commit 64c94bee7b17f68b91817f78cbde104b35e48045
author katherine_cheney@apple.com <katherine_cheney@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Wed Jul 01 16:03:56 2020 +0000
committer katherine_cheney@apple.com <katherine_cheney@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Wed Jul 01 16:03:56 2020 +0000
tree 72022f7316622695eb6555ed414101eee101d614
parent 328c7059694d84abb840ac5bccc406a3f989793f

WKUserScripts injecting into all frames seem to violate app-bound domains
https://bugs.webkit.org/show_bug.cgi?id=213816
<rdar://problem/64872296>

Reviewed by Brady Eidson.

Source/WebKit:

Patch to make app-bound domain checks on a per-frame basis instead
of per-page-based-on-main-frame. This will prevent WKUserScripts from
being injected in subframes when the main frame is app-bound. Now, all
ancestors of a frame must be app-bound in order for a frame to
evaluate user script.

* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::setIsNavigatingToAppBoundDomainAndCheckIfPermitted):
Move 'isMainFrame' check to be inside of the check for
m_limitsNavigationsToAppBoundDomains. The navigation should fail if
the main frame is not app-bound and the WKWebView is marked with the
limitsNavigationToAppBoundDomains flag, but non-app-bound subframe
loads are allowed to continue.

(WebKit::WebPageProxy::decidePolicyForNavigationAction):
* UIProcess/WebPageProxy.h:
(WebKit::WebPageProxy::isTopFrameNavigatingToAppBoundDomain const):
* UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::download):
* WebProcess/Network/WebLoaderStrategy.cpp:
(WebKit::WebLoaderStrategy::scheduleLoadFromNetworkProcess):
(WebKit::WebLoaderStrategy::loadResourceSynchronously):
(WebKit::WebLoaderStrategy::startPingLoad):
(WebKit::WebLoaderStrategy::preconnectTo):
For reporting loads to the Network Process, we only care if the main
frame is app bound, so we need to store that info in the WebPage and
WebPageProxy.

* WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
(WebKit::WebFrameLoaderClient::shouldEnableInAppBrowserPrivacyProtections const):
* WebProcess/WebPage/WebFrame.cpp:
(WebKit::WebFrame::startDownload):
(WebKit::WebFrame::convertMainResourceLoadToDownload):
(WebKit::WebFrame::shouldEnableInAppBrowserPrivacyProtections):
(WebKit::WebFrame::isTopFrameNavigatingToAppBoundDomain const):
* WebProcess/WebPage/WebFrame.h:
(WebKit::WebFrame::setIsNavigatingToAppBoundDomain):
(WebKit::WebFrame::isNavigatingToAppBoundDomain const):
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::loadRequest):
(WebKit::WebPage::loadDataImpl):
(WebKit::WebPage::didReceivePolicyDecision):
(WebKit::WebPage::runJavaScript):
(WebKit::WebPage::setIsNavigatingToAppBoundDomain):
(WebKit::WebPage::shouldEnableInAppBrowserPrivacyProtections): Deleted.
* WebProcess/WebPage/WebPage.h:
(WebKit::WebPage::needsInAppBrowserPrivacyQuirks):
(WebKit::WebPage::isNavigatingToAppBoundDomain const): Deleted.
Move all app-bound domain logic from the WebPage to the WebFrame now
that checks are on a per-frame basis.

Tools:

Added API test coverage. Sets up a tree like so: [app-bound domain,
non-app-bound domain, app-bound domain]. Script injection should only
be successful in the top frame. Since message handlers are disabled for non-
app-bound domains, this test injects script which loads an image using a
custom url scheme. If the load succeeds, we increment a counter, and
expect only one successful script load (the main frame).

* TestWebKitAPI/Tests/WebKitCocoa/InAppBrowserPrivacy.mm:
(-[InAppBrowserSchemeHandler webView:startURLSchemeTask:]):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@263806 268f45cc-cd09-0410-ab3c-d52691b4dbfc