Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b1fc319a481051f27706b003977e5213319421e4
https://github.com/WebKit/WebKit/commit/b1fc319a481051f27706b003977e5213319421e4
Author: Dewei Zhu <[email protected]>
Date: 2026-09-25 (Fri, 25 Sep 2026)
Changed paths:
M Websites/perf.webkit.org/public/include/json-header.php
M Websites/perf.webkit.org/public/include/report-processor.php
M Websites/perf.webkit.org/public/privileged-api/generate-csrf-token.php
M Websites/perf.webkit.org/server-tests/api-report-tests.js
M Websites/perf.webkit.org/server-tests/privileged-api-upate-run-status.js
M Websites/perf.webkit.org/tools/js/remote.js
Log Message:
-----------
perf.webkit.org: verify_token() compares the CSRF token with loose ==, so a
JSON boolean satisfies the check
https://bugs.webkit.org/show_bug.cgi?id=324033
rdar://187853206
Reviewed by Stephanie Lewis.
Two authentication checks could be satisfied without knowing the secret, and the
CSRF token itself was predictable.
Compare both secrets strictly, generate the token from a secure random source,
and
harden the token cookies. Also fix the Node cookie jar, which could not parse
the
new cookie attributes.
* Websites/perf.webkit.org/public/include/json-header.php:
* Websites/perf.webkit.org/public/include/report-processor.php:
* Websites/perf.webkit.org/public/privileged-api/generate-csrf-token.php:
* Websites/perf.webkit.org/server-tests/api-report-tests.js:
* Websites/perf.webkit.org/server-tests/privileged-api-upate-run-status.js:
(async await):
* Websites/perf.webkit.org/tools/js/remote.js:
(NodeRemoteAPI.prototype.sendHttpRequest):
Canonical link: https://commits.webkit.org/321945@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
