Bug 55371 – [Mac, WK2] Properly canonicalize paths for sandbox extensions

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKit2

[Ivan Krstić]

Since Sandbox operates on VFS paths, NSString -stringByStandardizingPath and -fileSystemRepresentation are not appropriate methods for canonicalization.

[Ivan Krstić]

Created attachment 84051 [details]
patch

[Darin Adler]

Comment on attachment 84051 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=84051&action=review

> Source/WebKit2/Shared/mac/SandboxExtensionMac.mm:115
> -    NSString *standardizedPath = [(NSString *)path stringByStandardizingPath];
> -    handle.m_sandboxExtension = WKSandboxExtensionCreate([standardizedPath fileSystemRepresentation], wkSandboxExtensionType(type));
> +    char normalizedPath[PATH_MAX];
> +    if (!realpath(path.utf8().data(), normalizedPath))
> +        return;

Adding the call to realpath seems fine. I believe that’s the primary intention of this patch.

But I’m surprised that it’s correct to convert to UTF-8 explicitly rather than using the fileSystemRepresentation method. Previously we had been told that it was always better to use that method and not do the UTF-8 conversion ourselves.

[Darin Adler]

This patch was never landed. Do we want this change or not?

[Eric Seidel (no email)]

Attachment 84051 [details] was posted by a committer and has review+, assigning to Ivan Krsti\u0107 for commit.

[Alexey Proskuryakov]

We now call realpath (indirectly) in SandboxExtension::createHandle(). We don't in SandboxExtension::createHandleForTemporaryFile(), and I'm not exactly sure why it works without. But since it does, I don't see a reason to keep this bug open.