218756 2020-11-10 08:50:58 -0800 [macOS] Enforce message filtering in the WebContent process 2020-11-10 17:04:28 -0800 1 1 1 Unclassified WebKit WebKit Misc. WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 pvollan webkit-unassigned bfulgham ddkilzer webkit-bug-importer oldest_to_newest 1706090 0 pvollan 2020-11-10 08:50:58 -0800 Based on telemetry, we should deny access to messages not being used in the WebContent process on macOS. 1706091 1 webkit-bug-importer 2020-11-10 08:51:19 -0800 <rdar://problem/71240766> 1706096 2 413703 pvollan 2020-11-10 09:02:39 -0800 Created attachment 413703 Patch 1706098 3 413705 pvollan 2020-11-10 09:03:59 -0800 Created attachment 413705 Patch 1706250 4 413705 ddkilzer 2020-11-10 15:27:38 -0800 Comment on attachment 413705 Patch r=me 1706292 5 413705 pvollan 2020-11-10 16:48:45 -0800 Comment on attachment 413705 Patch Thanks for reviewing! 1706297 6 ews-feeder 2020-11-10 17:04:27 -0800 Committed r269666: <https://trac.webkit.org/changeset/269666> All reviewed patches have been landed. Closing bug and clearing flags on attachment 413705. 413703 2020-11-10 09:02:39 -0800 2020-11-10 09:03:35 -0800 Patch 218756.patch text/plain 4079 pvollan SW5kZXg6IFNvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJL aXQvQ2hhbmdlTG9nCShyZXZpc2lvbiAyNjk2MjgpCisrKyBTb3VyY2UvV2ViS2l0L0NoYW5nZUxv Zwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI0IEBACisyMDIwLTExLTEwICBQZXIgQXJuZSBW b2xsYW4gIDxwdm9sbGFuQGFwcGxlLmNvbT4KKworICAgICAgICBbbWFjT1NdIEVuZm9yY2UgbWVz c2FnZSBmaWx0ZXJpbmcgaW4gdGhlIFdlYkNvbnRlbnQgcHJvY2VzcworICAgICAgICBodHRwczov L2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjE4NzU2CisgICAgICAgIDxyZGFyOi8v cHJvYmxlbS83MTI0MDc2Nj4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4K KworICAgICAgICBCYXNlZCBvbiB0ZWxlbWV0cnksIHdlIHNob3VsZCBkZW55IGFjY2VzcyB0byBt ZXNzYWdlcyBub3QgYmVpbmcgdXNlZCBpbiB0aGUgV2ViQ29udGVudCBwcm9jZXNzIG9uIG1hY09T