Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 2b4f51505b3e3b07c95379b9c46e32319b672f0a
https://github.com/WebKit/WebKit/commit/2b4f51505b3e3b07c95379b9c46e32319b672f0a
Author: Zak Ridouh <[email protected]>
Date: 2026-08-04 (Tue, 04 Aug 2026)
Changed paths:
A LayoutTests/ipc/fullscreen-foreign-frame-message-check-expected.txt
A LayoutTests/ipc/fullscreen-foreign-frame-message-check.html
M Source/WebKit/UIProcess/Cocoa/PlaybackSessionManagerProxy.h
M Source/WebKit/UIProcess/Cocoa/PlaybackSessionManagerProxy.messages.in
M Source/WebKit/UIProcess/Cocoa/PlaybackSessionManagerProxy.mm
M Source/WebKit/UIProcess/Cocoa/VideoPresentationManagerProxy.h
M Source/WebKit/UIProcess/Cocoa/VideoPresentationManagerProxy.messages.in
M Source/WebKit/UIProcess/Cocoa/VideoPresentationManagerProxy.mm
M Source/WebKit/UIProcess/WebFullScreenManagerProxy.cpp
M
Source/WebKit/UIProcess/WebFullScreenManagerProxy.h
M Source/WebKit/UIProcess/WebFullScreenManagerProxy.messages.in
M Source/WebKit/WebProcess/FullScreen/WebFullScreenManager.cpp
M Source/WebKit/WebProcess/cocoa/PlaybackSessionManager.mm
M Source/WebKit/WebProcess/cocoa/VideoPresentationManager.mm
Log Message:
-----------
[Site Isolation] Validate sender identity in per-page media and fullscreen
managers
https://bugs.webkit.org/show_bug.cgi?id=320604
rdar://172258882
Reviewed by Charlie Wolfe.
Under site isolation the RemotePage*Proxy wrappers register on each subframe
process's connection and forward every message to the shared per-page manager,
which was written before site isolation and assumed a single WebContent process.
A compromised subframe process could name another process's media element and
manipulate its playback, Now Playing, or fullscreen state.
Rather than validating the process component of an
incoming
PlaybackSessionContextIdentifier, don't send it at all: the media messages to
PlaybackSessionManagerProxy and VideoPresentationManagerProxy now carry a bare
WebCore::MediaPlayerClientIdentifier, and the UI process pairs it with the
process identifier of the sending connection. A foreign process identifier is
therefore unrepresentable rather than rejected, and no message check is needed.
This matches the pattern in RemoteMediaSessionManagerProxy and the unqualified
identifier already used for messages in the other direction.
WebCore::FrameIdentifier is not process-qualified and must be resolved through a
global map, so WebFullScreenManagerProxy still checks that an incoming frame is
hosted by the sending process and belongs to this page. BeganExitFullScreen no
longer carries a FrameIdentifier: beganEnterFullScreen records the frame it has
already validated, and exit uses that.
Also fix the pre-existing MESSAGE_CHECK in VideoPresentationManagerProxy to
blame
the sending connection rather than always the main-frame process's connection.
* LayoutTests/platform/glib/TestExpectations:
* Source/WebKit/UIProcess/Cocoa/PlaybackSessionManagerProxy.h:
*
Source/WebKit/UIProcess/Cocoa/PlaybackSessionManagerProxy.mm:
(WebKit::PlaybackSessionManagerProxy::setUpPlaybackControlsManagerWithID):
(WebKit::PlaybackSessionManagerProxy::swapFullscreenModes):
(WebKit::PlaybackSessionManagerProxy::currentTimeChanged):
(WebKit::PlaybackSessionManagerProxy::bufferedTimeChanged):
(WebKit::PlaybackSessionManagerProxy::seekableRangesVectorChanged):
(WebKit::PlaybackSessionManagerProxy::canPlayFastReverseChanged):
(WebKit::PlaybackSessionManagerProxy::audioMediaSelectionOptionsChanged):
(WebKit::PlaybackSessionManagerProxy::legibleMediaSelectionOptionsChanged):
