Bug 209339

Summary:

[Cocoa] Deny access to database mapping service

Product:

WebKit

Reporter:

Per Arne Vollan <pvollan>

Component:

WebKit Misc.

Assignee:

Per Arne Vollan <pvollan>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

benjamin, bfulgham, cdumez, cmarcelo, commit-queue, ews-watchlist, jacob_uphoff, simon.fraser, webkit-bug-importer

Priority:

Keywords:

InRadar

Version:

WebKit Nightly Build

Hardware:

Unspecified

OS:

Unspecified

Bug Depends on:

209459

Bug Blocks:

Attachments:

Description	Flags
Patch	none
Patch	none
Patch	none
Patch	none
Patch	none
Patch	none
Patch	none

Per Arne Vollan

Reported 2020-03-20 08:34:36 PDT

On macOS and iOS, the WebContent process should not have access to "com.apple.lsd.mapdb".

Attachments
Patch (10.55 KB, patch) 2020-03-20 08:53 PDT, Per Arne Vollan	no flags	Details Formatted Diff Diff
Patch (10.87 KB, patch) 2020-03-20 09:17 PDT, Per Arne Vollan	no flags	Details Formatted Diff Diff
Patch (11.32 KB, patch) 2020-03-20 13:15 PDT, Per Arne Vollan	no flags	Details Formatted Diff Diff
Patch (11.34 KB, patch) 2020-03-23 12:50 PDT, Per Arne Vollan	no flags	Details Formatted Diff Diff
Patch (11.39 KB, patch) 2020-03-23 13:52 PDT, Per Arne Vollan	no flags	Details Formatted Diff Diff
Patch (11.34 KB, patch) 2020-03-23 15:55 PDT, Per Arne Vollan	no flags	Details Formatted Diff Diff
Patch (11.01 KB, patch) 2020-03-24 09:31 PDT, Per Arne Vollan	no flags	Details Formatted Diff Diff
Show Obsolete (5) View All Add attachment proposed patch, testcase, etc.

Per Arne Vollan

Comment 1 2020-03-20 08:35:48 PDT

rdar://problem/56966010

Per Arne Vollan

Comment 2 2020-03-20 08:53:41 PDT

Created attachment 394086 [details] Patch

Per Arne Vollan

Comment 3 2020-03-20 09:17:56 PDT

Created attachment 394090 [details] Patch

Per Arne Vollan

Comment 4 2020-03-20 13:15:32 PDT

Created attachment 394114 [details] Patch

Brent Fulgham

Comment 5 2020-03-20 17:15:00 PDT

Comment on attachment 394114 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=394114&action=review r=me > Source/WebKit/WebProcess/cocoa/WebProcessCocoa.mm:107 > +#import <MobileCoreServices/MobileCoreServices.h> Does this need to be inside PLATFORM(IOS) or anything? It is available on all Cocoa ports? EWS seems happy, so I guess it does!

Per Arne Vollan

Comment 6 2020-03-20 17:27:14 PDT

Comment on attachment 394114 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=394114&action=review >> Source/WebKit/WebProcess/cocoa/WebProcessCocoa.mm:107 >> +#import <MobileCoreServices/MobileCoreServices.h> > > Does this need to be inside PLATFORM(IOS) or anything? It is available on all Cocoa ports? EWS seems happy, so I guess it does! It is inside PLATFORM(IOS_FAMILY), but the section was too long for it to be visible in the diff :)

Per Arne Vollan

Comment 7 2020-03-20 17:27:58 PDT

Comment on attachment 394114 [details] Patch Thanks for reviewing!

Simon Fraser (smfr)

Comment 8 2020-03-20 17:52:56 PDT

Comment on attachment 394114 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=394114&action=review > Source/WebKit/WebProcess/cocoa/WebProcessCocoa.mm:284 > + auto r = adoptCF(UTTypeCreatePreferredIdentifierForTag(kUTTagClassMIMEType, CFSTR("text/html"), 0)); r could use a better name. Does it even need one?

EWS

Comment 9 2020-03-20 18:10:47 PDT

Committed r258803: <https://trac.webkit.org/changeset/258803> All reviewed patches have been landed. Closing bug and clearing flags on attachment 394114 [details].

Jacob Uphoff

Comment 10 2020-03-23 07:38:28 PDT

Reverted r258803 for reason: This revision caused many layout tests and 10 API tests to start failing/crashing Committed r258841: <https://trac.webkit.org/changeset/258841>

Per Arne Vollan

Comment 11 2020-03-23 12:50:57 PDT

Created attachment 394291 [details] Patch

Per Arne Vollan

Comment 12 2020-03-23 13:52:41 PDT

Created attachment 394298 [details] Patch

Per Arne Vollan

Comment 13 2020-03-23 15:55:25 PDT

Created attachment 394315 [details] Patch

EWS

Comment 14 2020-03-23 17:15:29 PDT

Committed r258891: <https://trac.webkit.org/changeset/258891> All reviewed patches have been landed. Closing bug and clearing flags on attachment 394315 [details].