Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: 289d3ee2940d5771e0c7af454283c92d0463c694
https://github.com/WebKit/WebKit/commit/289d3ee2940d5771e0c7af454283c92d0463c694
Author: Ahmad Saleem <[email protected]>
Date: 2026-09-06 (Sun, 06 Sep 2026)
Changed paths:
M Source/WebCore/loader/NavigationAction.h
Log Message:
-----------
Cherry-pick 320316@main (ba64b8f51316).
https://bugs.webkit.org/show_bug.cgi?id=322905
NavigationAction::m_type is left uninitialized by the default constructor
https://bugs.webkit.org/show_bug.cgi?id=322905
rdar://186162338
Reviewed by Chris Dumez.
NavigationAction's user-provided default constructor doesn't zero-fill
members, and m_type is the only one without an in-class initializer, so
it is left indeterminate. DocumentLoader default-constructs
m_triggeringAction and its type() is read (via triggeringAction())
before a real action is assigned, which is undefined behavior.
Initialize m_type to NavigationType::Other, matching the other members.
* Source/WebCore/loader/NavigationAction.h:
Canonical link: https://commits.webkit.org/320316@main
Canonical link: https://commits.webkit.org/305877.1147@webkitglib/2.52
Commit: 08279e6ba1d66e13f03863eac5af7b98cbd94d18
https://github.com/WebKit/WebKit/commit/08279e6ba1d66e13f03863eac5af7b98cbd94d18
Author: Chris Dumez <[email protected]>
Date: 2026-09-06 (Sun, 06 Sep 2026)
Changed paths:
A
LayoutTests/http/tests/cookies/resources/set-raw-cookie-in-third-party-iframe-frame.html
A
LayoutTests/http/tests/cookies/set-raw-cookie-in-third-party-iframe-expected.txt
A LayoutTests/http/tests/cookies/set-raw-cookie-in-third-party-iframe.html
A LayoutTests/ipc/set-raw-cookie-empty-commenturl-crash-expected.txt
A LayoutTests/ipc/set-raw-cookie-empty-commenturl-crash.html
A LayoutTests/ipc/set-raw-cookie-firstparty-message-check-expected.txt
A LayoutTests/ipc/set-raw-cookie-firstparty-message-check.html
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
Log Message:
-----------
Cherry-pick 320304@main (d4867a890432).
https://bugs.webkit.org/show_bug.cgi?id=323060
Regression(314177@main) SetRawCookie's MESSAGE_CHECKs reject legitimate
cookie writes from third-party iframes
https://bugs.webkit.org/show_bug.cgi?id=323060
rdar://177769847
Reviewed by Ben Nham.
NetworkConnectionToWebProcess::setRawCookie validated cookie.domain and
url against firstParty:
```
MESSAGE_CHECK(RegistrableDomain::uncheckedCreateFromHost(cookie.domain).matches(firstParty));
MESSAGE_CHECK(RegistrableDomain(url).matches(firstParty));
```
This is too strict. WebCookieJar::setRawCookie passes
document.firstPartyForCookies() as firstParty (the top-level page's URL)
and document.cookieURL() as url (the document's own URL). For a
third-party iframe these legitimately differ, so the checks terminate
the WebProcess whenever Web Inspector or internals.setCookie is used in
a cross-site iframe.
Replace the two checks with an integrity check that cookie.domain's
registrable domain matches url, mirroring the existing posture of
setCookieFromDOMAsync which validates firstParty only and trusts the
url/cookie pair. The new check still rejects a mismatched
cookie.domain/url pair (the most useful invariant) without coupling
either to the unrelated top-level firstParty.
Tests: http/tests/cookies/set-raw-cookie-in-third-party-iframe.html
ipc/set-raw-cookie-empty-commenturl-crash.html
ipc/set-raw-cookie-firstparty-message-check.html
*
LayoutTests/http/tests/cookies/resources/set-raw-cookie-in-third-party-iframe-frame.html:
Added.
*
LayoutTests/http/tests/cookies/set-raw-cookie-in-third-party-iframe-expected.txt:
Added.
* LayoutTests/http/tests/cookies/set-raw-cookie-in-third-party-iframe.html:
Added.
Add test coverage for the overly strict checks.
* LayoutTests/ipc/set-raw-cookie-empty-commenturl-crash-expected.txt: Added.
* LayoutTests/ipc/set-raw-cookie-empty-commenturl-crash.html: Added.
* LayoutTests/ipc/set-raw-cookie-firstparty-message-check-expected.txt:
Added.
* LayoutTests/ipc/set-raw-cookie-firstparty-message-check.html: Added.
Add test coverage for what 314177@main was trying to fix, to make sure
that we don't regress it.
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::setRawCookie):
Canonical link: https://commits.webkit.org/320304@main
Canonical link: https://commits.webkit.org/305877.1148@webkitglib/2.52
Compare: https://github.com/WebKit/WebKit/compare/37c4a0953f49...08279e6ba1d6
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