LgorCisgICAgICAgIE5vIG5ldyB0ZXN0cywgY292ZXJlZCBieSBleGlzdGluZyB0ZXN0cy4KKwor ICAgICAgICAqIFNoYXJlZC9FbnRyeVBvaW50VXRpbGl0aWVzL0NvY29hL1hQQ1NlcnZpY2UvWFBD U2VydmljZUVudHJ5UG9pbnQubW06CisgICAgICAgIChXZWJLaXQ6OlhQQ1NlcnZpY2VJbml0aWFs aXplckRlbGVnYXRlOjpnZXRFeHRyYUluaXRpYWxpemF0aW9uRGF0YSk6CisgICAgICAgICogU2hh cmVkL21hYy9BdXhpbGlhcnlQcm9jZXNzTWFjLm1tOgorICAgICAgICAoV2ViS2l0OjpzYW5kYm94 RGF0YVZhdWx0UGFyZW50RGlyZWN0b3J5KToKKyAgICAgICAgKFdlYktpdDo6aW5pdGlhbGl6ZVNh bmRib3hQYXJhbWV0ZXJzKToKKyAgICAgICAgKiBVSVByb2Nlc3MvQXV4aWxpYXJ5UHJvY2Vzc1By b3h5LmNwcDoKKyAgICAgICAgKFdlYktpdDo6QXV4aWxpYXJ5UHJvY2Vzc1Byb3h5OjpnZXRMYXVu Y2hPcHRpb25zKToKKyAgICAgICAgKiBXZWJQcm9jZXNzL2NvbS5hcHBsZS5XZWJQcm9jZXNzLnNi LmluOgorCiAyMDIwLTExLTEwICBDYXJsb3MgR2FyY2lhIENhbXBvcyAgPGNnYXJjaWFAaWdhbGlh LmNvbT4KIAogICAgICAgICBbR1RLNF0gV2ViVmlldyBpcyBmbGlwcGVkCkluZGV4OiBTb3VyY2Uv V2ViS2l0L1dlYlByb2Nlc3MvY29tLmFwcGxlLldlYlByb2Nlc3Muc2IuaW4KPT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot LS0gU291cmNlL1dlYktpdC9XZWJQcm9jZXNzL2NvbS5hcHBsZS5XZWJQcm9jZXNzLnNiLmluCShy ZXZpc2lvbiAyNjk1OTYpCisrKyBTb3VyY2UvV2ViS2l0L1dlYlByb2Nlc3MvY29tLmFwcGxlLldl YlByb2Nlc3Muc2IuaW4JKHdvcmtpbmcgY29weSkKQEAgLTE0MjksMTEgKzE0MjksMTIgQEAKICh3 aGVuIChkZWZpbmVkPyAnbWFjaC1ib290c3RyYXApCiAgICAgKGFsbG93IG1hY2gtYm9vdHN0cmFw CiAgICAgICAgIChhcHBseS1tZXNzYWdlLWZpbHRlcgotICAgICAgICAgICAgKGFsbG93IHhwYy1t ZXNzYWdlLXNlbmQgKHdpdGggdGVsZW1ldHJ5KSkKKyAgICAgICAgICAgIChkZW55IHhwYy1tZXNz YWdlLXNlbmQgKHdpdGggdGVsZW1ldHJ5KSkKICAgICAgICAgICAgIChhbGxvdyB4cGMtbWVzc2Fn ZS1zZW5kIChtZXNzYWdlLW51bWJlcgogICAgICAgICAgICAgICAgIDIwNAogICAgICAgICAgICAg ICAgIDIwNwogICAgICAgICAgICAgICAgIDMwMQorICAgICAgICAgICAgICAgIDcxMQogICAgICAg ICAgICAgICAgIDgwMAogICAgICAgICAgICAgICAgIDgwNAogICAgICAgICAgICAgICAgICkKQEAg LTE0NDUsOSArMTQ0NiwxMCBAQAogKHdoZW4gKGRlZmluZWQ/ICdtYWNoLWtlcm5lbC1lbmRwb2lu dCkKICAgICAoYWxsb3cgbWFjaC1rZXJuZWwtZW5kcG9pbnQKICAgICAgICAgKGFwcGx5LW1lc3Nh Z2UtZmlsdGVyCi0gICAgICAgICAgICAoYWxsb3cgbWFjaC1tZXNzYWdlLXNlbmQgKHdpdGggdGVs