CVE-2025-43227

Medium CVSS 7.5 webkit Bypass 🔧 Commit mapped

Overview

Medium

Severity

7.5

CVSS

Exploited ITW

Fixed

Fix Status

DescriptionProcessing maliciously crafted web content may disclose sensitive user information

ComponentWTF

Sub-componentWTF

Bug ClassBypass

Tracker292888

Fix commitc3811ccef959 (WebKit/WebKit) +265/-65

CWECWE-359

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA KEVNot listed

CreditedGilad Moav, Yehuda Afek, Anat Bremler-Barr, and Amit Klein

Disclosed2025-07-29

Background

`portAllowed`: the WTF URL helper that returns whether a URL’s port may be used for a network request.
`blockedPortList`: a static, sorted array of uint16_t port numbers that portAllowed rejects to prevent cross-protocol and probing abuse.
Port 0: the reserved TCP/UDP port that never corresponds to a real listening service, so connection attempts to it fail deterministically.
Fetch port blocking: the WHATWG Fetch spec’s “bad port” list that browsers apply to block requests to sensitive or reserved ports.

Root Cause Analysis

portAllowed short-circuits to true only when port is empty (if (!port) return true;), meaning an explicitly specified port of 0 fell through to the blockedPortList membership check. The old blockedPortList was copied from Mozilla’s PortBanning list and began at port 1 (tcpmux), so 0 was never a member and a request to a :0 URL was therefore permitted. The violated invariant is that every reserved or non-connectable port that the Fetch spec designates as “bad” must be rejected by portAllowed; port 0 is such a reserved port but was absent from the table.

The fix re-bases the list on https://fetch.spec.whatwg.org/#port-blocking and prepends 0, // reserved, so portAllowed now returns false for :0 URLs and the request is blocked with a Not allowed to use restricted network port 0 console message. Because attempts to port 0 fail immediately and deterministically rather than performing a real TCP handshake, blocking them removes a stable timing/error side channel.

Key insight

The single mistake was that the blockedPortList omitted the reserved port 0, so portAllowed treated an explicit :0 as allowed; the fix simply adds 0 to the list (aligning it with the Fetch spec), closing the bypass.

Attack Path

Craft a zero-port URL Malicious web content issues a fetch("https://host:0/") (or sets an image src) whose explicit port is 0.
Pass the empty-port guard Because the port is explicitly 0 and not empty, portAllowed’s if (!port) return true; does not fire and control reaches the list check.
Miss the blocklist The pre-fix blockedPortList starts at 1, so 0 is not found and portAllowed returns true, allowing the request.
Observe the deterministic failure The request to port 0 fails immediately; the attacker times the rejection with performance.now() to derive a side channel or probe local network behavior.

Impact Assessment

An attacker running script in the web content process gains a reliable timing/probing side channel by measuring the deterministic failure of connections to reserved port 0, which can be used to infer information such as host reachability or fingerprintable timing, contributing to disclosure of sensitive user information. It operates entirely within the sandboxed content/renderer context and requires only that the victim load attacker-controlled web content. No further privilege or user interaction beyond visiting the page is needed.

Changed Functions

Function	Change	Notes
`if` LayoutTests/http/tests/security/block-connection-to-zero-port.https.html	modified

Files Changed

LayoutTests/http/tests/security/block-connection-to-zero-port.https-expected.txt
LayoutTests/http/tests/security/block-connection-to-zero-port.https.html
LayoutTests/platform/gtk-wk2/security/block-test-expected.txt
LayoutTests/platform/wpe/security/block-test-expected.txt
Source/WTF/wtf/URL.cpp

Audit Directions

Explicit sentinel values past empty checks
Review guards like if (!value) return allowed; where a semantically special but non-empty value (0, -1) can slip past an “unset” fast path into a permissive branch.
Blocklist provenance drift
Where a security allow/deny table is copied from an external source (here Mozilla’s PortBanning), confirm it is kept in sync with the authoritative spec (Fetch bad-port list) and re-audit on every spec update.
Deterministic-failure side channels
Audit code paths whose rejection timing or error is stable and script-observable (via performance.now() or promise rejection), since consistent failures for reserved endpoints can leak information.

