Skip to content

Restarted and context-menu downloads escape private relay's set fail-closed policy - #78748

Merged
webkit-commit-queue merged 1 commit into
mainfrom
integration/conflict/f9920fbf2e67_f9920fbf2e67_main
Oct 30, 2026
Merged

Restarted and context-menu downloads escape private relay's set fail-closed policy#78748
webkit-commit-queue merged 1 commit into
mainfrom
integration/conflict/f9920fbf2e67_f9920fbf2e67_main

Conversation

@webkit-opensource-integration

@webkit-opensource-integration webkit-opensource-integration commented Oct 29, 2026 •
edited by webkit-early-warning-system
Loading

Copy link
Copy Markdown

e049cc7

Restarted and context-menu downloads escape private relay's set fail-closed policy
rdar://186531546

Reviewed by Chris Dumez.

Downloads that don't come from a normal navigation never carried the page's privacy settings,
so they could quietly bypass Private Relay. Pass those settings along with the download request.

Test: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/AdvancedPrivacyProtections.mm

* Source/WebKit/NetworkProcess/Downloads/DownloadManager.cpp:
(WebKit::DownloadManager::startDownload):
* Source/WebKit/NetworkProcess/Downloads/DownloadManager.h:
(WebKit::DownloadManager::startDownload):
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::startDownload):
(WebKit::NetworkConnectionToWebProcess::convertMainResourceLoadToDownload):
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.h:
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.messages.in:
* Source/WebKit/NetworkProcess/NetworkProcess.cpp:
(WebKit::NetworkProcess::downloadRequest):
* Source/WebKit/NetworkProcess/NetworkProcess.h:
* Source/WebKit/NetworkProcess/NetworkProcess.messages.in:
* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:
(WebKit::NetworkResourceLoader::convertToDownload):
* Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.cpp:
(WebKit::WebsiteDataStore::download):
* Source/WebKit/WebProcess/WebPage/WebFrame.cpp:
(WebKit::WebFrame::startDownload):
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/AdvancedPrivacyProtections.mm:
(TestWebKitAPI::nonexistentDownloadDestination):
(TestWebKitAPI::redirectingAttachmentServer):
(TestWebKitAPI::downloadDelegateObservingRedirect):
(TestWebKitAPI::webViewWithFailClosedPrivacyProtections):
(TestWebKitAPI::TEST(AdvancedPrivacyProtections, DownloadRedirectPreservesPrivacyFlagsFromRequest)):
(TestWebKitAPI::TEST(AdvancedPrivacyProtections, DownloadStartedFromRequestInheritsPrivacyFlagsFromPage)):
(TestWebKitAPI::TEST(AdvancedPrivacyProtections, PolicyDecisionDownloadInheritsPrivacyFlagsFromPage)):

Originally-landed-as: 316606.751@safari-7625-branch (f9920fbf2e67). rdar://191050419
Canonical link: https://commits.webkit.org/325317@main

667e016

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios   🛠 mac ✅ 🛠 wpe   🛠 win
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-cmake-debug ✅ 🧪 wpe-wk2   🧪 win-tests
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
✅ 🧪 ios-wk2-wpt ✅ 🧪 api-mac-cmake-debug
✅ 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🛠 gtk3-gcc
✅ 🛠 ios-safer-cpp ✅ 🧪 mac-cmake-debug-wk2 ✅ 🛠 gtk
✅ 🛠 vision ✅ 🧪 gtk-wk2
✅ 🛠 🧪 merge ✅ 🛠 vision-sim ❌ 🧪 mac-intel-wk2 ✅ 🧪 api-gtk
✅ 🧪 vision-wk2 ✅ 🛠 mac-safer-cpp ✅ 🛠 playstation
✅ 🛠 tv ✅ 🧪 mac-site-isolation
✅ 🛠 tv-sim
✅ 🛠 watch
✅ 🛠 watch-sim

@webkit-opensource-integration

webkit-opensource-integration commented Oct 29, 2026

Copy link
Copy Markdown
Author

Integration performed the following cherry-picks: f9920fb for rdar://191050419. f9920fb caused a merge conflict.

@webkit-opensource-integration

webkit-opensource-integration commented Oct 29, 2026

Copy link
Copy Markdown
Author

At the time this pull request was created the following files were in conflict and need to be resolved:

  • Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp — modified on both the target branch and the incoming commit (content conflict)
  • Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp — modified on both the target branch and the incoming commit (content conflict)
  • Source/WebKit/WebProcess/WebPage/WebFrame.cpp — modified on both the target branch and the incoming commit (content conflict)
  • Tools/TestWebKitAPI/Tests/WebKit/WKWebView/AdvancedPrivacyProtections.mm — modified on both the target branch and the incoming commit (content conflict)

@webkit-early-warning-system

webkit-early-warning-system commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

EWS run on previous version of this PR (hash d97e04b)