ZW1ldHJ5KSkKKyAgICAgICAgICAgIChkZW55IG1hY2gtbWVzc2FnZS1zZW5kICh3aXRoIHRlbGVt ZXRyeSkpCiAgICAgICAgICAgICAoYWxsb3cgbWFjaC1tZXNzYWdlLXNlbmQgKGtlcm5lbC1taWct cm91dGluZQogICAgICAgICAgICAgICAgIF9tYWNoX21ha2VfbWVtb3J5X2VudHJ5CisgICAgICAg ICAgICAgICAgY2xvY2tfZ2V0X3RpbWUKICAgICAgICAgICAgICAgICBob3N0X2dldF9pb19tYXN0 ZXIKICAgICAgICAgICAgICAgICBob3N0X2luZm8KICAgICAgICAgICAgICAgICBob3N0X3JlcXVl c3Rfbm90aWZpY2F0aW9uCkBAIC0xNDc5LDYgKzE0ODEsNyBAQAogICAgICAgICAgICAgICAgIGlv X3NlcnZpY2VfZ2V0X21hdGNoaW5nX3NlcnZpY2VzX2JpbgogICAgICAgICAgICAgICAgIGlvX3Nl cnZpY2Vfb3Blbl9leHRlbmRlZAogICAgICAgICAgICAgICAgIG1hY2hfcG9ydF9nZXRfcmVmcwor ICAgICAgICAgICAgICAgIG1hY2hfcG9ydF9yZXF1ZXN0X25vdGlmaWNhdGlvbgogICAgICAgICAg ICAgICAgIG1hY2hfcG9ydF9zZXRfYXR0cmlidXRlcwogICAgICAgICAgICAgICAgIG1hY2hfdm1f Y29weQogICAgICAgICAgICAgICAgIG1hY2hfdm1fbWFwX2V4dGVybmFsCkBAIC0xNTA0LDEyICsx NTA3LDE0IEBACiApCiAKICh3aGVuIChkZWZpbmVkPyAnc3lzY2FsbC1tYWNoKQotICAgIChhbGxv dyBzeXNjYWxsLW1hY2ggKHdpdGggdGVsZW1ldHJ5KSkKKyAgICAoZGVueSBzeXNjYWxsLW1hY2gg KHdpdGggdGVsZW1ldHJ5KSkKICAgICAoYWxsb3cgc3lzY2FsbC1tYWNoIChtYWNodHJhcC1udW1i ZXIKKyAgICAgICAgTVNDX19rZXJuZWxycGNfbWFjaF9wb3J0X2FsbG9jYXRlX3RyYXAKICAgICAg ICAgTVNDX19rZXJuZWxycGNfbWFjaF9wb3J0X2NvbnN0cnVjdF90cmFwCiAgICAgICAgIE1TQ19f a2VybmVscnBjX21hY2hfcG9ydF9kZWFsbG9jYXRlX3RyYXAKICAgICAgICAgTVNDX19rZXJuZWxy cGNfbWFjaF9wb3J0X2Rlc3RydWN0X3RyYXAKICAgICAgICAgTVNDX19rZXJuZWxycGNfbWFjaF9w b3J0X2V4dHJhY3RfbWVtYmVyX3RyYXAKKyAgICAgICAgTVNDX19rZXJuZWxycGNfbWFjaF9wb3J0 X2dldF9hdHRyaWJ1dGVzX3RyYXAKICAgICAgICAgTVNDX19rZXJuZWxycGNfbWFjaF9wb3J0X2d1 YXJkX3RyYXAKICAgICAgICAgTVNDX19rZXJuZWxycGNfbWFjaF9wb3J0X2luc2VydF9tZW1iZXJf dHJhcAogICAgICAgICBNU0NfX2tlcm5lbHJwY19tYWNoX3BvcnRfaW5zZXJ0X3JpZ2h0X3RyYXAK QEAgLTE1MTYsNiArMTUyMSw3IEBACiAgICAgICAgIE1TQ19fa2VybmVscnBjX21hY2hfcG9ydF9t b2RfcmVmc190cmFwCiAgICAgICAgIE1TQ19fa2VybmVscnBjX21hY2hfcG9ydF9yZXF1ZXN0X25v dGlmaWNhdGlvbl90cmFwCiAgICAgICAgIE1TQ19fa2VybmVscnBjX21hY2hfcG9ydF90eXBlX3Ry