Patch

view commit

diff --git a/Source/WTF/wtf/URL.cpp b/Source/WTF/wtf/URL.cpp
index 615cedc793a8..9c9311c8fb41 100644
--- a/Source/WTF/wtf/URL.cpp
+++ b/Source/WTF/wtf/URL.cpp
@@ -1003,72 +1003,73 @@ bool portAllowed(const URL& url)
     if (!port)
         return true;
 
-    // This blocked port list matches the port blocking that Mozilla implements.
-    // See http://www.mozilla.org/projects/netlib/PortBanning.html for more information.
+    // This blocked port list is defined by the Fetch spec, with the addition of port 0.
+    // See https://fetch.spec.whatwg.org/#port-blocking for more information.
     static const uint16_t blockedPortList[] = {
-        1,    // tcpmux
-        7,    // echo
-        9,    // discard
-        11,   // systat
-        13,   // daytime
-        15,   // netstat
-        17,   // qotd
-        19,   // chargen
-        20,   // FTP-data
-        21,   // FTP-control
-        22,   // SSH
-        23,   // telnet
-        25,   // SMTP
-        37,   // time
-        42,   // name
-        43,   // nicname
-        53,   // domain
-        69,   // TFTP
-        77,   // priv-rjs
-        79,   // finger
-        87,   // ttylink
-        95,   // supdup
-        101,  // hostriame
-        102,  // iso-tsap
-        103,  // gppitnp
-        104,  // acr-nema
-        109,  // POP2
-        110,  // POP3
-        111,  // sunrpc
-        113,  // auth
-        115,  // SFTP
-        117,  // uucp-path
-        119,  // nntp
-        123,  // NTP
-        135,  // loc-srv / epmap
-        137,  // NetBIOS
-        139,  // netbios
-        143,  // IMAP2
-        161,  // SNMP
-        179,  // BGP
-        389,  // LDAP
-        427,  // SLP (Also used by Apple Filing Protocol)
-        465,  // SMTP+SSL
-        512,  // print / exec
-        513,  // login
-        514,  // shell
-        515,  // printer
-        526,  // tempo
-        530,  // courier
-        531,  // Chat
-        532,  // netnews
-        540,  // UUCP
-        548,  // afpovertcp [Apple addition]
-        554,  // rtsp
-        556,  // remotefs
-        563,  // NNTP+SSL
-        587,  // ESMTP
-        601,  // syslog-conn
-        636,  // LDAP+SSL
-        989,  // ftps-data
-        990,  // ftps
-        993,  // IMAP+SSL
-        995,  // POP3+SSL
+        0, // reserved
+        1, // tcpmux
+        7, // echo
+        9, // discard
+        11, // systat
+        13, // daytime
+        15, // netstat
+        17, // qotd
+        19, // chargen
+        20, // FTP-data
+        21, // FTP-control
+        22, // SSH
+        23, // telnet
+        25, // SMTP
+        37, // time
+        42, // name
+        43, // nicname
+        53, // domain
+        69, // TFTP
+        77, // priv-rjs
+        79, // finger
+        87, // ttylink
+        95, // supdup
+        101, // hostriame
+        102, // iso-tsap
+        103, // gppitnp
+        104, // acr-nema
+        109, // POP2
+        110, // POP3
+        111, // sunrpc
+        113, // auth
+        115, // SFTP
+        117, // uucp-path
+        119, // nntp
+        123, // NTP
+        135, // loc-srv / epmap
+        137, // NetBIOS
+        139, // netbios
+        143, // IMAP2
+        161, // SNMP
+        179, // BGP
+        389, // LDAP
+        427, // SLP (Also used by Apple Filing Protocol)
+        465, // SMTP+SSL
+        512, // print / exec
+        513, // login
+        514, // shell
+        515, // printer
+        526, // tempo
+        530, // courier
+        531, // Chat
+        532, // netnews
+        540, // UUCP
+        548, // afpovertcp [Apple addition]
+        554, // rtsp
+        556, // remotefs
+        563, // NNTP+SSL
+        587, // ESMTP
+        601, // syslog-conn
+        636, // LDAP+SSL
+        989, // ftps-data
+        990, // ftps
+        993, // IMAP+SSL
+        995, // POP3+SSL
         1719, // H323 (RAS)
         1720, // H323 (Q931)
         1723, // H323 (H245)
diff --git a/LayoutTests/http/tests/security/block-connection-to-zero-port.https-expected.txt b/LayoutTests/http/tests/security/block-connection-to-zero-port.https-expected.txt
new file mode 100644
index 000000000000..08549eb14739
--- /dev/null
+++ b/LayoutTests/http/tests/security/block-connection-to-zero-port.https-expected.txt
@@ -0,0 +1,2 @@
+CONSOLE MESSAGE: Not allowed to use restricted network port 0: https://does-not-exist.com:0/
+This attempts to measure performance based on the zero port.
diff --git a/LayoutTests/http/tests/security/block-connection-to-zero-port.https.html b/LayoutTests/http/tests/security/block-connection-to-zero-port.https.html
new file mode 100644
index 000000000000..045d1a73ce6e
--- /dev/null
+++ b/LayoutTests/http/tests/security/block-connection-to-zero-port.https.html
@@ -0,0 +1,15 @@
+<html>
+<body>
+<script>
+    if (window.testRunner) {
+        testRunner.dumpAsText();
+        testRunner.waitUntilDone();
+    }
+    fetch("https://does-not-exist.com:0/").catch((e) => {
+        const t1 = performance.now();
+        testRunner.notifyDone(); 
+    });
+</script>
+<p>This attempts to measure performance based on the zero port.</p>
+</body>
+</html>
diff --git a/LayoutTests/platform/gtk-wk2/security/block-test-expected.txt b/LayoutTests/platform/gtk-wk2/security/block-test-expected.txt
new file mode 100644
index 000000000000..27ecb5cf99fd
--- /dev/null
+++ b/LayoutTests/platform/gtk-wk2/security/block-test-expected.txt
@@ -0,0 +1,91 @@
+CONSOLE MESSAGE: Not allowed to use restricted network port 1: http://255.255.255.255:1/test.jpg
+block-test.html - didFinishLoading