Details

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
❌ 🧪 style ❌ 🛠 ios ❌ 🛠 mac ❌ 🛠 wpe ❌ 🛠 win
❌ 🧪 bindings ❌ 🛠 ios-sim ❌ 🛠 mac-cmake-debug ❌ 🧪 wpe-wk2 ❌ 🧪 win-tests
❌ 🧪 webkitperl ❌ 🧪 ios-wk2 ❌ 🧪 api-mac ❌ 🧪 api-wpe
❌ 🧪 ios-wk2-wpt ❌ 🧪 api-mac-cmake-debug ❌ 🧪 jsc-wpe
❌ 🧪 jsc-x86-64 ❌ 🧪 api-ios ❌ 🧪 mac-wk2 ❌ 🛠 gtk3-gcc
❌ 🛠 ios-safer-cpp ❌ 🧪 mac-cmake-debug-wk2 ❌ 🛠 gtk
❌ 🛠 vision ❌ 🧪 mac-wk2-stress ❌ 🧪 gtk-wk2
❌ 🛠 vision-sim ❌ 🧪 mac-intel-wk2 ❌ 🧪 api-gtk
❌ 🧪 vision-wk2 ❌ 🛠 mac-safer-cpp ❌ 🛠 playstation
❌ 🛠 tv ❌ 🧪 mac-site-isolation
❌ 🛠 tv-sim
❌ 🛠 watch
❌ 🛠 watch-sim

@beidson
beidson force-pushed the integration/conflict/f9920fbf2e67_f9920fbf2e67_main branch from d97e04b to 06ac700 Compare October 30, 2026 04:57
@webkit-early-warning-system

webkit-early-warning-system commented Oct 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

EWS run on previous version of this PR (hash 06ac700)

Details

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
❌ 🧪 style ❌ 🛠 ios ⏳ 🛠 mac ⏳ 🛠 wpe ⏳ 🛠 win
❌ 🧪 bindings ❌ 🛠 ios-sim ❌ 🛠 mac-cmake-debug ⏳ 🧪 wpe-wk2 ⏳ 🧪 win-tests
❌ 🧪 webkitperl ❌ 🧪 ios-wk2 ⏳ 🧪 api-mac ⏳ 🧪 api-wpe
❌ 🧪 ios-wk2-wpt ❌ 🧪 api-mac-cmake-debug ⏳ 🧪 jsc-wpe
⏳ 🧪 jsc-x86-64 ❌ 🧪 api-ios ⏳ 🧪 mac-wk2 ❌ 🛠 gtk3-gcc
⏳ 🛠 🧪 jsc-debug-arm64 ⏳ 🛠 ios-safer-cpp ❌ 🧪 mac-cmake-debug-wk2 ❌ 🛠 gtk
❌ 🛠 vision ⏳ 🧪 mac-wk2-stress ❌ 🧪 gtk-wk2
⏳ 🛠 vision-sim ⏳ 🧪 mac-intel-wk2 ❌ 🧪 api-gtk
⏳ 🧪 vision-wk2 ⏳ 🛠 mac-safer-cpp ⏳ 🛠 playstation
❌ 🛠 tv ⏳ 🧪 mac-site-isolation
❌ 🛠 tv-sim
❌ 🛠 watch
❌ 🛠 watch-sim

@rjepstein
rjepstein force-pushed the integration/conflict/f9920fbf2e67_f9920fbf2e67_main branch from 06ac700 to 20eaab4 Compare October 30, 2026 05:36
@webkit-early-warning-system

webkit-early-warning-system commented Oct 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

EWS run on previous version of this PR (hash 20eaab4)

Details

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
❌ 🧪 style ❌ 🛠 ios ⏳ 🛠 mac ⏳ 🛠 wpe ⏳ 🛠 win
❌ 🧪 bindings ❌ 🛠 ios-sim ❌ 🛠 mac-cmake-debug ⏳ 🧪 wpe-wk2 ⏳ 🧪 win-tests
❌ 🧪 webkitperl ❌ 🧪 ios-wk2 ⏳ 🧪 api-mac ⏳ 🧪 api-wpe
❌ 🧪 ios-wk2-wpt ❌ 🧪 api-mac-cmake-debug ⏳ 🧪 jsc-wpe
⏳ 🧪 jsc-x86-64 ❌ 🧪 api-ios ⏳ 🧪 mac-wk2 ❌ 🛠 gtk3-gcc
⏳ 🛠 🧪 jsc-debug-arm64 ⏳ 🛠 ios-safer-cpp ❌ 🧪 mac-cmake-debug-wk2   🛠 gtk
❌ 🛠 vision ⏳ 🧪 mac-wk2-stress   🧪 gtk-wk2
⏳ 🛠 vision-sim ⏳ 🧪 mac-intel-wk2   🧪 api-gtk
⏳ 🧪 vision-wk2 ⏳ 🛠 mac-safer-cpp ⏳ 🛠 playstation
❌ 🛠 tv ⏳ 🧪 mac-site-isolation
❌ 🛠 tv-sim
❌ 🛠 watch
❌ 🛠 watch-sim