YXAKKyAgICAgICAgTVNDX19rZXJuZWxycGNfbWFjaF9wb3J0X3VuZ3VhcmRfdHJhcAogICAgICAg ICBNU0NfX2tlcm5lbHJwY19tYWNoX3ZtX2FsbG9jYXRlX3RyYXAKICAgICAgICAgTVNDX19rZXJu ZWxycGNfbWFjaF92bV9kZWFsbG9jYXRlX3RyYXAKICAgICAgICAgTVNDX19rZXJuZWxycGNfbWFj aF92bV9tYXBfdHJhcApAQCAtMTUzMCw2ICsxNTM2LDcgQEAKICAgICAgICAgTVNDX21rX3RpbWVy X2FybQogICAgICAgICBNU0NfbWtfdGltZXJfY2FuY2VsCiAgICAgICAgIE1TQ19ta190aW1lcl9j cmVhdGUKKyAgICAgICAgTVNDX21rX3RpbWVyX2Rlc3Ryb3kKICAgICAgICAgTVNDX3BpZF9mb3Jf dGFzawogICAgICAgICBNU0Nfc2VtYXBob3JlX3NpZ25hbF90cmFwCiAgICAgICAgIE1TQ19zZW1h cGhvcmVfdGltZWR3YWl0X3RyYXAKQEAgLTE1MzcsNiArMTU0NCw3IEBACiAgICAgICAgIE1TQ19z eXNjYWxsX3RocmVhZF9zd2l0Y2gKICAgICAgICAgTVNDX3Rhc2tfbmFtZV9mb3JfcGlkCiAgICAg ICAgIE1TQ190aHJlYWRfZ2V0X3NwZWNpYWxfcmVwbHlfcG9ydAorICAgICAgICBNU0NfdGhyZWFk X3NlbGZfdHJhcAogICAgICAgICApCiAgICAgKQogKQo= 413705 2020-11-10 09:03:59 -0800 2020-11-10 17:04:27 -0800 Patch 218756.patch text/plain 3667 pvollan SW5kZXg6IFNvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJL aXQvQ2hhbmdlTG9nCShyZXZpc2lvbiAyNjk2MjgpCisrKyBTb3VyY2UvV2ViS2l0L0NoYW5nZUxv Zwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE3IEBACisyMDIwLTExLTEwICBQZXIgQXJuZSBW b2xsYW4gIDxwdm9sbGFuQGFwcGxlLmNvbT4KKworICAgICAgICBbbWFjT1NdIEVuZm9yY2UgbWVz c2FnZSBmaWx0ZXJpbmcgaW4gdGhlIFdlYkNvbnRlbnQgcHJvY2VzcworICAgICAgICBodHRwczov L2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjE4NzU2CisgICAgICAgIDxyZGFyOi8v cHJvYmxlbS83MTI0MDc2Nj4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4K KworICAgICAgICBCYXNlZCBvbiB0ZWxlbWV0cnksIHdlIHNob3VsZCBkZW55IGFjY2VzcyB0byBt ZXNzYWdlcyBub3QgYmVpbmcgdXNlZCBpbiB0aGUgV2ViQ29udGVudCBwcm9jZXNzIG9uIG1hY09T LgorCisgICAgICAgIE5vIG5ldyB0ZXN0cywgY292ZXJlZCBieSBleGlzdGluZyB0ZXN0cy4KKwor ICAgICAgICAqIFdlYlByb2Nlc3MvY29tLmFwcGxlLldlYlByb2Nlc3Muc2IuaW46CisKIDIwMjAt MTEtMTAgIENhcmxvcyBHYXJjaWEgQ2FtcG9zICA8Y2dhcmNpYUBpZ2FsaWEuY29tPgogCiAgICAg ICAgIFtHVEs0XSBXZWJWaWV3IGlzIGZsaXBwZWQKSW5kZXg6IFNvdXJjZS9XZWJLaXQvV2ViUHJv