+CONSOLE MESSAGE: Not allowed to use restricted network port 7: http://255.255.255.255:7/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 9: http://255.255.255.255:9/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 11: http://255.255.255.255:11/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 13: http://255.255.255.255:13/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 15: http://255.255.255.255:15/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 17: http://255.255.255.255:17/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 19: http://255.255.255.255:19/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 20: http://255.255.255.255:20/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 21: http://255.255.255.255:21/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 22: http://255.255.255.255:22/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 23: http://255.255.255.255:23/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 25: http://255.255.255.255:25/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 37: http://255.255.255.255:37/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 42: http://255.255.255.255:42/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 43: http://255.255.255.255:43/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 53: http://255.255.255.255:53/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 77: http://255.255.255.255:77/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 79: http://255.255.255.255:79/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 87: http://255.255.255.255:87/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 95: http://255.255.255.255:95/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 101: http://255.255.255.255:101/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 102: http://255.255.255.255:102/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 103: http://255.255.255.255:103/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 104: http://255.255.255.255:104/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 109: http://255.255.255.255:109/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 110: http://255.255.255.255:110/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 111: http://255.255.255.255:111/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 113: http://255.255.255.255:113/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 115: http://255.255.255.255:115/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 117: http://255.255.255.255:117/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 119: http://255.255.255.255:119/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 123: http://255.255.255.255:123/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 135: http://255.255.255.255:135/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 139: http://255.255.255.255:139/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 143: http://255.255.255.255:143/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 179: http://255.255.255.255:179/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 389: http://255.255.255.255:389/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 465: http://255.255.255.255:465/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 512: http://255.255.255.255:512/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 513: http://255.255.255.255:513/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 514: http://255.255.255.255:514/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 515: http://255.255.255.255:515/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 526: http://255.255.255.255:526/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 530: http://255.255.255.255:530/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 531: http://255.255.255.255:531/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 532: http://255.255.255.255:532/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 540: http://255.255.255.255:540/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 548: http://255.255.255.255:548/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 556: http://255.255.255.255:556/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 563: http://255.255.255.255:563/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 587: http://255.255.255.255:587/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 601: http://255.255.255.255:601/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 636: http://255.255.255.255:636/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 993: http://255.255.255.255:993/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 995: http://255.255.255.255:995/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 2049: http://255.255.255.255:2049/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 3659: http://255.255.255.255:3659/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 4045: http://255.255.255.255:4045/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 4190: http://255.255.255.255:4190/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6000: http://255.255.255.255:6000/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6665: http://255.255.255.255:6665/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6666: http://255.255.255.255:6666/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6667: http://255.255.255.255:6667/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6668: http://255.255.255.255:6668/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6669: http://255.255.255.255:6669/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6679: http://255.255.255.255:6679/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6697: http://255.255.255.255:6697/test.jpg
