Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b2dca993516ffb2cbdc016e4dc0df81e85e78f87
https://github.com/WebKit/WebKit/commit/b2dca993516ffb2cbdc016e4dc0df81e85e78f87
Author: Zak Ridouh <[email protected]>
Date: 2026-09-18 (Fri, 18 Sep 2026)
Changed paths:
M Source/WebCore/editing/cocoa/AttributedString.mm
M Source/WebKit/UIProcess/PageClient.h
M Source/WebKit/UIProcess/ios/PageClientImplIOS.h
M Source/WebKit/UIProcess/ios/PageClientImplIOS.mm
M Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm
M Source/WebKit/UIProcess/mac/WebContextMenuProxyMac.mm
M Tools/TestWebKitAPI/Tests/WebCore/cocoa/AttributedStringFontCache.mm
Log Message:
-----------
[CoreIPC] [UIP] UIProcess decodes WebContent-supplied image bytes with the
unrestricted ImageIO codec set
<https://bugs.webkit.org/show_bug.cgi?id=319411>
<rdar://174675851>
Reviewed by David Kilzer.
The WebContent and GPU processes restrict image decoding to the types
supported for web content, but the UIProcess does not, and it cannot do so
process-wide because it is the host application's process. As a result,
image bytes sent from the WebContent process to the UIProcess -- directly
via SharedMemory, or embedded as a file-wrapper attachment inside an
AttributedString -- get decoded with the full ImageIO codec set (PSD,
OpenEXR, camera RAW, JPEG 2000, etc.) rather than the web-safe subset. A
compromised WebContent process can use this to run codecs in the host
process that are never reached by normal web content.
Gate each affected UIProcess decode on WebCore::isSupportedImageType()
instead.
Test: Tools/TestWebKitAPI/Tests/WebCore/cocoa/AttributedStringFontCache.mm
* Source/WebCore/editing/cocoa/AttributedString.mm: When reconstructing an
NSTextAttachment, if the file-wrapper data is an image of a type not
supported for web content, drop it and substitute the missing-image
placeholder. Web-safe images and non-image file wrappers are unaffected.
* Source/WebKit/UIProcess/mac/WebContextMenuProxyMac.mm: Decode the share
menu's image through createCocoaImageRestrictedToSupportedTypes().
* Source/WebKit/UIProcess/PageClient.h:
* Source/WebKit/UIProcess/ios/PageClientImplIOS.h:
* Source/WebKit/UIProcess/ios/PageClientImplIOS.mm: Copy the image out of
shared memory and only save it to the photo library if it is a supported
image type. Take the SharedBuffer by const reference since the method does
not take ownership of it.
* Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm: Update the caller for the
saveImageToLibrary() signature change.
* Tools/TestWebKitAPI/Tests/WebCore/cocoa/AttributedStringFontCache.mm:
Added tests covering web-safe, unsupported-image, and non-image attachment
data.
Originally-landed-as: 316606.192@safari-7625-branch (eb9e464809b1).
rdar://187506978
Canonical link: https://commits.webkit.org/321422@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
