Skip to content

Cherry-pick(s) 8b7e574. rdar://191142094 - #78744

Open
webkit-opensource-integration wants to merge 1 commit into
mainfrom
integration/conflict/8b7e574_8b7e574_main
Open

Cherry-pick(s) 8b7e574. rdar://191142094#78744
webkit-opensource-integration wants to merge 1 commit into
mainfrom
integration/conflict/8b7e574_8b7e574_main

Conversation

@webkit-opensource-integration

@webkit-opensource-integration webkit-opensource-integration commented Oct 29, 2026 •
edited by webkit-early-warning-system
Loading

Copy link
Copy Markdown

Integration has hit a merge conflict while cherry-picking rdar://191142094 to main. [8b7e574] caused a merge conflict.

validateCacheEntry revalidates cached-redirect target against pre-redirect URL, merging cross-origin headers
rdar://182127841

Reviewed by Chris Dumez.

The network cache validated a redirect target's cache entry using originalRequest()'s URL instead of the URL of the request
the entry actually belonged to, whenever that entry was cross-origin from the original request. The fix is that when the entry being
revalidated is cross-origin from originalRequest(), use the entry's own request (URL) for revalidation instead. This request is
saved in m_cacheEntryForValidationRequest so the correct request is also used later to update the  cache when the network responds.

In the test, the source URL 302s to a cross-origin target whose cached response needs revalidation. Before the fix, the revalidation request
was sent to the source URL instead of the target's, so the source's server could forge a 304 and leak the cross-origin target's
cached body to the page.

Test: http/tests/cache/cached-redirect-cross-origin-leak.html

* LayoutTests/sar3/http/tests/cache/cached-redirect-cross-origin-leak-expected.txt: Added.
* LayoutTests/sar3/http/tests/cache/cached-redirect-cross-origin-leak.html: Added.
* LayoutTests/sar3/http/tests/cache/resources/cached-redirect-to-cross-origin-leak-redirect.py: Added.
* LayoutTests/sar3/http/tests/cache/resources/cached-redirect-to-cross-origin-leak-source.py: Added.
* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:
* Source/WebKit/NetworkProcess/NetworkResourceLoader.h:

Originally-landed-as: 316606.490@safari-7625-branch (8b7e574). rdar://191142094

ℹ️ Info

RC_REMOVE_SEC_ACCEL_* guards were removed with unifdef before cherry-picking, keeping only the code built when the macro is not defined.

57dc4ad

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 win
✅ 🛠 ios-sim ✅ 🛠 mac-cmake-debug ✅ 🧪 wpe-wk2 ✅ 🧪 win-tests
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
⏳ 🧪 ios-wk2-wpt ✅ 🧪 api-mac-cmake-debug
✅ 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🛠 gtk3-gcc
✅ 🛠 ios-safer-cpp ✅ 🧪 mac-cmake-debug-wk2 ✅ 🛠 gtk
✅ 🛠 vision ✅ 🧪 mac-wk2-stress ✅ 🧪 gtk-wk2
✅ 🛠 vision-sim ✅ 🧪 mac-intel-wk2 ✅ 🧪 api-gtk
✅ 🧪 vision-wk2 ✅ 🛠 mac-safer-cpp ✅ 🛠 playstation
✅ 🛠 tv ✅ 🧪 mac-site-isolation
✅ 🛠 tv-sim
✅ 🛠 watch
✅ 🛠 watch-sim

@webkit-opensource-integration

webkit-opensource-integration commented Oct 29, 2026

Copy link
Copy Markdown
Author

Integration performed the following cherry-picks: 8b7e574 for rdar://191142094. 8b7e574 caused a merge conflict.

