Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 633736c7eaf4e77b229586c5ce6fb14c650f19b1
https://github.com/WebKit/WebKit/commit/633736c7eaf4e77b229586c5ce6fb14c650f19b1
Author: Abrar Rahman Protyasha <[email protected]>
Date: 2026-05-12 (Tue, 12 May 2026)
Changed paths:
M Source/WebKit/UIProcess/mac/WebViewImpl.mm
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/DragAndDropTests.mm
Log Message:
-----------
REGRESSION(309943@main): Dragging images with draggable="true" no longer
exposes file data in dataTransfer.files for same-origin drops
https://bugs.webkit.org/show_bug.cgi?id=314562
rdar://176582995
Reviewed by Megan Gardner and Wenson Hsieh.
309943@main replaced -dragImage: with -beginDraggingSessionWithItems:
for all drag types. The old -dragImage: path had no sourceAction gate,
and setPromisedDataForImage() unconditionally wrote image data to the
pasteboard. -dragImage: used that pre-populated pasteboard regardless
of whether the resolved drag type was Image or DHTML.
The new startDrag() code introduced a check that additionally gated the
image file-promise path on sourceAction == .Image. This broke
<img draggable="true"> because EventHandler resolves dragState().type
to DHTML when the draggable attribute is present, even though the drag
controller still calls declareAndWriteDragImage() (based on drag source
action capability, not resolved type) and populates promised image drag
data via the SetPromisedDataForImage IPC. With sourceAction == .DHTML,
the file-promise path is skipped, writePromisedImageDragDataToPasteboard
is never called, and the pasteboard has no image data — resulting in
empty dataTransfer.files on drop.
In this patch, we address this regression by removing the .Image gate.
This brings our behavior back to pre-309943@main. The presence of
promised image drag data is the authoritative signal that image needs
file-promise treatment.
Test: TestWebKitAPI.DragAndDropTests.DoNotExposeCrossOriginImageData
* Source/WebKit/UIProcess/mac/WebViewImpl.mm:
(WebKit::WebViewImpl::startDrag):
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/DragAndDropTests.mm:
(TEST(DragAndDropTests, DoNotExposeCrossOriginImageData)):
(TEST(DragAndDropTests, DISABLED_DoNotExposeCrossOriginImageData)): Deleted.
Canonical link: https://commits.webkit.org/313088@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
