⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 271469 in webkit


Ignore:
Timestamp:
Jan 13, 2021, 3:27:18 PM (6 years ago)
Author:
pvollan@apple.com
Message:

[Cocoa] Network extension sandbox extensions are sometimes issued too late
​https://bugs.webkit.org/show_bug.cgi?id=220525
<rdar://problem/68443565>

Reviewed by Brent Fulgham.

Currently, Network extension sandbox extensions are sent to the WebContent process as part of the load parameters, but this is too late in some cases.
In these cases, the extensions can be sent along with the DidReceivePolicyDecision message.

  • Shared/Cocoa/LoadParametersCocoa.mm:

(WebKit::LoadParameters::platformEncode const):
(WebKit::LoadParameters::platformDecode):

  • Shared/LoadParameters.h:
  • UIProcess/Cocoa/WebPageProxyCocoa.mm:

(WebKit::WebPageProxy::addPlatformLoadParameters):

  • UIProcess/WebPageProxy.cpp:

(WebKit::createNetworkExtensionsSandboxExtensions):
(WebKit::WebPageProxy::decidePolicyForNavigationActionAsyncShared):
(WebKit::WebPageProxy::decidePolicyForNewWindowAction):
(WebKit::WebPageProxy::decidePolicyForResponseShared):

  • WebProcess/WebPage/Cocoa/WebPageCocoa.mm:

(WebKit::WebPage::platformDidReceiveLoadParameters):

  • WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::didReceivePolicyDecision):

  • WebProcess/WebPage/WebPage.h:
  • WebProcess/WebPage/WebPage.messages.in:
Location:
trunk/Source/WebKit
Files:
10 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebKit/ChangeLog

    r271467 r271469  
     12021-01-13  Per Arne Vollan  <pvollan@apple.com>
     2
     3        [Cocoa] Network extension sandbox extensions are sometimes issued too late
     4        https://bugs.webkit.org/show_bug.cgi?id=220525
     5        <rdar://problem/68443565>
     6
     7        Reviewed by Brent Fulgham.
     8
     9        Currently, Network extension sandbox extensions are sent to the WebContent process as part of the load parameters, but this is too late in some cases.
     10        In these cases, the extensions can be sent along with the DidReceivePolicyDecision message.
     11
     12        * Shared/Cocoa/LoadParametersCocoa.mm:
     13        (WebKit::LoadParameters::platformEncode const):
     14        (WebKit::LoadParameters::platformDecode):
     15        * Shared/LoadParameters.h:
     16        * UIProcess/Cocoa/WebPageProxyCocoa.mm:
     17        (WebKit::WebPageProxy::addPlatformLoadParameters):
     18        * UIProcess/WebPageProxy.cpp:
     19        (WebKit::createNetworkExtensionsSandboxExtensions):
     20        (WebKit::WebPageProxy::decidePolicyForNavigationActionAsyncShared):
     21        (WebKit::WebPageProxy::decidePolicyForNewWindowAction):
     22        (WebKit::WebPageProxy::decidePolicyForResponseShared):
     23        * WebProcess/WebPage/Cocoa/WebPageCocoa.mm:
     24        (WebKit::WebPage::platformDidReceiveLoadParameters):
     25        * WebProcess/WebPage/WebPage.cpp:
     26        (WebKit::WebPage::didReceivePolicyDecision):
     27        * WebProcess/WebPage/WebPage.h:
     28        * WebProcess/WebPage/WebPage.messages.in:
     29
    1302021-01-13  Jiewen Tan  <jiewen_tan@apple.com>
    231

  • trunk/Source/WebKit/Shared/Cocoa/LoadParametersCocoa.mm

    r263313 r271469  
    3838    IPC::encode(encoder, dataDetectionContext.get());
    3939
    40     encoder << neHelperExtensionHandle;
    41     encoder << neSessionManagerExtensionHandle;
    4240#if PLATFORM(IOS)
    4341    encoder << contentFilterExtensionHandle;
    … …  
    5048    if (!IPC::decode(decoder, parameters.dataDetectionContext))
    5149        return false;
    52 
    53     Optional<Optional<SandboxExtension::Handle>> neHelperExtensionHandle;
    54     decoder >> neHelperExtensionHandle;
    55     if (!neHelperExtensionHandle)
    56         return false;
    57     parameters.neHelperExtensionHandle = WTFMove(*neHelperExtensionHandle);
    58 
    59     Optional<Optional<SandboxExtension::Handle>> neSessionManagerExtensionHandle;
    60     decoder >> neSessionManagerExtensionHandle;
    61     if (!neSessionManagerExtensionHandle)
    62         return false;
    63     parameters.neSessionManagerExtensionHandle = WTFMove(*neSessionManagerExtensionHandle);
    6450
    6551#if PLATFORM(IOS)

