Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: a703efa383be16a62995db8621aaf3b47ac3471c
https://github.com/WebKit/WebKit/commit/a703efa383be16a62995db8621aaf3b47ac3471c
Author: Chris Dumez <[email protected]>
Date: 2026-07-19 (Sun, 19 Jul 2026)
Changed paths:
M LayoutTests/http/tests/ipc/createnewpage-file-body-sandbox-extension.html
M LayoutTests/platform/ios/TestExpectations
M LayoutTests/platform/mac-wk2/TestExpectations
Log Message:
-----------
NEW TEST(316388@main): [macOS iOS debug]:
http/tests/ipc/createnewpage-file-body-sandbox-extension.html is constant
failure
https://bugs.webkit.org/show_bug.cgi?id=319606
rdar://182434983
Reviewed by Sihui Liu.
The test asserted that WebPageProxy::createNewPage() rejects a hostile
EncodedFileData request body via its hasGrantedSandboxExtensionForFile
MESSAGE_CHECK. That check is no longer reachable for this payload:
316378@main (bug 314948) tightened IPC::FormDataReference decoding to drop
the body when a file element is not accompanied by a consumable sandbox
extension. The test supplies a null extension handle, so the body is now
dropped at decode and createNewPage() never sees an httpBody. The test
previously relied on the pre-fix behavior, which vacuously treated null
handles as successfully consumed and let the body through to the check.
With the body dropped, control instead reaches the sender-ownership check
added by e9f94fd4c643 (bug 315535):
```
!navigationActionData.originatingPageID
||
process->isAssociatedWithPage(*navigationActionData.originatingPageID)
```
The test's fabricated originatingPageID does not satisfy this check, so it
is rejected there. Depending on whether the body survived decode (which
varies by build/configuration), the test observed either the expected
hasGrantedSandboxExtensionForFile check or this unrelated originatingPageID
check, which is what CI flagged as flaky.
The hostile file body is still rejected at one layer or the other, so this
is a stale assertion, not a security regression. Make the test robust:
- Move testRunner.notifyDone() into the TakeInvalidMessageStringForTesting
reply callback so the page and frame stay alive through CreateNewPage
dispatch.
- Set originatingPageID to NULLOPT. It is orthogonal to what this test
covers (the file-body check runs earlier and is unaffected); leaving it
non-null only tripped the unrelated sender-ownership check.
- Accept both safe outcomes as a PASS: the body being dropped at decode
(no invalid message recorded) or the hasGrantedSandboxExtensionForFile
MESSAGE_CHECK firing on builds where the body survives decode. Only an
unexpected message check now fails the test.
Note: createNewPage()'s file-body MESSAGE_CHECK is now shadowed by
FormDataReference's decode-time enforcement and is effectively unreachable
via this IPC path. This test is consequently a defense-in-depth smoke test.
* LayoutTests/http/tests/ipc/createnewpage-file-body-sandbox-extension.html:
* LayoutTests/platform/ios/TestExpectations:
* LayoutTests/platform/mac-wk2/TestExpectations:
Canonical link: https://commits.webkit.org/317526@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
