.
+
+ * TestWebKitAPI/Tests/WebKitCocoa/ProcessSwapOnNavigation.mm:
+
2020-04-17 Alan Coon <[email protected]>
Cherry-pick r260278. rdar://problem/61950220
Modified: branches/safari-609-branch/Tools/TestWebKitAPI/Tests/WebKitCocoa/ProcessSwapOnNavigation.mm (260368 => 260369)
--- branches/safari-609-branch/Tools/TestWebKitAPI/Tests/WebKitCocoa/ProcessSwapOnNavigation.mm 2020-04-20 16:16:19 UTC (rev 260368)
+++ branches/safari-609-branch/Tools/TestWebKitAPI/Tests/WebKitCocoa/ProcessSwapOnNavigation.mm 2020-04-20 16:23:25 UTC (rev 260369)
@@ -6548,3 +6548,88 @@
EXPECT_WK_STREQ(webView.get()._resourceDirectoryURL.path, file.URLByDeletingLastPathComponent.path);
}
+
+#if PLATFORM(MAC)
+
+static const char* pageThatOpensBytes = R"PSONRESOURCE(
+<script>
+window._onload_ = function() {
+ window.open("pson://www.webkit.org/window.html", "_blank");
+}
+</script>
+)PSONRESOURCE";
+
+static const char* openedPage = "Hello World";
+
+TEST(ProcessSwap, SameSiteWindowWithOpenerNavigateToFile)
+{
+ auto processPoolConfiguration = psonProcessPoolConfiguration();
+ processPoolConfiguration.get().processSwapsOnWindowOpenWithOpener = YES;
+ auto processPool = adoptNS([[WKProcessPool alloc] _initWithConfiguration:processPoolConfiguration.get()]);
+
+ auto webViewConfiguration = adoptNS([[WKWebViewConfiguration alloc] init]);
+ [webViewConfiguration setProcessPool:processPool.get()];
+ auto handler = adoptNS([[PSONScheme alloc] init]);
+ [handler addMappingFromURLString:@"pson://www.webkit.org/main.html" toData:pageThatOpensBytes];
+ [handler addMappingFromURLString:@"pson://www.webkit.org/window.html" toData:openedPage];
+ [webViewConfiguration setURLSchemeHandler:handler.get() forURLScheme:@"PSON"];
+
+ auto webView = adoptNS([[WKWebView alloc] initWithFrame:NSMakeRect(0, 0, 800, 600) configuration:webViewConfiguration.get()]);
+ auto navigationDelegate = adoptNS([[PSONNavigationDelegate alloc] init]);
+ [webView setNavigationDelegate:navigationDelegate.get()];
+ auto uiDelegate = adoptNS([[PSONUIDelegate alloc] initWithNavigationDelegate:navigationDelegate.get()]);
+ [webView setUIDelegate:uiDelegate.get()];
+
+ numberOfDecidePolicyCalls = 0;
+ NSURLRequest *request = [NSURLRequest requestWithURL:[NSURL URLWithString:@"pson://www.webkit.org/main.html"]];
+ [webView loadRequest:request];
+
+ TestWebKitAPI::Util::run(&done);
+ done = false;
+
+ TestWebKitAPI::Util::run(&didCreateWebView);
+ didCreateWebView = false;
+
+ TestWebKitAPI::Util::run(&done);
+ done = false;
+
+ EXPECT_EQ(2, numberOfDecidePolicyCalls);
+
+ auto pid1 = [webView _webProcessIdentifier];
+ EXPECT_TRUE(!!pid1);
+ auto pid2 = [createdWebView _webProcessIdentifier];
+ EXPECT_TRUE(!!pid2);
+
+ EXPECT_EQ(pid1, pid2);
+
+ NSURL *url = "" mainBundle] URLForResource:@"blinking-div" withExtension:@"html" subdirectory:@"TestWebKitAPI.resources"];
+ EXPECT_TRUE([url.scheme isEqualToString:@"file"]);
+
+ [createdWebView loadRequest:[NSURLRequest requestWithURL:url]];
+
+ TestWebKitAPI::Util::run(&done);
+ done = false;
+
+ EXPECT_EQ(3, numberOfDecidePolicyCalls);
+ auto pid3 = [createdWebView _webProcessIdentifier];
+ EXPECT_TRUE(!!pid3);
+ EXPECT_NE(pid2, pid3);
+
+ [createdWebView goBack];
+ TestWebKitAPI::Util::run(&done);
+ done = false;
+
+ EXPECT_EQ(4, numberOfDecidePolicyCalls);
+ auto pid4 = [createdWebView _webProcessIdentifier];
+ EXPECT_NE(pid3, pid4);
+
+ [createdWebView goForward];
+ TestWebKitAPI::Util::run(&done);
+ done = false;
+
+ EXPECT_EQ(5, numberOfDecidePolicyCalls);
+ auto pid5 = [createdWebView _webProcessIdentifier];
+ EXPECT_NE(pid4, pid5);
+}
+
+#endif // PLATFORM(MAC)
