WebKit Bugzilla
New
Browse
Log In
×
Sign in with GitHub
or
Remember my login
Create Account
·
Forgot Password
Forgotten password account recovery
RESOLVED FIXED
213816
WKUserScripts injecting into all frames seem to violate app-bound domains
https://bugs.webkit.org/show_bug.cgi?id=213816
Summary
WKUserScripts injecting into all frames seem to violate app-bound domains
Kate Cheney
Reported
2020-06-30 14:22:23 PDT
WKUserScripts can inject user script into all frames when the top frame is app-bound, since only the top frame navigation is checked for app-bound status. This seems to violate principles of app-bound domains.
Attachments
Patch
(25.96 KB, patch)
2020-06-30 14:55 PDT
,
Kate Cheney
no flags
Details
Formatted Diff
Diff
Patch
(30.47 KB, patch)
2020-06-30 16:16 PDT
,
Kate Cheney
no flags
Details
Formatted Diff
Diff
Show Obsolete
(1)
View All
Add attachment
proposed patch, testcase, etc.
Kate Cheney
Comment 1
2020-06-30 14:23:41 PDT
<
rdar://problem/64872296
>
Kate Cheney
Comment 2
2020-06-30 14:55:23 PDT
Created
attachment 403244
[details]
Patch
Brady Eidson
Comment 3
2020-06-30 15:08:10 PDT
Comment on
attachment 403244
[details]
Patch View in context:
https://bugs.webkit.org/attachment.cgi?id=403244&action=review
Other than rebasing first and adding a test, looks good.
> Source/WebKit/WebProcess/WebPage/WebPage.cpp:3461 > - if (shouldEnableInAppBrowserPrivacyProtections()) { > + if (frame->shouldEnableInAppBrowserPrivacyProtections()) { > send(Messages::WebPageProxy::ScriptValueCallback({ }, ExceptionDetails { "Unable to execute JavaScript"_s }, callbackID));
You will have to rebase before this lands. Also, this is an interesting new case that now needs to be tested (as of
https://trac.webkit.org/changeset/263727/webkit
) - Could you add to the API test an attempt to evaluate javascript to the non app-bound domain should fail?
> Tools/TestWebKitAPI/Tests/WebKitCocoa/InAppBrowserPrivacy.mm:113 > + else if ([task.request.URL.path isEqualToString:@"/should-load-for-main-frame-only"]) > + countInjectedScriptSource++;
Another way to do this is checking the WKFrameInfo on the WKURLSchemeHandlerTask and see if it's the main frame, and get its URL, etc.
Kate Cheney
Comment 4
2020-06-30 16:16:15 PDT
Created
attachment 403250
[details]
Patch
EWS
Comment 5
2020-07-01 09:04:01 PDT
Committed
r263806
: <
https://trac.webkit.org/changeset/263806
> All reviewed patches have been landed. Closing bug and clearing flags on
attachment 403250
[details]
.
Note
You need to
log in
before you can comment on or make changes to this bug.
Top of Page
Format For Printing
XML
Clone This Bug