+http://255.255.255.255:65535/test.jpg - willSendRequest <NSURLRequest URL http://255.255.255.255:65535/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+http://255.255.255.255:65535/test.jpg - didFailLoadingWithError: <NSError domain g-io-error-quark, code 38, failing URL "http://255.255.255.255:65535/test.jpg">
+CONSOLE MESSAGE: Not allowed to use restricted network port 0: http://255.255.255.255:0/test.jpg
+http://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL http://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+http://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain g-io-error-quark, code 38, failing URL "http://255.255.255.255/test.jpg">
+http://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL http://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+http://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain g-io-error-quark, code 38, failing URL "http://255.255.255.255/test.jpg">
+ftp://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL ftp://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+CONSOLE MESSAGE: FTP URLs are disabled
+CONSOLE MESSAGE: Cannot load image ftp://255.255.255.255/test.jpg due to access control checks.
+ftp://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain WebKitInternal, code 0, failing URL "ftp://255.255.255.255/test.jpg">
+ftp://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL ftp://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+CONSOLE MESSAGE: FTP URLs are disabled
+CONSOLE MESSAGE: Cannot load image ftp://255.255.255.255/test.jpg due to access control checks.
+ftp://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain WebKitInternal, code 0, failing URL "ftp://255.255.255.255/test.jpg">
+ftp://255.255.255.255:22/test.jpg - willSendRequest <NSURLRequest URL ftp://255.255.255.255:22/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+CONSOLE MESSAGE: FTP URLs are disabled
+CONSOLE MESSAGE: Cannot load image ftp://255.255.255.255:22/test.jpg due to access control checks.
+ftp://255.255.255.255:22/test.jpg - didFailLoadingWithError: <NSError domain WebKitInternal, code 0, failing URL "ftp://255.255.255.255:22/test.jpg">
+This test attempts to change the src of an IMG tag to all blocked ports to confirm that WebKit returns the correct error for them - blocked instead of cannot find. It also tries the FTP ports for exemptions. Due to the nature of this test, the results can only be processed automatically via DumpRenderTree
+
+
diff --git a/LayoutTests/platform/wpe/security/block-test-expected.txt b/LayoutTests/platform/wpe/security/block-test-expected.txt
new file mode 100644
index 000000000000..27ecb5cf99fd
--- /dev/null
+++ b/LayoutTests/platform/wpe/security/block-test-expected.txt
@@ -0,0 +1,91 @@
+CONSOLE MESSAGE: Not allowed to use restricted network port 1: http://255.255.255.255:1/test.jpg
+block-test.html - didFinishLoading
+CONSOLE MESSAGE: Not allowed to use restricted network port 7: http://255.255.255.255:7/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 9: http://255.255.255.255:9/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 11: http://255.255.255.255:11/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 13: http://255.255.255.255:13/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 15: http://255.255.255.255:15/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 17: http://255.255.255.255:17/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 19: http://255.255.255.255:19/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 20: http://255.255.255.255:20/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 21: http://255.255.255.255:21/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 22: http://255.255.255.255:22/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 23: http://255.255.255.255:23/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 25: http://255.255.255.255:25/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 37: http://255.255.255.255:37/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 42: http://255.255.255.255:42/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 43: http://255.255.255.255:43/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 53: http://255.255.255.255:53/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 77: http://255.255.255.255:77/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 79: http://255.255.255.255:79/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 87: http://255.255.255.255:87/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 95: http://255.255.255.255:95/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 101: http://255.255.255.255:101/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 102: http://255.255.255.255:102/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 103: http://255.255.255.255:103/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 104: http://255.255.255.255:104/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 109: http://255.255.255.255:109/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 110: http://255.255.255.255:110/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 111: http://255.255.255.255:111/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 113: http://255.255.255.255:113/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 115: http://255.255.255.255:115/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 117: http://255.255.255.255:117/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 119: