Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 2077ff8b9089b2f216f4cba982428f35e1844ea1
https://github.com/WebKit/WebKit/commit/2077ff8b9089b2f216f4cba982428f35e1844ea1
Author: Chris Dumez <[email protected]>
Date: 2026-09-28 (Mon, 28 Sep 2026)
Changed paths:
M Source/WebCore/loader/DocumentLoader.cpp
M Source/WebKit/UIProcess/API/APINavigation.h
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/Download.mm
Log Message:
-----------
REGRESSION(316344@main): [iOS] Wallet pass delivered via data: URL navigation
no longer opens Wallet
https://bugs.webkit.org/show_bug.cgi?id=325353
rdar://184582548
Reviewed by Brady Eidson.
Revert 316344@main. It refused Download policy decisions for script-initiated
data: URL
navigations, which broke sites that deliver Wallet passes, Wallet orders,
iCalendar files
and contact cards this way.
The restriction did not add security. The download is attributed to the
originating frame
exactly like one from an https URL the attacker controls, so the client's
per-site download
policy applies the same way.
Test: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/Download.mm
* Source/WebCore/loader/DocumentLoader.cpp:
(WebCore::DocumentLoader::continueAfterContentPolicy):
* Source/WebKit/UIProcess/API/APINavigation.h:
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::receivedNavigationResponsePolicyDecision):
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/Download.mm:
(TestWebKitAPI::runScriptNavigationToDataURLAndWaitForDownload):
(TestWebKitAPI::TEST(WKDownload, ScriptNavigationToDataURLBecomesDownload)):
Canonical link: https://commits.webkit.org/322096@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
