Changeset 184931 in webkit

Timestamp:

May 27, 2015 5:34:39 PM (9 years ago)

Author:

andersca@apple.com

Message:

Can't load local files in WKWebView from containerized app
​https://bugs.webkit.org/show_bug.cgi?id=145424
rdar://problem/20831176

Reviewed by Dan Bernstein.

Allow the network process to load local files from its bundle as long as it has
the sandbox extensions to do so.

This was originally added to only allow SSO to read the Info.plist inside its own application
bundle, but being able to read the application bundle from within the network process should be OK.

• Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb (modified) (1 diff)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2015-05-27  Anders Carlsson  <andersca@apple.com>
+
+        Can't load local files in WKWebView from containerized app
+        https://bugs.webkit.org/show_bug.cgi?id=145424
+        rdar://problem/20831176
+
+        Reviewed by Dan Bernstein.
+
+        Allow the network process to load local files from its bundle as long as it has
+        the sandbox extensions to do so.
+
+        This was originally added to only allow SSO to read the Info.plist inside its own application
+        bundle, but being able to read the application bundle from within the network process should be OK.
+
+        * Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:
+
 2015-05-27  Andreas Kling  <akling@apple.com>
 

trunk/Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb

@@ -43 +43 @@
 ;; enough access to make it possible.
 
-;; Disallow networking process from reading any bundles, even with the read extension
-(deny file-read*
-    (require-all
-        (subpath "/Applications")
-        (extension "com.apple.app-sandbox.read")))
-(deny file-read*
-    (require-all
-        (subpath "/private/var/mobile/Containers/Bundle/Application")
-        (extension "com.apple.app-sandbox.read")))
-
-;; Allow the networking process to read directories inside the bundle directories
-;; that we may have killed off above
-(allow file-read*
-    (require-all
-        (extension "com.apple.app-sandbox.read")
-        (vnode-type DIRECTORY)))
-
-;; Allow the networking process to read the Info.plist files
-(allow file-read*
-    (require-all
-        (extension "com.apple.app-sandbox.read")
-        (regex #"/Info\.plist$")))
-
 ;; IOKit user clients
 (allow iokit-open