Bug 322074 – [SecurityFlags] Allow disabling security flags locally through a user default

• Status: RESOLVED
• Resolution: FIXED
• Component: New Bugs

[Basuke Suzuki]

rdar://185262053

Follow-up to bug 321950 (rdar://185129202), which introduced SecurityFlags and the propagation to the privileged child processes.

There is no way to disable a security flag on a local device yet: the server-side list delivery does not exist, and the only entry point is a testing SPI that a client has to call from code. Add a user default that the UIProcess reads at startup, so a flag can be disabled without building WebKit:

    defaults write com.apple.Safari WebKitDebugDisabledSecurityFlags -array radar184485266
    defaults write -g WebKitDebugDisabledSecurityFlags -array radar184485266

Design:

- Read in the SecurityFlagsController constructor. Every child-process launch path goes through the singleton, so the default is always applied before any child receives its creation parameters; no new call site and no ordering window.
- Read through [NSUserDefaults standardUserDefaults], matching the existing user defaults in the UIProcess. The standard search list covers the application domain and the global domain, so one key serves per-app and device-wide testing alike.
- Cocoa only; a stub returns an empty list on the other ports.
- Gated the same way the existing testing SPI is: compiled out of builds without the internal SDK, and a no-op unless this is an internal install.
- Names from the default are sticky and stay disabled no matter what list is applied later. The one exception is the testing SPI, which ignores the default so the existing API tests stay hermetic; that carve-out can only move flags toward enforced.

[Basuke Suzuki]

rdar://185262053

[Basuke Suzuki]

Pull request: https://github.com/WebKit/WebKit/pull/71947

[EWS]

Committed 319525@main (9a2bcc01a9a8): <https://commits.webkit.org/319525@main>

Reviewed commits have been landed. Closing PR #71947 and removing active labels.

[Basuke Suzuki]

<rdar://problem/185453780>

[Basuke Suzuki]

Re-opening for pull request https://github.com/apple/WebKit/pull/6433

[EWS]

Committed 316606.466@safari-7625-branch (c888a6679a13): <https://commits.webkit.org/316606.466@safari-7625-branch>

Reviewed commits have been landed. Closing PR #6433 and removing active labels.