Changeset 244255 in webkit

Timestamp:

Apr 15, 2019, 12:15:29 AM (7 years ago)

Author:

bshafiei@apple.com

Message:

Cherry-pick r243487. rdar://problem/49788895

Do not terminate the NetworkProcess if a third party application sends a NSCredential with a SecIdentityRef
​https://bugs.webkit.org/show_bug.cgi?id=196213

Patch by Alex Christensen <​achristensen@webkit.org> on 2019-03-25
Reviewed by Geoff Garen.

Source/WebKit:

A release assertion added in r230225 was reachable. I reached it in a unit test that responds to a challenge
with a SecIdentityRef wrapped in an NSCredential.

• Shared/cf/ArgumentCodersCF.cpp: (IPC::decode):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@243487 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-607-branch/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Shared/cf/ArgumentCodersCF.cpp (modified) (2 diffs)

branches/safari-607-branch/Source/WebKit/ChangeLog

@@ +1 @@
+2019-04-14  Babak Shafiei  <bshafiei@apple.com>
+
+        Cherry-pick r243487. rdar://problem/49788895
+
+    Do not terminate the NetworkProcess if a third party application sends a NSCredential with a SecIdentityRef
+    https://bugs.webkit.org/show_bug.cgi?id=196213
+    
+    Patch by Alex Christensen <achristensen@webkit.org> on 2019-03-25
+    Reviewed by Geoff Garen.
+    
+    Source/WebKit:
+    
+    A release assertion added in r230225 was reachable.  I reached it in a unit test that responds to a challenge
+    with a SecIdentityRef wrapped in an NSCredential.
+    
+    * Shared/cf/ArgumentCodersCF.cpp:
+    (IPC::decode):
+    
+    Tools:
+    
+    * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
+    * TestWebKitAPI/Tests/WebKitCocoa/Challenge.mm: Added.
+    (credentialWithIdentityAndKeychainPath):
+    (-[ChallengeDelegate webView:didFinishNavigation:]):
+    (-[ChallengeDelegate webView:didReceiveAuthenticationChallenge:completionHandler:]):
+    (TestWebKitAPI::TEST):
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243487 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-03-25  Alex Christensen  <achristensen@webkit.org>
+
+            Do not terminate the NetworkProcess if a third party application sends a NSCredential with a SecIdentityRef
+            https://bugs.webkit.org/show_bug.cgi?id=196213
+
+            Reviewed by Geoff Garen.
+
+            A release assertion added in r230225 was reachable.  I reached it in a unit test that responds to a challenge
+            with a SecIdentityRef wrapped in an NSCredential.
+
+            * Shared/cf/ArgumentCodersCF.cpp:
+            (IPC::decode):
+
 2019-04-11  Kocsen Chung  <kocsen_chung@apple.com>
 

branches/safari-607-branch/Source/WebKit/Shared/cf/ArgumentCodersCF.cpp

@@ -706 +706 @@
 bool decode(Decoder& decoder, RetainPtr<SecIdentityRef>& result)
 {
-#if PLATFORM(COCOA)
-    RELEASE_ASSERT(hasProcessPrivilege(ProcessPrivilege::CanAccessCredentials));
-#endif
-
     RetainPtr<SecCertificateRef> certificate;
     if (!decode(decoder, certificate))
@@ -724 +720 @@
     if (!decode(decoder, keyData))
         return false;
+
+#if PLATFORM(COCOA)
+    if (!hasProcessPrivilege(ProcessPrivilege::CanAccessCredentials))
+        return true;
+#endif
 
     SecKeyRef key = nullptr;