  • trunk/Source/WebKit/Shared/LoadParameters.h

    r263313 r271469  
    7575#if PLATFORM(COCOA)
    7676    RetainPtr<NSDictionary> dataDetectionContext;
    77     Optional<SandboxExtension::Handle> neHelperExtensionHandle;
    78     Optional<SandboxExtension::Handle> neSessionManagerExtensionHandle;
    7977#endif
    8078#if PLATFORM(IOS)

  • trunk/Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm

    r270362 r271469  
    155155    loadParameters.dataDetectionContext = m_uiClient->dataDetectionContext();
    156156
    157 #if ENABLE(CONTENT_FILTERING)
    158     if (!process.hasNetworkExtensionSandboxAccess() && NetworkExtensionContentFilter::isRequired()) {
    159         SandboxExtension::Handle helperHandle;
    160         SandboxExtension::createHandleForMachLookup("com.apple.nehelper"_s, WTF::nullopt, helperHandle);
    161         loadParameters.neHelperExtensionHandle = WTFMove(helperHandle);
    162         SandboxExtension::Handle managerHandle;
    163 #if PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED < 101500
    164         SandboxExtension::createHandleForMachLookup("com.apple.nesessionmanager"_s, WTF::nullopt, managerHandle);
    165 #else
    166         SandboxExtension::createHandleForMachLookup("com.apple.nesessionmanager.content-filter"_s, WTF::nullopt, managerHandle);
    167 #endif
    168         loadParameters.neSessionManagerExtensionHandle = WTFMove(managerHandle);
    169 
    170         process.markHasNetworkExtensionSandboxAccess();
    171     }
    172 #endif
    173 
    174157#if PLATFORM(IOS)
    175158    if (!process.hasManagedSessionSandboxAccess() && [getWebFilterEvaluatorClass() isManagedSession]) {
    … …  
    553536    send(Messages::WebPage::CreateAppHighlightInSelectedRange(createNewGroup));
    554537}
    555 
    556 #endif
     538#endif
     539
     540SandboxExtension::HandleArray WebPageProxy::createNetworkExtensionsSandboxExtensions(WebProcessProxy& process)
     541{
     542#if ENABLE(CONTENT_FILTERING)
     543    if (!process.hasNetworkExtensionSandboxAccess() && NetworkExtensionContentFilter::isRequired()) {
     544        process.markHasNetworkExtensionSandboxAccess();
     545        constexpr ASCIILiteral neHelperService { "com.apple.nehelper"_s };
     546#if PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED < 101500
     547        constexpr ASCIILiteral neSessionManagerService { "com.apple.nesessionmanager"_s };
     548#else
     549        constexpr ASCIILiteral neSessionManagerService { "com.apple.nesessionmanager.content-filter"_s };
     550#endif
     551        return SandboxExtension::createHandlesForMachLookup({ neHelperService, neSessionManagerService }, WTF::nullopt);
     552    }
     553#endif
     554    return SandboxExtension::HandleArray();
     555}
    557556
    558557} // namespace WebKit

  • trunk/Source/WebKit/UIProcess/WebPageProxy.cpp

    r271408 r271469  
    50285028
    50295029    auto sender = PolicyDecisionSender::create(identifier, [webPageID, frameID, listenerID, process] (const auto& policyDecision) {
    5030         process->send(Messages::WebPage::DidReceivePolicyDecision(frameID, listenerID, policyDecision), webPageID);
     5030        process->send(Messages::WebPage::DidReceivePolicyDecision(frameID, listenerID, policyDecision, createNetworkExtensionsSandboxExtensions(process)), webPageID);
    50315031    });
    50325032
    … …  
    53395339
    53405340        auto sender = PolicyDecisionSender::create(identifier, [this, protectedThis = WTFMove(protectedThis), frameID, listenerID] (const auto& policyDecision) {
    5341             send(Messages::WebPage::DidReceivePolicyDecision(frameID, listenerID, policyDecision));
     5341            send(Messages::WebPage::DidReceivePolicyDecision(frameID, listenerID, policyDecision, createNetworkExtensionsSandboxExtensions(m_process)));
    53425342        });
    53435343
    … …  
    53785378
    53795379        auto sender = PolicyDecisionSender::create(identifier, [webPageID, frameID, listenerID, process = WTFMove(process)] (const auto& policyDecision) {
    5380             process->send(Messages::WebPage::DidReceivePolicyDecision(frameID, listenerID, policyDecision), webPageID);
     5380            process->send(Messages::WebPage::DidReceivePolicyDecision(frameID, listenerID, policyDecision, createNetworkExtensionsSandboxExtensions(process)), webPageID);
    53815381        });
    53825382       
    … …  
    1034010340#endif
    1034110341
     10342#if !PLATFORM(COCOA)
     10343SandboxExtension::HandleArray WebPageProxy::createNetworkExtensionsSandboxExtensions(WebProcessProxy& process)
     10344{
     10345    return SandboxExtension::HandleArray();
     10346}
     10347#endif
     10348
    1034210349} // namespace WebKit
    1034310350