http://255.255.255.255:119/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 123: http://255.255.255.255:123/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 135: http://255.255.255.255:135/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 139: http://255.255.255.255:139/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 143: http://255.255.255.255:143/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 179: http://255.255.255.255:179/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 389: http://255.255.255.255:389/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 465: http://255.255.255.255:465/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 512: http://255.255.255.255:512/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 513: http://255.255.255.255:513/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 514: http://255.255.255.255:514/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 515: http://255.255.255.255:515/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 526: http://255.255.255.255:526/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 530: http://255.255.255.255:530/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 531: http://255.255.255.255:531/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 532: http://255.255.255.255:532/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 540: http://255.255.255.255:540/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 548: http://255.255.255.255:548/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 556: http://255.255.255.255:556/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 563: http://255.255.255.255:563/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 587: http://255.255.255.255:587/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 601: http://255.255.255.255:601/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 636: http://255.255.255.255:636/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 993: http://255.255.255.255:993/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 995: http://255.255.255.255:995/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 2049: http://255.255.255.255:2049/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 3659: http://255.255.255.255:3659/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 4045: http://255.255.255.255:4045/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 4190: http://255.255.255.255:4190/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6000: http://255.255.255.255:6000/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6665: http://255.255.255.255:6665/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6666: http://255.255.255.255:6666/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6667: http://255.255.255.255:6667/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6668: http://255.255.255.255:6668/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6669: http://255.255.255.255:6669/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6679: http://255.255.255.255:6679/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6697: http://255.255.255.255:6697/test.jpg
+http://255.255.255.255:65535/test.jpg - willSendRequest <NSURLRequest URL http://255.255.255.255:65535/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+http://255.255.255.255:65535/test.jpg - didFailLoadingWithError: <NSError domain g-io-error-quark, code 38, failing URL "http://255.255.255.255:65535/test.jpg">
+CONSOLE MESSAGE: Not allowed to use restricted network port 0: http://255.255.255.255:0/test.jpg
+http://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL http://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+http://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain g-io-error-quark, code 38, failing URL "http://255.255.255.255/test.jpg">
+http://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL http://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+http://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain g-io-error-quark, code 38, failing URL "http://255.255.255.255/test.jpg">
+ftp://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL ftp://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+CONSOLE MESSAGE: FTP URLs are disabled
+CONSOLE MESSAGE: Cannot load image ftp://255.255.255.255/test.jpg due to access control checks.
+ftp://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain WebKitInternal, code 0, failing URL "ftp://255.255.255.255/test.jpg">
+ftp://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL ftp://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+CONSOLE MESSAGE: FTP URLs are disabled
+CONSOLE MESSAGE: Cannot load image ftp://255.255.255.255/test.jpg due to access control checks.
+ftp://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain WebKitInternal, code 0, failing URL "ftp://255.255.255.255/test.jpg">
+ftp://255.255.255.255:22/test.jpg - willSendRequest <NSURLRequest URL ftp://255.255.255.255:22/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+CONSOLE MESSAGE: FTP URLs are disabled
+CONSOLE MESSAGE: Cannot load image ftp://255.255.255.255:22/test.jpg due to access control checks.
+ftp://255.255.255.255:22/test.jpg - didFailLoadingWithError: <NSError domain WebKitInternal, code 0, failing URL "ftp://255.255.255.255:22/test.jpg">
+This test attempts to change the src of an IMG tag to all blocked ports to confirm that WebKit returns the correct error for them - blocked instead of cannot find. It also tries the FTP ports for exemptions. Due to the nature of this test, the results can only be processed automatically via DumpRenderTree
+
+

