Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: 80eed320a2e3524231498b67f4d83c0ddadecea4
https://github.com/WebKit/WebKit/commit/80eed320a2e3524231498b67f4d83c0ddadecea4
Author: Anthony Tarbinian <[email protected]>
Date: 2026-09-15 (Tue, 15 Sep 2026)
Changed paths:
A
LayoutTests/ipc/scheduleresourceload-resume-bind-to-claimant-message-check-expected.txt
A
LayoutTests/ipc/scheduleresourceload-resume-bind-to-claimant-message-check.html
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.h
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.messages.in
M Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp
M Source/WebKit/NetworkProcess/NetworkSession.cpp
M Source/WebKit/NetworkProcess/NetworkSession.h
M Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp
M Source/WebKit/UIProcess/Network/NetworkProcessProxy.h
M Source/WebKit/UIProcess/Network/NetworkProcessProxy.messages.in
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/UIProcess/WebPageProxy.h
Log Message:
-----------
Cherry-pick 316606.70@safari-7625-branch (c3e6d5676f11).
https://bugs.webkit.org/show_bug.cgi?id=315727
Add ownership check on existingLoaderToResume in
NetworkConnectionToWebProcess::scheduleResourceLoad
https://bugs.webkit.org/show_bug.cgi?id=315727
rdar://176369767
Reviewed by Basuke Suzuki.
When a BrowsingContextGroup switch is needed, the NetworkProcess
"parks" the in-flight NetworkResourceloader of a response while a new WebContent
process is being spun up. The NetworkResourceloader stores
connection details, headers, cookies, response body, etc.
The NetworkProcess caches the loader in a map
(NetworkSession::m_loadersAwaitingWebProcessTransfer)
where the key is a ObjectIdentifier (integer under the hood).
The bug is that a WebContent can attempts to claim the parked
NetworkResourceLoader without any verification of ownership of the loader.
This happens in NetworkConnectionToWebProcess::scheduleResourceLoad
which accepts a WebContent-supplied ID into the map (called
existingLoaderToResume).
There is no verification that the calling WebContent process actually
owns that parked resource loader. If another, malicious, WebContent
process guessed the right integer, it could receive the NetworkResourceloader
which was intended for another process. This allows any WebContent
process to "impersonate" as another and claim their loader with all the
information associated with it.
This patch binds the parked loader to the intended WebContent process.
The UIProcess already chooses the destination process when handling
TriggerBrowsingContextGroupSwitchForNavigation.
Instead of blindly accpeting the loader ID from untrusted WebContent processes,
the NetworkProcess validates it against the UIProcess which is the definitive
source of truth.
THis patch changes the completion handler of
TriggerBrowsingContextGroupSwitchForNavigation to
carry that destination's WebProcessIdentifier back to NetworkProcess.
NetworkSession records it as a member on the CachedNetworkResourceLoader
wrapper, and takeLoaderAwaitingWebProcessTransfer now compares the calling
connection's WebProcessIdentifier against the recorded destination, returning
one of four outcomes (Success, NotFound, Pending, WrongCaller).
scheduleResourceLoad MESSAGE_CHECKs WrongCaller, terminating the lying
connection.
A claim that arrives before UIProcess's reply has set the destination is
queued against the cached loader via
CachedNetworkResourceLoader::addPendingClaim
(capped at 4 pending claims).
When the destination web process is resolved, the queue is drained and if the
claim matches the actual destination, the transfer of the loader to the
WebContent
process is handled. Any mismatch where a WebContent process is claiming to
own another process's loader will result in the WebContent process being
terminated.
This is the flow of the ownership check and handling pending claims:
1. Claim arrives. WCP sends ScheduleResourceLoad. NP enters
scheduleResourceLoad, hits
Pending, calls queuePendingLoaderClaim. The claim is stored. The function
returns.
Dispatch of that message is now complete.
2. Time passes and the UIProcess replies to
TriggerBrowsingContextGroupSwitchForNavigation
with the new WCP identifier after the BrowsingContextGroup switch.
3. NP enters setLoaderAwaitingWebProcessTransferDestination. Inside, the
queue drains. For each mismatched claim, we want to kill that specific WCP.
In addition to this ownership check, I plan to change the key to the
NetworkSession::m_loadersAwaitingWebProcessTransfer map to be more difficult
to guess compared to a sequentially incrementing integer in a follow-up.
Add a layout test that drives the loader ownership check through the real
ScheduleResourceLoad IPC path. This patch adds two test-only
NetworkConnectionToWebProcess IPC messages (gated behind
ENABLE(IPC_TESTING_API)).
