Changeset 244670 in webkit

Timestamp:

Apr 25, 2019 5:17:23 PM (5 years ago)

Author:

Chris Dumez

Message:

Trying to load a main resource outside the sandbox should not crash the WebContent process
​https://bugs.webkit.org/show_bug.cgi?id=197299
<rdar://problem/49808042>

Reviewed by Geoffrey Garen.

Trying to load a main resource outside the sandbox should not crash the WebContent process. We should
simply ignore the load and log an error message.

• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::decidePolicyForNavigationAction):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/WebPageProxy.cpp (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-04-25  Chris Dumez  <cdumez@apple.com>
+
+        Trying to load a main resource outside the sandbox should not crash the WebContent process
+        https://bugs.webkit.org/show_bug.cgi?id=197299
+        <rdar://problem/49808042>
+
+        Reviewed by Geoffrey Garen.
+
+        Trying to load a main resource outside the sandbox should not crash the WebContent process. We should
+        simply ignore the load and log an error message.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::decidePolicyForNavigationAction):
+
 2019-04-25  Timothy Hatcher  <timothy@apple.com>
 

trunk/Source/WebKit/UIProcess/WebPageProxy.cpp

@@ -4542 +4542 @@
         m_pageLoadState.clearPendingAPIRequestURL(transaction);
 
-    MESSAGE_CHECK_URL(process, request.url());
+    if (!checkURLReceivedFromCurrentOrPreviousWebProcess(process, request.url())) {
+        RELEASE_LOG_ERROR_IF_ALLOWED(Process, "Ignoring request to load this main resource because it is outside the sandbox");
+        sender->send(PolicyAction::Ignore, 0, DownloadID(), WTF::nullopt);
+        return;
+    }
+
     MESSAGE_CHECK_URL(process, originalRequest.url());