browsers.fail
← webkit

commit bf820aa57d04

SharedWorker process placement potential spoofing

webkit spoofing heuristic WebKit

commit message

SharedWorker process placement potential spoofing
rdar://183347241

Reviewed by Rupin Mittal and Chris Dumez.

SharedWorker registration and requesting was only validating the registrable domain of a WebContent-supplied security origin.

Instead, rely on a full Site (that includes the scheme) as provided by the UI process to validate.

An opaque top origin has no scheme, and RegistrableDomain maps its empty host to "nullOrigin", so every
opaque origin collapses to a single Site and cannot be validated this way. Skip the check for those rather
than terminating a document that legitimately has one: a top-level document sandboxed by CSP has an opaque
origin, and AbstractWorker::validateURL lets it name a data: worker script.

Tests: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SharedWorker.mm
       fast/workers/shared-worker-file-url-top-origin.html
       http/tests/ipc/shared-worker-forged-top-origin-scheme.html

* LayoutTests/fast/workers/resources/shared-worker-file-url-top-origin.js: Added.
* LayoutTests/fast/workers/shared-worker-file-url-top-origin-expected.txt: Added.
* LayoutTests/fast/workers/shared-worker-file-url-top-origin.html: Added.
* LayoutTests/http/tests/ipc/resources/shared-worker-forged-top-origin-scheme-worker.js: Added.
* LayoutTests/http/tests/ipc/shared-worker-forged-top-origin-scheme-expected.txt: Added.
* LayoutTests/http/tests/ipc/shared-worker-forged-top-origin-scheme.html: Added.
* Source/WebKit/NetworkProcess/NetworkProcess.cpp:
(WebKit::NetworkProcess::createNetworkConnectionToWebProcess):
(WebKit::NetworkProcess::addAllowedFirstPartyForCookies):
(WebKit::NetworkProcess::addAllowedFirstPartyDomainForCookies):
(WebKit::NetworkProcess::allowsFirstPartyForCookies):
(WebKit::NetworkProcess::allowsFirstPartySite const):
* Source/WebKit/NetworkProcess/NetworkProcess.h:
* Source/WebKit/NetworkProcess/NetworkProcess.messages.in:
* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:
(WebKit::NetworkResourceLoader::didReceiveResponse):
(WebKit::NetworkResourceLoader::handleProvisionalLoadFailureFromContentFilter):
* Source/WebKit/NetworkProcess/NetworkSession.cpp:
(WebKit::NetworkSession::addAllowedFirstPartyForCookies):
* Source/WebKit/NetworkProcess/SharedWorker/WebSharedWorkerServerConnection.cpp:
(WebKit::WebSharedWorkerServerConnection::requestSharedWorker):
* Source/WebKit/NetworkProcess/SharedWorker/WebSharedWorkerServerToContextConnection.cpp:
(WebKit::WebSharedWorkerServerToContextConnection::launchSharedWorker):
* Source/WebKit/Shared/NetworkProcessConnectionParameters.h:
* Source/WebKit/Shared/NetworkProcessConnectionParameters.serialization.in:
* Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp:
(WebKit::NetworkProcessProxy::addAllowedFirstPartyForCookies):
* Source/WebKit/UIProcess/Network/NetworkProcessProxy.h:
* Source/WebKit/UIProcess/WebFrameProxy.cpp:
(WebKit::WebFrameProxy::prepareForProvisionalLoadInProcess):
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::addAllowedFirstPartyForCookies):
(WebKit::WebPageProxy::loadAlternateHTML):
(WebKit::WebPageProxy::receivedNavigationActionPolicyDecision):
(WebKit::WebPageProxy::continueNavigationInNewProcess):
(WebKit::WebPageProxy::performProcessSwapForNavigationResponse):
(WebKit::canReuseProvisionalProcessForBrowsingContextGroupSwitch):
* Source/WebKit/UIProcess/WebPageProxy.h:
* Source/WebKit/UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::establishRemoteWorkerContextConnectionToNetworkProcess):
(WebKit::WebProcessPool::processForNavigation):
(WebKit::WebProcessPool::prepareProcessForNavigation):
* Source/WebKit/UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::addAllowedFirstPartyForCookies):
* Source/WebKit/UIProcess/WebProcessProxy.h:
* Tools/TestWebKitAPI/SourcesCocoa.txt:
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SharedWorker.mm: Added.
(if):
(cloneParsedMessage):
(harvestFailedSharedWorker):
(harvest):
(restoreTransferredMessagePort):
(requestSharedWorker):
(messagesFromWorkers):
(TestWebKitAPI::(SharedWorkerProcessPlacement, ReplayedRequestStartsWorkerWithoutNewProcess)):
(TestWebKitAPI::(SharedWorkerProcessPlacement, ForgedTopOriginSchemeDoesNotCreateNewProcess)):
(TestWebKitAPI::runDataURLSharedWorkerInSandboxedDocumentTest):
(TestWebKitAPI::(SharedWorkerProcessPlacement, SandboxedFrameCanStartDataURLSharedWorker)):
(TestWebKitAPI::(SharedWorkerProcessPlacement, SandboxedTopLevelDocumentCanStartDataURLSharedWorker)):
(TestWebKitAPI::(SharedWorkerProcessPlacement, CustomSchemeDocumentWithoutHostCanStartSharedWorker)):
(-[SharedWorkerHostSchemeHandler webView:startURLSchemeTask:]):
(-[SharedWorkerHostSchemeHandler webView:stopURLSchemeTask:]):

Originally-landed-as: 316606.631@safari-7625-branch (bc550432a2f0). rdar://191060009
Canonical link: https://commits.webkit.org/326231@main

files

  • LayoutTests/fast/workers/resources/shared-worker-file-url-top-origin.js
  • LayoutTests/fast/workers/shared-worker-file-url-top-origin-expected.txt
  • LayoutTests/fast/workers/shared-worker-file-url-top-origin.html
  • LayoutTests/http/tests/ipc/resources/shared-worker-forged-top-origin-scheme-worker.js
  • LayoutTests/http/tests/ipc/shared-worker-forged-top-origin-scheme-expected.txt
  • LayoutTests/http/tests/ipc/shared-worker-forged-top-origin-scheme.html
  • Source/WebKit/NetworkProcess/NetworkProcess.cpp
  • Source/WebKit/NetworkProcess/NetworkProcess.h
  • Source/WebKit/NetworkProcess/NetworkProcess.messages.in
  • Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp
  • Source/WebKit/NetworkProcess/NetworkSession.cpp
  • Source/WebKit/NetworkProcess/SharedWorker/WebSharedWorkerServerConnection.cpp
  • Source/WebKit/NetworkProcess/SharedWorker/WebSharedWorkerServerToContextConnection.cpp
  • Source/WebKit/Shared/NetworkProcessConnectionParameters.h
  • Source/WebKit/Shared/NetworkProcessConnectionParameters.serialization.in
  • Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp
  • Source/WebKit/UIProcess/Network/NetworkProcessProxy.h
  • Source/WebKit/UIProcess/WebFrameProxy.cpp
  • Source/WebKit/UIProcess/WebPageProxy.cpp
  • Source/WebKit/UIProcess/WebPageProxy.h
  • Source/WebKit/UIProcess/WebProcessPool.cpp
  • Source/WebKit/UIProcess/WebProcessProxy.cpp
  • Source/WebKit/UIProcess/WebProcessProxy.h
  • Tools/TestWebKitAPI/SourcesCocoa.txt
  • Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SharedWorker.mm

this commit matched a vulnerability pattern in its message. WebKit does not publish a security bug for every fix, so treat it as a lead, not as a CVE record.