Changeset 243784 in webkit

Timestamp:

Apr 2, 2019, 8:24:29 PM (7 years ago)

Author:

ggaren@apple.com

Message:

Eliminate plugin sandbox exceptions
​https://bugs.webkit.org/show_bug.cgi?id=196510

Reviewed by Chris Dumez.

• PluginProcess/mac/PluginProcessMac.mm:

(WebKit::PluginProcess::initializeSandbox):

• UIProcess/Plugins/PluginInfoStore.cpp:

(WebKit::PluginInfoStore::shouldAllowPluginToRunUnsandboxed): Deleted.

• UIProcess/Plugins/PluginInfoStore.h:
• UIProcess/Plugins/mac/PluginInfoStoreMac.mm:

(WebKit::PluginInfoStore::shouldUsePlugin):
(WebKit::PluginInfoStore::shouldAllowPluginToRunUnsandboxed): Deleted.

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• PluginProcess/mac/PluginProcessMac.mm (modified) (1 diff)
• UIProcess/Plugins/PluginInfoStore.cpp (modified) (1 diff)
• UIProcess/Plugins/PluginInfoStore.h (modified) (1 diff)
• UIProcess/Plugins/mac/PluginInfoStoreMac.mm (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-04-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Eliminate plugin sandbox exceptions
+        https://bugs.webkit.org/show_bug.cgi?id=196510
+
+        Reviewed by Chris Dumez.
+
+        * PluginProcess/mac/PluginProcessMac.mm:
+        (WebKit::PluginProcess::initializeSandbox):
+        * UIProcess/Plugins/PluginInfoStore.cpp:
+        (WebKit::PluginInfoStore::shouldAllowPluginToRunUnsandboxed): Deleted.
+        * UIProcess/Plugins/PluginInfoStore.h:
+        * UIProcess/Plugins/mac/PluginInfoStoreMac.mm:
+        (WebKit::PluginInfoStore::shouldUsePlugin):
+        (WebKit::PluginInfoStore::shouldAllowPluginToRunUnsandboxed): Deleted.
+
 2019-04-02  Alex Christensen  <achristensen@webkit.org>
 

trunk/Source/WebKit/PluginProcess/mac/PluginProcessMac.mm

@@ -475 +475 @@
     }
 
-    if (PluginInfoStore::shouldAllowPluginToRunUnsandboxed(m_pluginBundleIdentifier))
-        return;
-
     bool parentIsSandboxed = parameters.connectionIdentifier.xpcConnection && connectedProcessIsSandboxed(parameters.connectionIdentifier.xpcConnection.get());
 

trunk/Source/WebKit/UIProcess/Plugins/PluginInfoStore.cpp

@@ -160 +160 @@
 #if !PLATFORM(COCOA)
 
-bool PluginInfoStore::shouldAllowPluginToRunUnsandboxed(const String& pluginBundleIdentifier)
-{
-    UNUSED_PARAM(pluginBundleIdentifier);
-    return false;
-}
-
 PluginModuleLoadPolicy PluginInfoStore::defaultLoadPolicyForPlugin(const PluginModuleInfo&)
 {

trunk/Source/WebKit/UIProcess/Plugins/PluginInfoStore.h

@@ -65 +65 @@
     void clearSupportedPlugins() { m_supportedPlugins = WTF::nullopt; }
 
-    static bool shouldAllowPluginToRunUnsandboxed(const String& pluginBundleIdentifier);
-
 private:
     PluginModuleInfo findPluginForMIMEType(const String& mimeType, WebCore::PluginData::AllowedPluginTypes) const;

trunk/Source/WebKit/UIProcess/Plugins/mac/PluginInfoStoreMac.mm

@@ -84 +84 @@
 }
 
-bool PluginInfoStore::shouldAllowPluginToRunUnsandboxed(const String& pluginBundleIdentifier)
-{
-    if (RuntimeEnabledFeatures::sharedFeatures().experimentalPlugInSandboxProfilesEnabled())
-        return false;
-
-    return pluginBundleIdentifier == "com.cisco.webex.plugin.gpc64"_s
-        || pluginBundleIdentifier == "com.google.googletalkbrowserplugin"_s
-        || pluginBundleIdentifier == "com.google.o1dbrowserplugin"_s
-        || pluginBundleIdentifier == "com.apple.NPSafeInput"_s
-        || pluginBundleIdentifier == "com.apple.BocomSubmitCtrl"_s
-        || pluginBundleIdentifier == "com.ftsafe.NPAPI-Core-Safe-SoftKeybaord.plugin.rfc1034identifier"_s
-        || pluginBundleIdentifier == "com.cfca.npSecEditCtl.MAC.BOC.plugin"_s
-        || pluginBundleIdentifier == "com.cfca.npSecEditCtl.MAC.BOCO"_s
-        || pluginBundleIdentifier == "cfca.com.npCryptoKit.MAC.BOC"_s
-        || pluginBundleIdentifier == "cfca.com.npP11CertEnroll.MAC.BOC"_s
-        || pluginBundleIdentifier == "cfca.com.npCryptoKit.UnionPay.MAC"_s
-        || pluginBundleIdentifier == "cfca.com.npP11CertEnroll.MAC.UnionPay"_s
-        || pluginBundleIdentifier == "Bocom.netsignplugin"_s
-        || pluginBundleIdentifier == "cfca.com.npP11CertEnroll.MAC.CGB"_s
-        || pluginBundleIdentifier == "cfca.com.npCryptoKit.CGB.MAC"_s
-        || pluginBundleIdentifier == "mw.icbc-safari-MW"_s;
-}
-
 bool PluginInfoStore::shouldUsePlugin(Vector<PluginModuleInfo>& alreadyLoadedPlugins, const PluginModuleInfo& plugin)
 {
@@ -128 +105 @@
     }
 
-    if (currentProcessIsSandboxed() && !plugin.hasSandboxProfile && !shouldAllowPluginToRunUnsandboxed(plugin.bundleIdentifier)) {
+    if (currentProcessIsSandboxed() && !plugin.hasSandboxProfile) {
         LOG(Plugins, "Ignoring unsandboxed plug-in %s", plugin.bundleIdentifier.utf8().data());
         return false;