@webkit-opensource-integration

webkit-opensource-integration commented Oct 29, 2026

Copy link
Copy Markdown
Author

At the time this pull request was created the following files were in conflict and need to be resolved:

  • Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp — modified on both the target branch and the incoming commit (content conflict)

@webkit-early-warning-system

webkit-early-warning-system commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

EWS run on previous version of this PR (hash f878b86)

Details

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
❌ 🧪 style ❌ 🛠 ios ❌ 🛠 mac ❌ 🛠 wpe ❌ 🛠 win
❌ 🛠 ios-sim ❌ 🛠 mac-cmake-debug ❌ 🧪 wpe-wk2 ❌ 🧪 win-tests
❌ 🧪 webkitperl ❌ 🧪 ios-wk2 ❌ 🧪 api-mac ❌ 🧪 api-wpe
❌ 🧪 ios-wk2-wpt ❌ 🧪 api-mac-cmake-debug ❌ 🧪 jsc-wpe
❌ 🧪 jsc-x86-64 ❌ 🧪 api-ios ❌ 🧪 mac-wk2 ❌ 🛠 gtk3-gcc
❌ 🛠 ios-safer-cpp ❌ 🧪 mac-cmake-debug-wk2 ❌ 🛠 gtk
❌ 🛠 vision ❌ 🧪 mac-wk2-stress ❌ 🧪 gtk-wk2
❌ 🛠 vision-sim ❌ 🧪 mac-intel-wk2 ❌ 🧪 api-gtk
❌ 🧪 vision-wk2 ❌ 🛠 mac-safer-cpp ❌ 🛠 playstation
❌ 🛠 tv ❌ 🧪 mac-site-isolation
❌ 🛠 tv-sim
❌ 🛠 watch
❌ 🛠 watch-sim

@jelee53
validateCacheEntry revalidates cached-redirect target against pre-red…
57dc4ad 
…irect URL, merging cross-origin headers

rdar://182127841

Reviewed by Chris Dumez.

The network cache validated a redirect target's cache entry using originalRequest()'s URL instead of the URL of the request
the entry actually belonged to, whenever that entry was cross-origin from the original request. The fix is that when the entry being
revalidated is cross-origin from originalRequest(), use the entry's own request (URL) for revalidation instead. This request is
saved in m_cacheEntryForValidationRequest so the correct request is also used later to update the  cache when the network responds.

In the test, the source URL 302s to a cross-origin target whose cached response needs revalidation. Before the fix, the revalidation request
was sent to the source URL instead of the target's, so the source's server could forge a 304 and leak the cross-origin target's
cached body to the page.

Test: http/tests/cache/cached-redirect-cross-origin-leak.html

* LayoutTests/http/tests/cache/cached-redirect-cross-origin-leak-expected.txt: Added.
* LayoutTests/http/tests/cache/cached-redirect-cross-origin-leak.html: Added.
* LayoutTests/http/tests/cache/resources/cached-redirect-to-cross-origin-leak-redirect.py: Added.
* LayoutTests/http/tests/cache/resources/cached-redirect-to-cross-origin-leak-source.py: Added.
* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:
* Source/WebKit/NetworkProcess/NetworkResourceLoader.h:

Originally-landed-as: 316606.490@safari-7625-branch (8b7e574). rdar://191142094
@jelee53
jelee53 force-pushed the integration/conflict/8b7e574_8b7e574_main branch from f878b86 to 57dc4ad Compare October 29, 2026 07:03
@webkit-early-warning-system

webkit-early-warning-system commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

EWS run on current version of this PR (hash 57dc4ad)

Details

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 win
✅ 🛠 ios-sim ✅ 🛠 mac-cmake-debug ✅ 🧪 wpe-wk2 ✅ 🧪 win-tests
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
⏳ 🧪 ios-wk2-wpt ✅ 🧪 api-mac-cmake-debug
✅ 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🛠 gtk3-gcc
✅ 🛠 ios-safer-cpp ✅ 🧪 mac-cmake-debug-wk2 ✅ 🛠 gtk
✅ 🛠 vision ✅ 🧪 mac-wk2-stress ✅ 🧪 gtk-wk2
✅ 🛠 vision-sim ✅ 🧪 mac-intel-wk2 ✅ 🧪 api-gtk
✅ 🧪 vision-wk2 ✅ 🛠 mac-safer-cpp ✅ 🛠 playstation
✅ 🛠 tv ✅ 🧪 mac-site-isolation
✅ 🛠 tv-sim
✅ 🛠 watch
✅ 🛠 watch-sim

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cdumez cdumez Awaiting requested review from cdumez cdumez is a code owner

Assignees

@jelee53 jelee53

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@webkit-opensource-integration @webkit-early-warning-system @jelee53