Loading diff…

Regression Test / PoC

shipped with the fix

diff --git a/LayoutTests/http/tests/security/block-connection-to-zero-port.https-expected.txt b/LayoutTests/http/tests/security/block-connection-to-zero-port.https-expected.txt
new file mode 100644
index 000000000000..08549eb14739
--- /dev/null
+++ b/LayoutTests/http/tests/security/block-connection-to-zero-port.https-expected.txt
@@ -0,0 +1,2 @@
+CONSOLE MESSAGE: Not allowed to use restricted network port 0: https://does-not-exist.com:0/
+This attempts to measure performance based on the zero port.
diff --git a/LayoutTests/http/tests/security/block-connection-to-zero-port.https.html b/LayoutTests/http/tests/security/block-connection-to-zero-port.https.html
new file mode 100644
index 000000000000..045d1a73ce6e
--- /dev/null
+++ b/LayoutTests/http/tests/security/block-connection-to-zero-port.https.html
@@ -0,0 +1,15 @@
+<html>
+<body>
+<script>
+    if (window.testRunner) {
+        testRunner.dumpAsText();
+        testRunner.waitUntilDone();
+    }
+    fetch("https://does-not-exist.com:0/").catch((e) => {
+        const t1 = performance.now();
+        testRunner.notifyDone(); 
+    });
+</script>
+<p>This attempts to measure performance based on the zero port.</p>
+</body>
+</html>
diff --git a/LayoutTests/platform/gtk-wk2/security/block-test-expected.txt b/LayoutTests/platform/gtk-wk2/security/block-test-expected.txt
new file mode 100644
index 000000000000..27ecb5cf99fd
--- /dev/null
+++ b/LayoutTests/platform/gtk-wk2/security/block-test-expected.txt
@@ -0,0 +1,91 @@
+CONSOLE MESSAGE: Not allowed to use restricted network port 1: http://255.255.255.255:1/test.jpg
+block-test.html - didFinishLoading
+CONSOLE MESSAGE: Not allowed to use restricted network port 7: http://255.255.255.255:7/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 9: http://255.255.255.255:9/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 11: http://255.255.255.255:11/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 13: http://255.255.255.255:13/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 15: http://255.255.255.255:15/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 17: http://255.255.255.255:17/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 19: http://255.255.255.255:19/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 20: http://255.255.255.255:20/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 21: http://255.255.255.255:21/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 22: http://255.255.255.255:22/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 23: http://255.255.255.255:23/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 25: http://255.255.255.255:25/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 37: http://255.255.255.255:37/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 42: http://255.255.255.255:42/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 43: http://255.255.255.255:43/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 53: http://255.255.255.255:53/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 77: http://255.255.255.255:77/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 79: http://255.255.255.255:79/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 87: http://255.255.255.255:87/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 95: http://255.255.255.255:95/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 101: http://255.255.255.255:101/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 102: http://255.255.255.255:102/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 103: http://255.255.255.255:103/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 104: http://255.255.255.255:104/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 109: http://255.255.255.255:109/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 110: http://255.255.255.255:110/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 111: http://255.255.255.255:111/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 113: http://255.255.255.255:113/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 115: http://255.255.255.255:115/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 117: http://255.255.255.255:117/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 119: http://255.255.255.255:119/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 123: http://255.255.255.255:123/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 135: http://255.255.255.255:135/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 139: http://255.255.255.255:139/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 143: http://255.255.255.255:143/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 179: http://255.255.255.255:179/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 389: http://255.255.255.255:389/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 465: http://255.255.255.255:465/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 512: http://255.255.255.255:512/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 513: http://255.255.255.255:513/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 514: http://255.255.255.255:514/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 515: http://255.255.255.255:515/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 526: http://255.255.255.255:526/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 530: http://255.255.255.255:530/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 531: http://255.255.255.255:531/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 532: http://255.255.255.255:532/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 540: http://255.255.255.255:540/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 548: http://255.255.255.255:548/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 556: http://255.255.255.255:556/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 563: http://255.255.255.255:563/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 587: http://255.255.255.255:587/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 601: http://255.255.255.255:601/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 636: http://255.255.255.255:636/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 