Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 80eff88f5fa13fd16ca4a44281424e386894d176
https://github.com/WebKit/WebKit/commit/80eff88f5fa13fd16ca4a44281424e386894d176
Author: Chris Dumez <[email protected]>
Date: 2026-09-14 (Mon, 14 Sep 2026)
Changed paths:
R
LayoutTests/http/tests/cookies/resources/set-raw-cookie-in-third-party-iframe-frame.html
R
LayoutTests/http/tests/cookies/set-raw-cookie-in-third-party-iframe-expected.txt
R LayoutTests/http/tests/cookies/set-raw-cookie-in-third-party-iframe.html
A
LayoutTests/http/tests/inspector/page/setCookie-with-cross-origin-iframe-expected.txt
A
LayoutTests/http/tests/inspector/page/setCookie-with-cross-origin-iframe.html
M LayoutTests/ipc/set-raw-cookie-firstparty-message-check-expected.txt
M LayoutTests/ipc/set-raw-cookie-firstparty-message-check.html
M Source/WebCore/inspector/agents/InspectorPageAgent.cpp
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
Log Message:
-----------
Regression(320304@main) SetRawCookie's MESSAGE_CHECK lets a compromised
WebContent process write cookies for other origins
https://bugs.webkit.org/show_bug.cgi?id=324125
rdar://187342639
Reviewed by Alex Christensen.
320304@main replaced setRawCookie's two MESSAGE_CHECKs:
```
MESSAGE_CHECK(RegistrableDomain::uncheckedCreateFromHost(cookie.domain).matches(firstParty));
MESSAGE_CHECK(RegistrableDomain(url).matches(firstParty));
```
with a single check that cookie.domain matches url. firstParty is the only
value in this message the NetworkProcess can trust: allowsFirstPartyForCookies
consults m_allowedFirstPartiesForCookies, populated exclusively by the UI
process via NetworkProcess::AddAllowedFirstPartyForCookies. Anchoring
cookie.domain and url to it was the point of both checks. Without that anchor,
a compromised WebContent process can pass firstParty for an origin it
legitimately hosts and both url and cookie.domain for a victim origin: the pair
agrees with itself, the check passes, and the write reaches
NetworkStorageSession::setCookie.
Restore both checks and fix the sender instead. Web Inspector and internals are
the only callers of CookieJar::setRawCookie, and neither is reachable from web
content, so the failure 320304@main was addressing never warranted relaxing the
IPC check. InspectorPageAgent::setCookie broadcast one cookie to every frame's
document, so a page with a cross-site iframe always produced an iteration whose
document URL and first party disagreed. Skip the frames the message checks would
reject; setting the same cookie once per frame was redundant anyway. This loses
no functionality, as a cookie targeting a third-party frame's domain is dropped
by -[NSHTTPCookieStorage setCookies:forURL:mainDocumentURL:] regardless.
Tests: http/tests/inspector/page/setCookie-with-cross-origin-iframe.html
ipc/set-raw-cookie-firstparty-message-check.html
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::setRawCookie):
Restore the checks removed by 320304@main.
* Source/WebCore/inspector/agents/InspectorPageAgent.cpp:
(WebCore::InspectorPageAgent::setCookie):
Only dispatch to documents whose first party matches both the cookie domain and
the document URL.
*
LayoutTests/http/tests/inspector/page/setCookie-with-cross-origin-iframe.html:
Added.
*
LayoutTests/http/tests/inspector/page/setCookie-with-cross-origin-iframe-expected.txt:
Added.
Cover Page.setCookie on a page with a cross-origin iframe, the case 320304@main
was meant to fix. Drives the Inspector protocol rather than internals, so it
exercises the path that actually regressed.
* LayoutTests/ipc/set-raw-cookie-firstparty-message-check.html:
* LayoutTests/ipc/set-raw-cookie-firstparty-message-check-expected.txt:
Add a self-consistent cross-origin url/cookie.domain pair, the one combination
the relaxed check admitted.
* LayoutTests/http/tests/cookies/set-raw-cookie-in-third-party-iframe.html:
Removed.
*
LayoutTests/http/tests/cookies/set-raw-cookie-in-third-party-iframe-expected.txt:
Removed.
*
LayoutTests/http/tests/cookies/resources/set-raw-cookie-in-third-party-iframe-frame.html:
Removed.
Asserted the relaxed behavior, and was the only user of internals.setCookie in
LayoutTests.
Canonical link: https://commits.webkit.org/321113@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