(WebKit::PlaybackSessionManagerProxy::audioMediaSelectionIndexChanged):
(WebKit::PlaybackSessionManagerProxy::legibleMediaSelectionIndexChanged):
(WebKit::PlaybackSessionManagerProxy::externalPlaybackPropertiesChanged):
(WebKit::PlaybackSessionManagerProxy::wirelessVideoPlaybackDisabledChanged):
(WebKit::PlaybackSessionManagerProxy::mutedChanged):
(WebKit::PlaybackSessionManagerProxy::volumeChanged):
(WebKit::PlaybackSessionManagerProxy::durationChanged):
(WebKit::PlaybackSessionManagerProxy::playbackStartedTimeChanged):
(WebKit::PlaybackSessionManagerProxy::rateChanged):
(WebKit::PlaybackSessionManagerProxy::pictureInPictureSupportedChanged):
(WebKit::PlaybackSessionManagerProxy::isInWindowFullscreenActiveChanged):
(WebKit::PlaybackSessionManagerProxy::canSkipAdChanged):
(WebKit::PlaybackSessionManagerProxy::supportsLinearMediaPlayerChanged):
(WebKit::PlaybackSessionManagerProxy::immersiveVideoMetadataChanged):
(WebKit::PlaybackSessionManagerProxy::handleControlledElementIDResponse
const):
(WebKit::PlaybackSessionManagerProxy::setLogIdentifier):
(WebKit::PlaybackSessionManagerProxy::contextIdForConnection const):
(WebKit::PlaybackSessionManagerProxy::ensureModel):
* Source/WebKit/UIProcess/Cocoa/VideoPresentationManagerProxy.h:
*
Source/WebKit/UIProcess/Cocoa/VideoPresentationManagerProxy.mm:
(WebKit::VideoPresentationManagerProxy::setDocumentVisibility):
(WebKit::VideoPresentationManagerProxy::setIsChildOfElementFullscreen):
(WebKit::VideoPresentationManagerProxy::hasBeenInteractedWith):
(WebKit::VideoPresentationManagerProxy::setupFullscreenWithID):
(WebKit::VideoPresentationManagerProxy::setPlayerIdentifier):
(WebKit::VideoPresentationManagerProxy::audioSessionCategoryChanged):
(WebKit::VideoPresentationManagerProxy::routingContextUIDChanged):
(WebKit::VideoPresentationManagerProxy::setHasVideo):
(WebKit::VideoPresentationManagerProxy::setVideoDimensions):
(WebKit::VideoPresentationManagerProxy::enterFullscreen):
(WebKit::VideoPresentationManagerProxy::enterFullscreenForContext):
(WebKit::VideoPresentationManagerProxy::exitFullscreen):
(WebKit::VideoPresentationManagerProxy::exitFullscreenWithoutAnimationToMode):
(WebKit::VideoPresentationManagerProxy::setVideoFullscreenMode):
(WebKit::VideoPresentationManagerProxy::clearVideoFullscreenMode):
(WebKit::VideoPresentationManagerProxy::setInlineRect):
(WebKit::VideoPresentationManagerProxy::setHasVideoContentLayer):
(WebKit::VideoPresentationManagerProxy::cleanupFullscreen):
(WebKit::VideoPresentationManagerProxy::preparedToReturnToInline):
(WebKit::VideoPresentationManagerProxy::preparedToExitFullscreen):
(WebKit::VideoPresentationManagerProxy::textTrackRepresentationUpdate):
(WebKit::VideoPresentationManagerProxy::textTrackRepresentationSetContentsScale):
(WebKit::VideoPresentationManagerProxy::textTrackRepresentationSetHidden):
(WebKit::VideoPresentationManagerProxy::didSetupFullscreen):
(WebKit::VideoPresentationManagerProxy::contextIdForConnection
const):
(WebKit::VideoPresentationManagerProxy::ensureModel):
(WebKit::VideoPresentationManagerProxy::ensureInterface):
* Source/WebKit/UIProcess/WebFullScreenManagerProxy.cpp:
(WebKit::WebFullScreenManagerProxy::isFrameInSendingProcess const):
(WebKit::WebFullScreenManagerProxy::enterFullScreen):
(WebKit::WebFullScreenManagerProxy::beganEnterFullScreen):
(WebKit::WebFullScreenManagerProxy::beganExitFullScreen):
* Source/WebKit/UIProcess/WebFullScreenManagerProxy.h:
* LayoutTests/ipc/fullscreen-foreign-frame-message-check-expected.txt: Added.
* LayoutTests/ipc/fullscreen-foreign-frame-message-check.html: Added.
