Changeset 284819 in webkit


Ignore:
Timestamp:
Oct 25, 2021, 1:24:45 PM (4 years ago)
Author:
Kate Cheney
Message:

[App Privacy Report] CORS preflight requests attributed incorrectly
​https://bugs.webkit.org/show_bug.cgi?id=232221
<rdar://problem/84116159>

Reviewed by Brent Fulgham.

Source/WebKit:

HTTP redirects should already be marked as app-initiated or not based
on the NSURLRequest that initiated the redirect, either because the
same NSURLRequest is used or because it is set in the completion
handler of the networkDataTask->willPerformHTTPRedirection call in
NetworkSessionCocoa.

However, checking the request before calling the completion handler
can initiate CORS preflight checks that create loads that are incorrectly
marked for App Privacy Report. This patch sets the app initiated value
in the ResourceRequest object before the new NetworkDataTask is created to fix this.

  • NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:

(WebKit::NetworkDataTaskCocoa::willPerformHTTPRedirection):

LayoutTests:

Layout test coverage.

  • http/tests/app-privacy-report/app-attribution-cors-preflight-redirect-expected.txt: Added.
  • http/tests/app-privacy-report/app-attribution-cors-preflight-redirect.html: Added.
  • http/tests/app-privacy-report/resources/cors-preflight.py: Added.
  • http/tests/app-privacy-report/resources/redirect-with-cors-preflight-check.py: Added.
  • http/tests/app-privacy-report/user-attribution-cors-preflight-redirect-expected.txt: Added.
  • http/tests/app-privacy-report/user-attribution-cors-preflight-redirect.html: Added.
Location:
trunk
Files:
6 added
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r284818 r284819  
     12021-10-25  Kate Cheney  <katherine_cheney@apple.com>
     2
     3        [App Privacy Report] CORS preflight requests attributed incorrectly
     4        https://bugs.webkit.org/show_bug.cgi?id=232221
     5        <rdar://problem/84116159>
     6
     7        Reviewed by Brent Fulgham.
     8
     9        Layout test coverage.
     10
     11        * http/tests/app-privacy-report/app-attribution-cors-preflight-redirect-expected.txt: Added.
     12        * http/tests/app-privacy-report/app-attribution-cors-preflight-redirect.html: Added.
     13        * http/tests/app-privacy-report/resources/cors-preflight.py: Added.
     14        * http/tests/app-privacy-report/resources/redirect-with-cors-preflight-check.py: Added.
     15        * http/tests/app-privacy-report/user-attribution-cors-preflight-redirect-expected.txt: Added.
     16        * http/tests/app-privacy-report/user-attribution-cors-preflight-redirect.html: Added.
     17
    1182021-10-25  Chris Dumez  <cdumez@apple.com>
    219

  • trunk/Source/WebKit/ChangeLog

    r284786 r284819  
     12021-10-25  Kate Cheney  <katherine_cheney@apple.com>
     2
     3        [App Privacy Report] CORS preflight requests attributed incorrectly
     4        https://bugs.webkit.org/show_bug.cgi?id=232221
     5        <rdar://problem/84116159>
     6
     7        Reviewed by Brent Fulgham.
     8
     9        HTTP redirects should already be marked as app-initiated or not based
     10        on the NSURLRequest that initiated the redirect, either because the
     11        same NSURLRequest is used or because it is set in the completion
     12        handler of the networkDataTask->willPerformHTTPRedirection call in
     13        NetworkSessionCocoa.
     14
     15        However, checking the request before calling the completion handler
     16        can initiate CORS preflight checks that create loads that are incorrectly
     17        marked for App Privacy Report. This patch sets the app initiated value
     18        in the ResourceRequest object before the new NetworkDataTask is created to fix this.
     19
     20        * NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:
     21        (WebKit::NetworkDataTaskCocoa::willPerformHTTPRedirection):
     22
    1232021-10-25  Wenson Hsieh  <wenson_hsieh@apple.com>
    224

  • trunk/Source/WebKit/NetworkProcess/cocoa/NetworkDataTaskCocoa.mm

    r284483 r284819  
    520520        request.setFirstPartyForCookies(request.url());
    521521
     522#if ENABLE(APP_PRIVACY_REPORT)
     523    request.setIsAppInitiated(request.nsURLRequest(WebCore::HTTPBodyUpdatePolicy::DoNotUpdateHTTPBody).attribution == NSURLRequestAttributionDeveloper);
     524#endif
     525
    522526#if ENABLE(INTELLIGENT_TRACKING_PREVENTION)
    523527#if HAVE(CFNETWORK_CNAME_AND_COOKIE_TRANSFORM_SPI)
Note: See TracChangeset for help on using the changeset viewer.