993: http://255.255.255.255:993/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 995: http://255.255.255.255:995/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 2049: http://255.255.255.255:2049/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 3659: http://255.255.255.255:3659/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 4045: http://255.255.255.255:4045/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 4190: http://255.255.255.255:4190/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6000: http://255.255.255.255:6000/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6665: http://255.255.255.255:6665/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6666: http://255.255.255.255:6666/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6667: http://255.255.255.255:6667/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6668: http://255.255.255.255:6668/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6669: http://255.255.255.255:6669/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6679: http://255.255.255.255:6679/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6697: http://255.255.255.255:6697/test.jpg
+http://255.255.255.255:65535/test.jpg - willSendRequest <NSURLRequest URL http://255.255.255.255:65535/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+http://255.255.255.255:65535/test.jpg - didFailLoadingWithError: <NSError domain g-io-error-quark, code 38, failing URL "http://255.255.255.255:65535/test.jpg">
+CONSOLE MESSAGE: Not allowed to use restricted network port 0: http://255.255.255.255:0/test.jpg
+http://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL http://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+http://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain g-io-error-quark, code 38, failing URL "http://255.255.255.255/test.jpg">
+http://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL http://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+http://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain g-io-error-quark, code 38, failing URL "http://255.255.255.255/test.jpg">
+ftp://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL ftp://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+CONSOLE MESSAGE: FTP URLs are disabled
+CONSOLE MESSAGE: Cannot load image ftp://255.255.255.255/test.jpg due to access control checks.
+ftp://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain WebKitInternal, code 0, failing URL "ftp://255.255.255.255/test.jpg">
+ftp://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL ftp://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+CONSOLE MESSAGE: FTP URLs are disabled
+CONSOLE MESSAGE: Cannot load image ftp://255.255.255.255/test.jpg due to access control checks.
+ftp://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain WebKitInternal, code 0, failing URL "ftp://255.255.255.255/test.jpg">
+ftp://255.255.255.255:22/test.jpg - willSendRequest <NSURLRequest URL ftp://255.255.255.255:22/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+CONSOLE MESSAGE: FTP URLs are disabled
+CONSOLE MESSAGE: Cannot load image ftp://255.255.255.255:22/test.jpg due to access control checks.
+ftp://255.255.255.255:22/test.jpg - didFailLoadingWithError: <NSError domain WebKitInternal, code 0, failing URL "ftp://255.255.255.255:22/test.jpg">
+This test attempts to change the src of an IMG tag to all blocked ports to confirm that WebKit returns the correct error for them - blocked instead of cannot find. It also tries the FTP ports for exemptions. Due to the nature of this test, the results can only be processed automatically via DumpRenderTree
+
+
diff --git a/LayoutTests/platform/wpe/security/block-test-expected.txt b/LayoutTests/platform/wpe/security/block-test-expected.txt
new file mode 100644
index 000000000000..27ecb5cf99fd
--- /dev/null
+++ b/LayoutTests/platform/wpe/security/block-test-expected.txt
@@ -0,0 +1,91 @@
+CONSOLE MESSAGE: Not allowed to use restricted network port 1: http://255.255.255.255:1/test.jpg
+block-test.html - didFinishLoading
+CONSOLE MESSAGE: Not allowed to use restricted network port 7: http://255.255.255.255:7/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 9: http://255.255.255.255:9/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 11: http://255.255.255.255:11/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 13: http://255.255.255.255:13/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 15: http://255.255.255.255:15/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 17: http://255.255.255.255:17/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 19: http://255.255.255.255:19/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 20: http://255.255.255.255:20/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 21: http://255.255.255.255:21/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 22: http://255.255.255.255:22/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 23: http://255.255.255.255:23/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 25: http://255.255.255.255:25/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 37: http://255.255.255.255:37/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 42: http://255.255.255.255:42/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 43: http://255.255.255.255:43/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 53: http://255.255.255.255:53/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 77: http://255.255.255.255:77/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 79: http://255.255.255.255:79/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 87: http://255.255.255.255:87/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 95: http://255.255.255.255:95/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 101: http://255.255.255.255:101/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 102: http://255.255.255.255:102/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 103: http://255.255.255.255:103/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 104: http://255.255.255.255:104/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 109: http://255.255.255.255:109/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 