Y2Vzcy9jb20uYXBwbGUuV2ViUHJvY2Vzcy5zYi5pbgo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi S2l0L1dlYlByb2Nlc3MvY29tLmFwcGxlLldlYlByb2Nlc3Muc2IuaW4JKHJldmlzaW9uIDI2OTU5 NikKKysrIFNvdXJjZS9XZWJLaXQvV2ViUHJvY2Vzcy9jb20uYXBwbGUuV2ViUHJvY2Vzcy5zYi5p bgkod29ya2luZyBjb3B5KQpAQCAtMTQyOSwxMSArMTQyOSwxMiBAQAogKHdoZW4gKGRlZmluZWQ/ ICdtYWNoLWJvb3RzdHJhcCkKICAgICAoYWxsb3cgbWFjaC1ib290c3RyYXAKICAgICAgICAgKGFw cGx5LW1lc3NhZ2UtZmlsdGVyCi0gICAgICAgICAgICAoYWxsb3cgeHBjLW1lc3NhZ2Utc2VuZCAo d2l0aCB0ZWxlbWV0cnkpKQorICAgICAgICAgICAgKGRlbnkgeHBjLW1lc3NhZ2Utc2VuZCAod2l0 aCB0ZWxlbWV0cnkpKQogICAgICAgICAgICAgKGFsbG93IHhwYy1tZXNzYWdlLXNlbmQgKG1lc3Nh Z2UtbnVtYmVyCiAgICAgICAgICAgICAgICAgMjA0CiAgICAgICAgICAgICAgICAgMjA3CiAgICAg ICAgICAgICAgICAgMzAxCisgICAgICAgICAgICAgICAgNzExCiAgICAgICAgICAgICAgICAgODAw CiAgICAgICAgICAgICAgICAgODA0CiAgICAgICAgICAgICAgICAgKQpAQCAtMTQ0NSw5ICsxNDQ2 LDEwIEBACiAod2hlbiAoZGVmaW5lZD8gJ21hY2gta2VybmVsLWVuZHBvaW50KQogICAgIChhbGxv dyBtYWNoLWtlcm5lbC1lbmRwb2ludAogICAgICAgICAoYXBwbHktbWVzc2FnZS1maWx0ZXIKLSAg ICAgICAgICAgIChhbGxvdyBtYWNoLW1lc3NhZ2Utc2VuZCAod2l0aCB0ZWxlbWV0cnkpKQorICAg ICAgICAgICAgKGRlbnkgbWFjaC1tZXNzYWdlLXNlbmQgKHdpdGggdGVsZW1ldHJ5KSkKICAgICAg ICAgICAgIChhbGxvdyBtYWNoLW1lc3NhZ2Utc2VuZCAoa2VybmVsLW1pZy1yb3V0aW5lCiAgICAg ICAgICAgICAgICAgX21hY2hfbWFrZV9tZW1vcnlfZW50cnkKKyAgICAgICAgICAgICAgICBjbG9j a19nZXRfdGltZQogICAgICAgICAgICAgICAgIGhvc3RfZ2V0X2lvX21hc3RlcgogICAgICAgICAg ICAgICAgIGhvc3RfaW5mbwogICAgICAgICAgICAgICAgIGhvc3RfcmVxdWVzdF9ub3RpZmljYXRp b24KQEAgLTE0NzksNiArMTQ4MSw3IEBACiAgICAgICAgICAgICAgICAgaW9fc2VydmljZV9nZXRf bWF0Y2hpbmdfc2VydmljZXNfYmluCiAgICAgICAgICAgICAgICAgaW9fc2VydmljZV9vcGVuX2V4 dGVuZGVkCiAgICAgICAgICAgICAgICAgbWFjaF9wb3J0X2dldF9yZWZzCisgICAgICAgICAgICAg ICAgbWFjaF9wb3J0X3JlcXVlc3Rfbm90aWZpY2F0aW9uCiAgICAgICAgICAgICAgICAgbWFjaF9w b3J0X3NldF9hdHRyaWJ1dGVzCiAgICAgICAgICAgICAgICAgbWFjaF92bV9jb3B5CiAgICAgICAg