Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 835c8016b492f302189935e14739b165149f6d3c
https://github.com/WebKit/WebKit/commit/835c8016b492f302189935e14739b165149f6d3c
Author: Adrian Taylor <[email protected]>
Date: 2026-09-09 (Wed, 09 Sep 2026)
Changed paths:
M Source/WebKit/Scripts/webkit/untrusted_origins.py
R Source/WebKit/UIProcess/FirstPartyAuthority.h
A Source/WebKit/UIProcess/ValidationProcedures.h
M Source/WebKit/UIProcess/WebProcessProxy.cpp
M Source/WebKit/UIProcess/WebProcessProxy.h
M Source/WebKit/WebKit.xcodeproj/project.pbxproj
Log Message:
-----------
Rename and adjust the UI process's validation procedures
https://bugs.webkit.org/show_bug.cgi?id=323738
Reviewed by Zak Ridouh.
The procedures a value must pass through to escape IPC::Untrusted were added by
earlier infrastructural commits and nothing calls them yet. Adjust them before
the commit that turns validation on, based on experience.
No behaviour change: every procedure here is still unreachable, and the one new
WebProcessProxy predicate has no caller but the procedure that wraps it.
Renamed, because the old names described neither what they check nor how they
differ from each other:
- FirstPartyAuthority and TopLevelFirstPartyAuthority are now one
ProcessSpeaksForDomain. The difference between them was never top-level
frames at all: one applied the site-isolation guard and the other did not.
That is now a constructor argument, EvenWithoutSiteIsolation, so the
difference
is visible at the call site instead of encoded in a prefix.
- CommittedClientOriginAuthority is now ProcessCommittedClientOrigin, and
PageFirstPartySiteAuthority is now ProcessParticipatesInPageWithSite. Each
names the WebProcessProxy predicate it applies, so the class list reads as the
list of questions asked.
FirstPartyAuthority.h becomes ValidationProcedures.h.
ProcessParticipatesInPageWithSite is new: use it for a value naming a page's
top-level site rather than something the sender speaks for itself, where the
sender cannot be the judge.
A value whose registrable domain is empty now passes. An opaque origin has no
host and so no domain to compare, a process legitimately hosts such documents -
sandboxed frames, data: URLs, the initial about:blank - and an opaque origin
claims no authority, so there is nothing to withhold by allowing it.
* Source/WebKit/Scripts/webkit/untrusted_origins.py:
* Source/WebKit/UIProcess/ValidationProcedures.h: Renamed from
Source/WebKit/UIProcess/FirstPartyAuthority.h.
(WebKit::ProcessSpeaksForDomain::ProcessSpeaksForDomain):
(WebKit::ProcessSpeaksForDomain::checkUntrusted const):
(WebKit::ProcessSpeaksForDomain::checkUntrustedDomain const):
(WebKit::ProcessParticipatesInPageWithSite::ProcessParticipatesInPageWithSite):
(WebKit::ProcessParticipatesInPageWithSite::checkUntrusted const):
(WebKit::ProcessCommittedClientOrigin::ProcessCommittedClientOrigin):
(WebKit::ProcessCommittedClientOrigin::checkUntrusted const):
(WebKit::firstPartyAccessIsAnswerable):
(WebKit::checkFirstPartyAccessResult):
(WebKit::checkFirstPartyAccess):
* Source/WebKit/UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::participatesInPageWithFirstPartySite const):
* Source/WebKit/UIProcess/WebProcessProxy.h:
* Source/WebKit/WebKit.xcodeproj/project.pbxproj:
Canonical link: https://commits.webkit.org/320738@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