110: http://255.255.255.255:110/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 111: http://255.255.255.255:111/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 113: http://255.255.255.255:113/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 115: http://255.255.255.255:115/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 117: http://255.255.255.255:117/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 119: http://255.255.255.255:119/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 123: http://255.255.255.255:123/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 135: http://255.255.255.255:135/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 139: http://255.255.255.255:139/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 143: http://255.255.255.255:143/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 179: http://255.255.255.255:179/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 389: http://255.255.255.255:389/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 465: http://255.255.255.255:465/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 512: http://255.255.255.255:512/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 513: http://255.255.255.255:513/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 514: http://255.255.255.255:514/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 515: http://255.255.255.255:515/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 526: http://255.255.255.255:526/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 530: http://255.255.255.255:530/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 531: http://255.255.255.255:531/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 532: http://255.255.255.255:532/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 540: http://255.255.255.255:540/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 548: http://255.255.255.255:548/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 556: http://255.255.255.255:556/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 563: http://255.255.255.255:563/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 587: http://255.255.255.255:587/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 601: http://255.255.255.255:601/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 636: http://255.255.255.255:636/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 993: http://255.255.255.255:993/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 995: http://255.255.255.255:995/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 2049: http://255.255.255.255:2049/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 3659: http://255.255.255.255:3659/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 4045: http://255.255.255.255:4045/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 4190: http://255.255.255.255:4190/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6000: http://255.255.255.255:6000/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6665: http://255.255.255.255:6665/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6666: http://255.255.255.255:6666/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6667: http://255.255.255.255:6667/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6668: http://255.255.255.255:6668/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6669: http://255.255.255.255:6669/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6679: http://255.255.255.255:6679/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6697: http://255.255.255.255:6697/test.jpg
+http://255.255.255.255:65535/test.jpg - willSendRequest <NSURLRequest URL http://255.255.255.255:65535/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+http://255.255.255.255:65535/test.jpg - didFailLoadingWithError: <NSError domain g-io-error-quark, code 38, failing URL "http://255.255.255.255:65535/test.jpg">
+CONSOLE MESSAGE: Not allowed to use restricted network port 0: http://255.255.255.255:0/test.jpg
+http://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL http://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+http://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain g-io-error-quark, code 38, failing URL "http://255.255.255.255/test.jpg">
+http://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL http://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+http://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain g-io-error-quark, code 38, failing URL "http://255.255.255.255/test.jpg">
+ftp://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL ftp://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+CONSOLE MESSAGE: FTP URLs are disabled
+CONSOLE MESSAGE: Cannot load image ftp://255.255.255.255/test.jpg due to access control checks.
+ftp://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain WebKitInternal, code 0, failing URL "ftp://255.255.255.255/test.jpg">
+ftp://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL ftp://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+CONSOLE MESSAGE: FTP URLs are disabled
+CONSOLE MESSAGE: Cannot load image ftp://255.255.255.255/test.jpg due to access control checks.
+ftp://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain WebKitInternal, code 0, failing URL "ftp://255.255.255.255/test.jpg">
+ftp://255.255.255.255:22/test.jpg - willSendRequest <NSURLRequest URL ftp://255.255.255.255:22/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+CONSOLE MESSAGE: FTP URLs are disabled
+CONSOLE MESSAGE: Cannot load image ftp://255.255.255.255:22/test.jpg due to access control checks.
+ftp://255.255.255.255:22/test.jpg - didFailLoadingWithError: <NSError domain WebKitInternal, code 0, failing URL "ftp://255.255.255.255:22/test.jpg">
+This test attempts to change the src of an IMG tag to all blocked ports to confirm that WebKit returns the correct error for them - blocked instead of cannot find. It also tries the FTP ports for exemptions. Due to the nature of this test, the results can only be processed automatically via DumpRenderTree
+
+

Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker.

References

Vendor advisory Fix commit Bug tracker NVD

On This Page