Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: 6bedabd8e3a7286fe4aee72fc0f0be017118af3e
https://github.com/WebKit/WebKit/commit/6bedabd8e3a7286fe4aee72fc0f0be017118af3e
Author: Chris Dumez <[email protected]>
Date: 2026-08-18 (Tue, 18 Aug 2026)
Changed paths:
M Source/WebKit/UIProcess/WebFrameProxy.cpp
M Source/WebKit/UIProcess/WebFrameProxy.h
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm
M Tools/TestWebKitAPI/Tests/WebKitGtk/TestWebViewEditor.cpp
Log Message:
-----------
Cherry-pick 6e4e21af9c2e. https://bugs.webkit.org/show_bug.cgi?id=314886
Validate transient user activation in UIProcess for async clipboard reads
https://bugs.webkit.org/show_bug.cgi?id=314886
rdar://177152667
Reviewed by Ryosuke Niwa.
Follow-up to 305413.908@safari-7624-branch, which added a WebCore-side
transient activation check
to
navigator.clipboard.readText() / read(). That
check is bypassable by a compromised WebContent process that calls the
RequestDOMPasteAccess IPC directly with a fabricated activation claim.
Mirror the spec's transient activation tracking
(LocalDOMWindow::notifyActivated, LocalDOMWindow::hasTransientActivation) in
the UIProcess so the UIProcess can independently verify that the requesting
frame really is activated:
- WebFrameProxy gains m_lastActivationTimestamp, notifyActivated(), and
hasTransientActivation(). notifyActivated() propagates the timestamp to
ancestor frames (any origin) and same-origin descendant frames, matching
the HTML spec's activation notification algorithm.
- The four input-event entry points in WebPageProxy
(sendMouseEvent / sendKeyEvent / sendPreventableTouchEvent /
sendUnpreventableTouchEvent) now call WebFrameProxy::notifyActivated for
activation-triggering
events on the target frame. The pre-existing
page-level lastActivationTimestamp updates remain; they serve a
different
heuristic.
- WebPageProxy::requestDOMPasteAccess rejects with DeniedForGesture if the
requesting WebFrameProxy does not have transient activation. A
compromised
WebContent process can no longer get past this gate.
- WebFrameProxy::didCommitLoad resets m_lastActivationTimestamp so a new
document does not inherit activation from the previous one (matches
LocalDOMWindow::consumeLastActivationIfNecessary semantics).
* Source/WebKit/UIProcess/WebFrameProxy.cpp:
(WebKit::WebFrameProxy::didCommitLoad):
(WebKit::WebFrameProxy::notifyActivated):
(WebKit::WebFrameProxy::propagateActivationToSameOriginDescendants):
(WebKit::WebFrameProxy::hasTransientActivation const):
(WebKit::WebFrameProxy::securityOrigin const):
*
Source/WebKit/UIProcess/WebFrameProxy.h:
*
Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::sendMouseEvent):
(WebKit::WebPageProxy::sendKeyEvent):
(WebKit::WebPageProxy::sendPreventableTouchEvent):
(WebKit::WebPageProxy::sendUnpreventableTouchEvent):
(WebKit::WebPageProxy::requestDOMPasteAccess):
Identifier: 305413.928@safari-7624-branch
Canonical link:
https://flagged.apple.com:443/proxy?t2=Dz9w1P3RF3&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzA1NDEzLjk3N0BzYWZhcmktNzYyNC40LWJyYW5jaA==&emid=1a834727-3825-4686-a201-e89177777138&c=11
Canonical link:
https://flagged.apple.com:443/proxy?t2=Do7W0h1cl7&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzA1ODc3LjEwOTdAd2Via2l0Z2xpYi8yLjUy&emid=1a834727-3825-4686-a201-e89177777138&c=11
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