  • trunk/Source/WebKit/UIProcess/WebPageProxy.h

    r271381 r271469  
    23712371#endif
    23722372
     2373    static SandboxExtension::HandleArray createNetworkExtensionsSandboxExtensions(WebProcessProxy&);
     2374
    23732375    const Identifier m_identifier;
    23742376    WebCore::PageIdentifier m_webPageID;

  • trunk/Source/WebKit/WebProcess/WebPage/Cocoa/WebPageCocoa.mm

    r269173 r271469  
    8282    m_dataDetectionContext = parameters.dataDetectionContext;
    8383
    84 #if ENABLE(CONTENT_FILTERING)
    85     if (parameters.neHelperExtensionHandle)
    86         SandboxExtension::consumePermanently(*parameters.neHelperExtensionHandle);
    87     if (parameters.neSessionManagerExtensionHandle)
    88         SandboxExtension::consumePermanently(*parameters.neSessionManagerExtensionHandle);
    89     NetworkExtensionContentFilter::setHasConsumedSandboxExtensions(parameters.neHelperExtensionHandle.hasValue() && parameters.neSessionManagerExtensionHandle.hasValue());
    90 #endif
    91 
    9284#if PLATFORM(IOS)
    9385    if (parameters.contentFilterExtensionHandle)
    … …  
    415407}
    416408
     409void WebPage::consumeNetworkExtensionSandboxExtensions(const SandboxExtension::HandleArray& networkExtensionsHandles)
     410{
     411#if ENABLE(CONTENT_FILTERING)
     412    SandboxExtension::consumePermanently(networkExtensionsHandles);
     413    NetworkExtensionContentFilter::setHasConsumedSandboxExtensions(networkExtensionsHandles.size());
     414#else
     415    UNUSED_PARAM(networkExtensionsHandles);
     416#endif
     417}
     418
    417419} // namespace WebKit
    418420

  • trunk/Source/WebKit/WebProcess/WebPage/WebPage.cpp

    r271378 r271469  
    33643364}
    33653365
    3366 void WebPage::didReceivePolicyDecision(FrameIdentifier frameID, uint64_t listenerID, PolicyDecision&& policyDecision)
    3367 {
     3366void WebPage::didReceivePolicyDecision(FrameIdentifier frameID, uint64_t listenerID, PolicyDecision&& policyDecision, const SandboxExtension::HandleArray& networkExtensionsHandles)
     3367{
     3368    consumeNetworkExtensionSandboxExtensions(networkExtensionsHandles);
     3369
    33683370    WebFrame* frame = WebProcess::singleton().webFrame(frameID);
    33693371    RELEASE_LOG_IF_ALLOWED(Loading, "didReceivePolicyDecision: policyAction: %u - frameID: %llu - webFrame: %p - mainFrame: %d", (unsigned)policyDecision.policyAction, frameID.toUInt64(), frame, frame ? frame->isMainFrame() : 0);
    … …  
    71507152#endif
    71517153
     7154#if !PLATFORM(COCOA)
     7155void WebPage::consumeNetworkExtensionSandboxExtensions(const SandboxExtension::HandleArray&)
     7156{
     7157}
     7158#endif
    71527159
    71537160} // namespace WebKit

  • trunk/Source/WebKit/WebProcess/WebPage/WebPage.h

    r271386 r271469  
    15851585#endif
    15861586
    1587     void didReceivePolicyDecision(WebCore::FrameIdentifier, uint64_t listenerID, PolicyDecision&&);
     1587    void didReceivePolicyDecision(WebCore::FrameIdentifier, uint64_t listenerID, PolicyDecision&&, const SandboxExtension::HandleArray&);
    15881588    void continueWillSubmitForm(WebCore::FrameIdentifier, uint64_t listenerID);
    15891589    void setUserAgent(const String&);
    … …  
    18021802    void setSelectionRange(const WebCore::IntPoint&, WebCore::TextGranularity, bool);
    18031803   
     1804    void consumeNetworkExtensionSandboxExtensions(const SandboxExtension::HandleArray&);
     1805
    18041806    WebCore::PageIdentifier m_identifier;
    18051807

  • trunk/Source/WebKit/WebProcess/WebPage/WebPage.messages.in

    r271378 r271469  
    197197    UpdateWebsitePolicies(struct WebKit::WebsitePoliciesData websitePolicies)
    198198    NotifyUserScripts()
    199     DidReceivePolicyDecision(WebCore::FrameIdentifier frameID, uint64_t listenerID, struct WebKit::PolicyDecision policyDecision)
     199    DidReceivePolicyDecision(WebCore::FrameIdentifier frameID, uint64_t listenerID, struct WebKit::PolicyDecision policyDecision, WebKit::SandboxExtension::HandleArray networkExtensionsSandboxExtensions)
    200200
    201201    ContinueWillSubmitForm(WebCore::FrameIdentifier frameID, uint64_t listenerID)
Note: See TracChangeset for help on using the changeset viewer.