Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 22a2306fb72994403a9910071fff0284a132292b
https://github.com/WebKit/WebKit/commit/22a2306fb72994403a9910071fff0284a132292b
Author: Anne van Kesteren <[email protected]>
Date: 2026-10-11 (Sun, 11 Oct 2026)
Changed paths:
A
LayoutTests/imported/w3c/web-platform-tests/html/document-isolation-policy/blob-document-inherits-policy.tentative.https-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/html/document-isolation-policy/blob-document-inherits-policy.tentative.https.html
A
LayoutTests/imported/w3c/web-platform-tests/html/document-isolation-policy/resources/blob-creator-frame.html
M
LayoutTests/imported/w3c/web-platform-tests/html/document-isolation-policy/resources/w3c-import.log
M
LayoutTests/imported/w3c/web-platform-tests/html/document-isolation-policy/w3c-import.log
M LayoutTests/platform/ios-site-isolation/TestExpectations
M LayoutTests/platform/mac-site-isolation/TestExpectations
M Source/WebCore/loader/DocumentIsolationPolicy.cpp
M Source/WebKit/UIProcess/BrowsingContextGroup.cpp
Log Message:
-----------
Blob documents created by a document with an opaque origin lose its
Document-Isolation-Policy
https://bugs.webkit.org/show_bug.cgi?id=327090
rdar://189704994
Reviewed by Ryosuke Niwa.
A blob: document inherits the policy container of the document that created
it, which BlobResourceHandleBase reflects as a Document-Isolation-Policy
header on the response. Since 323290@main the UI process applies that
header only in a secure context, which it computes from the response's
origin. For a blob URL created by an opaque origin, such as a sandboxed
document, the UI process can't recover the creator's origin, so the
policy was ignored and the blob document could load cross-origin
resources that don't opt in through CORP.
obtainDocumentIsolationPolicy() now treats the header on a blob: response as
inherited and skips the secure context check for it: the header is only
present when the creator's policy, obtained in a secure context, included it.
Test:
imported/w3c/web-platform-tests/html/document-isolation-policy/blob-document-inherits-policy.tentative.https.html
Canonical link: https://commits.webkit.org/323391@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