@beidson
beidson force-pushed the integration/conflict/f9920fbf2e67_f9920fbf2e67_main branch from 20eaab4 to 667e016 Compare October 30, 2026 05:40
@webkit-early-warning-system

webkit-early-warning-system commented Oct 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

EWS run on current version of this PR (hash 667e016)

Details

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios   🛠 mac ✅ 🛠 wpe   🛠 win
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-cmake-debug ✅ 🧪 wpe-wk2   🧪 win-tests
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
✅ 🧪 ios-wk2-wpt ✅ 🧪 api-mac-cmake-debug
✅ 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🛠 gtk3-gcc
✅ 🛠 ios-safer-cpp ✅ 🧪 mac-cmake-debug-wk2 ✅ 🛠 gtk
✅ 🛠 vision ✅ 🧪 gtk-wk2
✅ 🛠 🧪 merge ✅ 🛠 vision-sim ❌ 🧪 mac-intel-wk2 ✅ 🧪 api-gtk
✅ 🧪 vision-wk2 ✅ 🛠 mac-safer-cpp ✅ 🛠 playstation
✅ 🛠 tv ✅ 🧪 mac-site-isolation
✅ 🛠 tv-sim
✅ 🛠 watch
✅ 🛠 watch-sim

@beidson beidson added the merge-queue Applied to send a pull request to merge-queue label Oct 30, 2026
@beidson

beidson commented Oct 30, 2026

Copy link
Copy Markdown
Contributor

The mac-intel-wk2 situation is not because of this patch. Blaming general infrastructure

@beidson
Restarted and context-menu downloads escape private relay's set fail-…
e049cc7 
…closed policy

rdar://186531546

Reviewed by Chris Dumez.

Downloads that don't come from a normal navigation never carried the page's privacy settings,
so they could quietly bypass Private Relay. Pass those settings along with the download request.

Test: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/AdvancedPrivacyProtections.mm

* Source/WebKit/NetworkProcess/Downloads/DownloadManager.cpp:
(WebKit::DownloadManager::startDownload):
* Source/WebKit/NetworkProcess/Downloads/DownloadManager.h:
(WebKit::DownloadManager::startDownload):
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::startDownload):
(WebKit::NetworkConnectionToWebProcess::convertMainResourceLoadToDownload):
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.h:
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.messages.in:
* Source/WebKit/NetworkProcess/NetworkProcess.cpp:
(WebKit::NetworkProcess::downloadRequest):
* Source/WebKit/NetworkProcess/NetworkProcess.h:
* Source/WebKit/NetworkProcess/NetworkProcess.messages.in:
* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:
(WebKit::NetworkResourceLoader::convertToDownload):
* Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.cpp:
(WebKit::WebsiteDataStore::download):
* Source/WebKit/WebProcess/WebPage/WebFrame.cpp:
(WebKit::WebFrame::startDownload):
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/AdvancedPrivacyProtections.mm:
(TestWebKitAPI::nonexistentDownloadDestination):
(TestWebKitAPI::redirectingAttachmentServer):
(TestWebKitAPI::downloadDelegateObservingRedirect):
(TestWebKitAPI::webViewWithFailClosedPrivacyProtections):
(TestWebKitAPI::TEST(AdvancedPrivacyProtections, DownloadRedirectPreservesPrivacyFlagsFromRequest)):
(TestWebKitAPI::TEST(AdvancedPrivacyProtections, DownloadStartedFromRequestInheritsPrivacyFlagsFromPage)):
(TestWebKitAPI::TEST(AdvancedPrivacyProtections, PolicyDecisionDownloadInheritsPrivacyFlagsFromPage)):

Originally-landed-as: 316606.751@safari-7625-branch (f9920fb). rdar://191050419
Canonical link: https://commits.webkit.org/325317@main
@webkit-commit-queue webkit-commit-queue changed the title Cherry-pick(s) f9920fbf2e67. rdar://191050419 Restarted and context-menu downloads escape private relay's set fail-closed policy Oct 30, 2026
@webkit-commit-queue
webkit-commit-queue force-pushed the integration/conflict/f9920fbf2e67_f9920fbf2e67_main branch from 667e016 to e049cc7 Compare October 30, 2026 23:09
@webkit-commit-queue
webkit-commit-queue merged commit e049cc7 into WebKit:main Oct 30, 2026
@webkit-commit-queue

webkit-commit-queue commented Oct 30, 2026

Copy link
Copy Markdown
Collaborator

Committed 325317@main (e049cc7): https://commits.webkit.org/325317@main

Reviewed commits have been landed. Closing PR #78748 and removing active labels.

@webkit-commit-queue webkit-commit-queue removed the merge-queue Applied to send a pull request to merge-queue label Oct 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cdumez cdumez Awaiting requested review from cdumez cdumez is a code owner

Assignees

@beidson beidson

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@webkit-opensource-integration @webkit-early-warning-system @beidson @webkit-commit-queue