ICAgICAgICAgbWFjaF92bV9tYXBfZXh0ZXJuYWwKQEAgLTE1MDQsMTIgKzE1MDcsMTQgQEAKICkK IAogKHdoZW4gKGRlZmluZWQ/ICdzeXNjYWxsLW1hY2gpCi0gICAgKGFsbG93IHN5c2NhbGwtbWFj aCAod2l0aCB0ZWxlbWV0cnkpKQorICAgIChkZW55IHN5c2NhbGwtbWFjaCAod2l0aCB0ZWxlbWV0 cnkpKQogICAgIChhbGxvdyBzeXNjYWxsLW1hY2ggKG1hY2h0cmFwLW51bWJlcgorICAgICAgICBN U0NfX2tlcm5lbHJwY19tYWNoX3BvcnRfYWxsb2NhdGVfdHJhcAogICAgICAgICBNU0NfX2tlcm5l bHJwY19tYWNoX3BvcnRfY29uc3RydWN0X3RyYXAKICAgICAgICAgTVNDX19rZXJuZWxycGNfbWFj aF9wb3J0X2RlYWxsb2NhdGVfdHJhcAogICAgICAgICBNU0NfX2tlcm5lbHJwY19tYWNoX3BvcnRf ZGVzdHJ1Y3RfdHJhcAogICAgICAgICBNU0NfX2tlcm5lbHJwY19tYWNoX3BvcnRfZXh0cmFjdF9t ZW1iZXJfdHJhcAorICAgICAgICBNU0NfX2tlcm5lbHJwY19tYWNoX3BvcnRfZ2V0X2F0dHJpYnV0 ZXNfdHJhcAogICAgICAgICBNU0NfX2tlcm5lbHJwY19tYWNoX3BvcnRfZ3VhcmRfdHJhcAogICAg ICAgICBNU0NfX2tlcm5lbHJwY19tYWNoX3BvcnRfaW5zZXJ0X21lbWJlcl90cmFwCiAgICAgICAg IE1TQ19fa2VybmVscnBjX21hY2hfcG9ydF9pbnNlcnRfcmlnaHRfdHJhcApAQCAtMTUxNiw2ICsx NTIxLDcgQEAKICAgICAgICAgTVNDX19rZXJuZWxycGNfbWFjaF9wb3J0X21vZF9yZWZzX3RyYXAK ICAgICAgICAgTVNDX19rZXJuZWxycGNfbWFjaF9wb3J0X3JlcXVlc3Rfbm90aWZpY2F0aW9uX3Ry YXAKICAgICAgICAgTVNDX19rZXJuZWxycGNfbWFjaF9wb3J0X3R5cGVfdHJhcAorICAgICAgICBN U0NfX2tlcm5lbHJwY19tYWNoX3BvcnRfdW5ndWFyZF90cmFwCiAgICAgICAgIE1TQ19fa2VybmVs cnBjX21hY2hfdm1fYWxsb2NhdGVfdHJhcAogICAgICAgICBNU0NfX2tlcm5lbHJwY19tYWNoX3Zt X2RlYWxsb2NhdGVfdHJhcAogICAgICAgICBNU0NfX2tlcm5lbHJwY19tYWNoX3ZtX21hcF90cmFw CkBAIC0xNTMwLDYgKzE1MzYsNyBAQAogICAgICAgICBNU0NfbWtfdGltZXJfYXJtCiAgICAgICAg IE1TQ19ta190aW1lcl9jYW5jZWwKICAgICAgICAgTVNDX21rX3RpbWVyX2NyZWF0ZQorICAgICAg ICBNU0NfbWtfdGltZXJfZGVzdHJveQogICAgICAgICBNU0NfcGlkX2Zvcl90YXNrCiAgICAgICAg IE1TQ19zZW1hcGhvcmVfc2lnbmFsX3RyYXAKICAgICAgICAgTVNDX3NlbWFwaG9yZV90aW1lZHdh aXRfdHJhcApAQCAtMTUzNyw2ICsxNTQ0LDcgQEAKICAgICAgICAgTVNDX3N5c2NhbGxfdGhyZWFk X3N3aXRjaAogICAgICAgICBNU0NfdGFza19uYW1lX2Zvcl9waWQKICAgICAgICAgTVNDX3RocmVh ZF9nZXRfc3BlY2lhbF9yZXBseV9wb3J0CisgICAgICAgIE1TQ190aHJlYWRfc2VsZl90cmFwCiAg ICAgICAgICkKICAgICApCiApCg==