Bug 241155
| Summary: | PopUpSOAuthorizationSession::initSecretWebView performs a shallow copy leading to manipulation of parent view configuration | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Brent Fulgham <bfulgham> |
| Component: | WebKit Misc. | Assignee: | Brent Fulgham <bfulgham> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
Brent Fulgham
The AppSSO flows that create a new WKWebView pass through a method 'PopUpSOAuthorizationSession::initSecretWebView'. This conducts SSO flows in an invisible Window for cases where other UI handles the actual authentication, but a web view is needed to handle server interactions. It turns AppSSO off in this view so that normal server authentication can happen without AppSSO being triggered a second time.
This method made the common mistake of believing that copying the configuration of the parent WKWebView gave a deep copy that could be manipulated to control the invisible view independently of the parent view. While the method correctly disabled AppSSO for the hidden view, it also deactivated it for the parent view.
This bug could lead to cases where someone who mistakenly terminated an AppSSO flow would be unable to start the process a second time, as the view would now be configured to block access to AppSSO authentication.
This bug corrects that bug.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Radar WebKit Bug Importer
<rdar://problem/94176551>
Brent Fulgham
Pull request: https://github.com/Webkit/WebKit/pull/1190
EWS
Committed r295068 (251163@main): <https://commits.webkit.org/251163@main>
Reviewed commits have been landed. Closing PR #1190 and removing active labels.