The first plants and the second removes a synthetic parked
entry whose destination is a WebProcessIdentifier the calling WebContent
process cannot match. The test then sends a real ScheduleResourceLoad with
existingLoaderToResume pointing at the synthetic entry and asserts that
NetworkProcess fires MESSAGE_CHECK on the WrongCaller outcome (observed via
the existing TakeInvalidMessageStringForTesting IPC). With the fix
reverted, NetworkProcess crashes attempting to dereference the synthetic
entry's null loader, which the layout-test runner reports as a regression.
Test: ipc/scheduleresourceload-resume-bind-to-claimant-message-check.html
Test: ipc/scheduleresourceload-resume-bind-to-claimant-message-check.html
*
LayoutTests/ipc/scheduleresourceload-resume-bind-to-claimant-message-check-expected.txt:
Added.
*
LayoutTests/ipc/scheduleresourceload-resume-bind-to-claimant-message-check.html:
Added.
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::scheduleResourceLoad):
(WebKit::NetworkConnectionToWebProcess::completeQueuedExistingLoaderResume):
(WebKit::NetworkConnectionToWebProcess::terminateForInvalidLoaderResumeClaim):
(WebKit::NetworkConnectionToWebProcess::addSyntheticParkedLoaderForTesting):
(WebKit::NetworkConnectionToWebProcess::removeSyntheticParkedLoaderForTesting):
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.h:
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.messages.in:
* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:
(WebKit::NetworkResourceLoader::sendDidReceiveResponsePotentiallyInNewBrowsingContextGroup):
* Source/WebKit/NetworkProcess/NetworkSession.cpp:
(WebKit::NetworkSession::CachedNetworkResourceLoader::createForTesting):
Testing helper function to create an empty CachedNetworkResourceLoader
to use for parking.
(WebKit::NetworkSession::CachedNetworkResourceLoader::CachedNetworkResourceLoader):
(WebKit::NetworkSession::CachedNetworkResourceLoader::expirationTimerFired):
(WebKit::NetworkSession::CachedNetworkResourceLoader::addPendingClaim):
Keep track of when a WebContent process kicks off a claim
of a parked loader.
(WebKit::NetworkSession::CachedNetworkResourceLoader::takePendingClaims):
Grab the queued claim and handle it whenever
the UIProcess responds with whoever owns the parked loader.
(WebKit::NetworkSession::setParkedLoaderDestinationAndResolvePendingClaims):
Associates a parked loader with a destination WebContent process
(after the UIProcess has determined the new process for the BCG switch).
After that, this function walks through the queued up claims and
performs the ownership check (enforces that the WebContent process
that originally made the claim is really the same process which the
UIProcess said owns the loader).
If the claim's process matches, then we transfer the loader to them.
If not, we terminate the misbehaved WebContent process which tried
to claim another process's loader.
(WebKit::NetworkSession::takeLoaderAwaitingWebProcessTransfer):
(WebKit::NetworkSession::queuePendingLoaderClaim):
Add incoming loader claims from WebContent processes to the queue.
(WebKit::NetworkSession::addSyntheticLoaderAwaitingWebProcessTransferForTesting):
Testing only function which artificially parks a loader in
the m_loadersAwaitingWebProcessTransfer map.
(WebKit::NetworkSession::removeSyntheticLoaderAwaitingWebProcessTransferForTesting):
Testing only function which artificially removes a loader
from the m_loadersAwaitingWebProcessTransfer map.
* Source/WebKit/NetworkProcess/NetworkSession.h:
(WebKit::NetworkSession::CachedNetworkResourceLoader::destinationWebProcess
const):
(WebKit::NetworkSession::CachedNetworkResourceLoader::setDestinationWebProcess):
* Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp:
(WebKit::NetworkProcessProxy::triggerBrowsingContextGroupSwitchForNavigation):
Change
NetworkProcessProxy::triggerBrowsingContextGroupSwitchForNavigation
to pass in std::nullopt as the destinationWebProcess during failure.
* Source/WebKit/UIProcess/Network/NetworkProcessProxy.h:
Change definition of
NetworkProcessProxy::triggerBrowsingContextGroupSwitchForNavigation
to take a completion handler which passes the destination web process
identifier.
* Source/WebKit/UIProcess/Network/NetworkProcessProxy.messages.in:
Change definition of triggerBrowsingContextGroupSwitchForNavigation
IPC message to take a completion handler which passes the destination
web process identifier.
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::triggerBrowsingContextGroupSwitchForNavigation):
Change completion handler of
WebPageProxy::triggerBrowsingContextGroupSwitchForNavigation
to pass the destination web process chosen after a BrowsingContextGroup
switch. Previously, the completion handler had one argument which was
a success indicator of the BrowsingContextGroup switch.
* Source/WebKit/UIProcess/WebPageProxy.h:
Change definition of
WebPageProxy::triggerBrowsingContextGroupSwitchForNavigation
to take a completion handler which passes the destination web process
identifier.
Identifier: 316606.70@safari-7625-branch
Canonical link: https://commits.webkit.org/317695.318@webkitglib/2.54
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
