← WebKit — 2026-W35
0748de3348707dfdfb3bb4c2c295979833a654ab Incomplete replacementPath validation in NetworkConnectionToWebProcess::registerInternalFileBlobURL
severity low
class AuthorizationError
confidence 0.3
signal score 8.2
Source/WebCore/html
Primitive: transcoded-file blob registration path-allow checks reworked for image transcoding over IPC
Triage note: Routes image transcoding through Chrome::transcodeChosenFiles/WebPageProxy IPC and replaces the sandbox_check on replacementPath in registerInternalFileBlobURL with isFilePathAllowed plus AllowFilesAccessFromWebProcess grants. Largely plumbing/refactor of sandbox file-access handling; no single concrete bug clearly fixed in this diff.
Triage note: Routes image transcoding through Chrome::transcodeChosenFiles/WebPageProxy IPC and replaces the sandbox_check on replacementPath in registerInternalFileBlobURL with isFilePathAllowed plus AllowFilesAccessFromWebProcess grants. Largely plumbing/refactor of sandbox file-access handling; no single concrete bug clearly fixed in this diff.
Structural signals: smartptr_member_added (+3.0), null_guard (+1.95), uaf_lifetime (+4.75), msg_soft (+1.0), msg_noise (-2.5), area:Source/WebCore/html (+2.0), large_churn (-2.0)
Commit message
Incomplete replacementPath validation in NetworkConnectionToWebProcess::registerInternalFileBlobURL
rdar://176890926
Reviewed by Chris Dumez.
We cannot easily validate that a sandbox extension is valid or related to a specific file.
We thus stop validating the sandbox extension and only rely on the allowed file path check.
This ensures that a web process can only create blobs from a file that the UIProcess deemed appropriate (via direct UIProcess/NetworkProcess IPC).
Two code paths need to be updated to not break existing functionality:
1. Image transcoding for files dropped on <input type=file> was previoulsy done in WebProcess.
We move this to UIProcess via ChromeClient::transcodeChosenFiles, with a default implementation
that preserves the previous in-WebProcess behavior by dispatching to the shared transcoding queue.
WebChromeClient is implementing out-of-process transcoding by asking WebPageProxy via IPC to do the work.
WebPageProxy does this and makes sure to notify network process that the transcoded files can be accessed.
2. WebPageProxy::didChooseFilesForOpenPanelWithImageTranscoding needs to make sure to allow access of these files
from the network process. Once this is done, it notifies the WebProcess of the result as before.
We do a small refactoring by factoring the queue dispatch + main-thread hop into transcodeImagesInBackgroundQueue.
Call sites like the default ChromeClient implementation and WebPageProxy::transcodeChosenFiles no longer manage cross-thread copies.
Manually tested.
* Source/WebCore/html/FileInputType.cpp:
(WebCore::FileInputType::receiveDroppedFilesWithImageTranscoding):
* Source/WebCore/page/Chrome.cpp:
(WebCore::Chrome::transcodeChosenFiles):
* Source/WebCore/page/Chrome.h:
* Source/WebCore/page/ChromeClient.cpp:
(WebCore::ChromeClient::transcodeChosenFiles):
* Source/WebCore/page/ChromeClient.h:
* Source/WebCore/platform/graphics/ImageUtilities.h:
* Source/WebCore/platform/graphics/cg/ImageUtilitiesCG.cpp:
(WebCore::transcodeImages):
(WebCore::transcodeImagesInBackgroundQueue):
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::registerInternalFileBlobURL):
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::didChooseFilesForOpenPanelWithImageTranscoding):
(WebKit::WebPageProxy::transcodeChosenFiles):
* Source/WebKit/UIProcess/WebPageProxy.h:
* Source/WebKit/UIProcess/WebPageProxy.messages.in:
* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp:
(WebKit::WebChromeClient::transcodeChosenFiles):
* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.h:
Originally-landed-as: [email protected] (1c3f0755c46a). rdar://185369553
Canonical link: https://commits.webkit.org/319864@main
Before / after
Loading diff…
On This Page