Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 173261c80c9adef54161b4f821af8404ccdcc827
https://github.com/WebKit/WebKit/commit/173261c80c9adef54161b4f821af8404ccdcc827
Author: Chris Dumez <[email protected]>
Date: 2026-09-07 (Mon, 07 Sep 2026)
Changed paths:
M Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm
M Source/WebKit/UIProcess/WebFrameProxy.cpp
M Source/WebKit/UIProcess/WebFrameProxy.h
M Source/WebKit/UIProcess/WebPageProxy.cpp
Log Message:
-----------
Validate transient user activation in UIProcess for async clipboard reads
https://bugs.webkit.org/show_bug.cgi?id=314886
rdar://177152667
Reviewed by Ryosuke Niwa.
Follow-up to 305413.908@safari-7624-branch, which added a WebCore-side
transient activation check to navigator.clipboard.readText() / read(). That
check is bypassable by a compromised WebContent process that calls the
RequestDOMPasteAccess IPC directly with a fabricated activation claim.
Mirror the spec's transient activation tracking
(LocalDOMWindow::notifyActivated, LocalDOMWindow::hasTransientActivation) in
the UIProcess so the UIProcess can independently verify that the requesting
frame really is activated:
- WebFrameProxy gains m_lastActivationTimestamp, notifyActivated(), and
hasTransientActivation(). notifyActivated() propagates the timestamp to
ancestor frames (any origin) and same-origin descendant frames, matching
the HTML spec's activation notification algorithm.
- The four input-event entry points in WebPageProxy
(sendMouseEvent / sendKeyEvent / sendPreventableTouchEvent /
sendUnpreventableTouchEvent) now call WebFrameProxy::notifyActivated for
activation-triggering events on the target frame. The pre-existing
page-level lastActivationTimestamp updates remain; they serve a different
heuristic.
- WebPageProxy::requestDOMPasteAccess rejects with DeniedForGesture if the
requesting WebFrameProxy does not have transient activation. A compromised
WebContent process can no longer get past this gate.
- WebFrameProxy::didCommitLoad resets m_lastActivationTimestamp so a new
document does not inherit activation from the previous one (matches
LocalDOMWindow::consumeLastActivationIfNecessary semantics).
* Source/WebKit/UIProcess/WebFrameProxy.cpp:
(WebKit::WebFrameProxy::didCommitLoad):
(WebKit::WebFrameProxy::notifyActivated):
(WebKit::WebFrameProxy::propagateActivationToSameOriginDescendants):
(WebKit::WebFrameProxy::hasTransientActivation const):
(WebKit::WebFrameProxy::securityOrigin const):
* Source/WebKit/UIProcess/WebFrameProxy.h:
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::sendMouseEvent):
(WebKit::WebPageProxy::sendKeyEvent):
(WebKit::WebPageProxy::sendPreventableTouchEvent):
(WebKit::WebPageProxy::sendUnpreventableTouchEvent):
(WebKit::WebPageProxy::requestDOMPasteAccess):
Originally-landed-as: 305413.928@safari-7624-branch (6e4e21af9c2e).
rdar://184744416
Canonical link: https://commits.webkit.org/320639@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
