Bug 183275 – Safari uses WebContent.Development when loading injected bundle embedded in its app bundle

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKit2

WebProcessProxy::shouldAllowNonValidInjectedCode checks whether the injected bundle is in /System, because everything coming from there shouldn’t commingle with non-valid code. But platforms apps may use injected bundles from outside /System (for example, Safari uses a bundle embedded in its app bundle for its website icon and snapshot fetching), and those should still not allow non-valid code.

Patch forthcoming.

[Tim Horton]

*** Bug 183276 has been marked as a duplicate of this bug. ***

*** Bug 183276 has been marked as a duplicate of this bug. ***

Created attachment 334881 [details]
Never allow non-valid injected code into a Web Content process serving a platform binary

Comment on attachment 334881 [details]
Never allow non-valid injected code into a Web Content process serving a platform binary

View in context: https://bugs.webkit.org/attachment.cgi?id=334881&action=review

> Source/WebKit/UIProcess/mac/WebProcessProxyMac.mm:59
> +    static bool isPlatformBinary = [] {
> +        return SecTaskGetCodeSignStatus(adoptCF(SecTaskCreateFromSelf(kCFAllocatorDefault)).get()) & CS_PLATFORM_BINARY;
> +    }();

Tim pointed out the silliness in using a lambda here.

Created attachment 334883 [details]
Never allow non-valid injected code into a Web Content process serving a platform binary

Fixed in <https://trac.webkit.org/r229168>.

[Radar WebKit Bug Importer]

<rdar://problem/38059174>