* Source/WebKit/UIProcess/Cocoa/PlaybackSessionManagerProxy.messages.in:
* Source/WebKit/UIProcess/Cocoa/VideoPresentationManagerProxy.messages.in:
* Source/WebKit/UIProcess/WebFullScreenManagerProxy.messages.in:
* Source/WebKit/WebProcess/FullScreen/WebFullScreenManager.cpp:
(WebKit::WebFullScreenManager::willExitFullScreen):
*
Source/WebKit/WebProcess/cocoa/PlaybackSessionManager.mm:
(WebKit::PlaybackSessionManager::setUpPlaybackControlsManager):
(WebKit::PlaybackSessionManager::mediaEngineChanged):
(WebKit::PlaybackSessionManager::durationChanged):
(WebKit::PlaybackSessionManager::currentTimeChanged):
(WebKit::PlaybackSessionManager::bufferedTimeChanged):
(WebKit::PlaybackSessionManager::playbackStartedTimeChanged):
(WebKit::PlaybackSessionManager::rateChanged):
(WebKit::PlaybackSessionManager::seekableRangesChanged):
(WebKit::PlaybackSessionManager::canPlayFastReverseChanged):
(WebKit::PlaybackSessionManager::audioMediaSelectionOptionsChanged):
(WebKit::PlaybackSessionManager::legibleMediaSelectionOptionsChanged):
(WebKit::PlaybackSessionManager::externalPlaybackChanged):
(WebKit::PlaybackSessionManager::audioMediaSelectionIndexChanged):
(WebKit::PlaybackSessionManager::legibleMediaSelectionIndexChanged):
(WebKit::PlaybackSessionManager::wirelessVideoPlaybackDisabledChanged):
(WebKit::PlaybackSessionManager::mutedChanged):
(WebKit::PlaybackSessionManager::volumeChanged):
(WebKit::PlaybackSessionManager::isPictureInPictureSupportedChanged):
(WebKit::PlaybackSessionManager::isInWindowFullscreenActiveChanged):
(WebKit::PlaybackSessionManager::immersiveVideoMetadataChanged):
(WebKit::PlaybackSessionManager::actionHandlersChanged):
(WebKit::PlaybackSessionManager::handleControlledElementIDRequest):
(WebKit::PlaybackSessionManager::sendLogIdentifierForMediaElement):
*
Source/WebKit/WebProcess/cocoa/VideoPresentationManager.mm:
(WebKit::VideoPresentationManager::enterVideoFullscreenForVideoElement):
(WebKit::VideoPresentationManager::exitVideoFullscreenForVideoElement):
(WebKit::VideoPresentationManager::exitVideoFullscreenToModeWithoutAnimation):
(WebKit::VideoPresentationManager::setVideoFullscreenMode):
(WebKit::VideoPresentationManager::clearVideoFullscreenMode):
(WebKit::VideoPresentationManager::hasVideoChanged):
(WebKit::VideoPresentationManager::documentVisibilityChanged):
(WebKit::VideoPresentationManager::isChildOfElementFullscreenChanged):
(WebKit::VideoPresentationManager::audioSessionCategoryChanged):
(WebKit::VideoPresentationManager::routingContextUIDChanged):
(WebKit::VideoPresentationManager::hasBeenInteractedWith):
(WebKit::VideoPresentationManager::videoDimensionsChanged):
(WebKit::VideoPresentationManager::setPlayerIdentifier):
(WebKit::VideoPresentationManager::requestUpdateInlineRect):
(WebKit::VideoPresentationManager::requestVideoContentLayer):
(WebKit::VideoPresentationManager::returnVideoContentLayer):
(WebKit::VideoPresentationManager::didSetupFullscreen):
(WebKit::VideoPresentationManager::willExitFullscreen):
(WebKit::VideoPresentationManager::failedToEnterFullscreen):
(WebKit::VideoPresentationManager::didExitFullscreen):
(WebKit::VideoPresentationManager::fullscreenMayReturnToInline):
(WebKit::VideoPresentationManager::ensureUpdatedVideoDimensions):
(WebKit::VideoPresentationManager::updateTextTrackRepresentationForVideoElement):
(WebKit::VideoPresentationManager::setTextTrackRepresentationContentScaleForVideoElement):
(WebKit::VideoPresentationManager::setTextTrackRepresentationIsHiddenForVideoElement):
Canonical
link:
https://flagged.apple.com:443/proxy?t2=Dh1X6d6qS1&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE4NjE0QG1haW4=&emid=d17ae1d3-b89a-476b-b86e-b0308e381e99&c=11
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
