← WebKit — 2026-W36
e65c18148ecd4d9ff6d7789362db77cbac61088e WebExtensionURLSchemeHandler Serves /data:, URL Path as Extension-Origin Resource.
severity medium
class PolicyBypass
confidence 0.62
signal score 6.47
Source/WebKit/UIProcess
patch-now
Primitive: The extension URL scheme handler resolved inline data:/symbol: resource paths, letting a request to the extension scheme decode arbitrary data URLs instead of only serving real extension files.
Triage note: The non-RC_REMOVE_SEC_ACCEL_3 branch adds an AllowInlineResourceURLs parameter to WebExtension::resourceDataForPath and gates the data:/symbol: handling behind it, while WebExtensionURLSchemeHandlerCocoa now passes AllowInlineResourceURLs::No. This blocks web-reachable extension-scheme requests from resolving inline resource URLs (Cocoa and GLib ports).
Triage note: The non-RC_REMOVE_SEC_ACCEL_3 branch adds an AllowInlineResourceURLs parameter to WebExtension::resourceDataForPath and gates the data:/symbol: handling behind it, while WebExtensionURLSchemeHandlerCocoa now passes AllowInlineResourceURLs::No. This blocks web-reachable extension-scheme requests from resolving inline resource URLs (Cocoa and GLib ports).
Structural signals: smartptr_member_added (+6.47)
Commit message
WebExtensionURLSchemeHandler Serves /data:, URL Path as Extension-Origin Resource.
https://webkit.org/b/323361
rdar://182129440
Reviewed by Kiara Rose.
A resource request to a web extension whose path looked like an inline data URL had its contents decoded and
served as a document from the extension's origin, instead of being resolved to a file in the extension's
bundle. This let web content run in the extension's origin.
Require resources loaded over the extension URL scheme to resolve to a file inside the code-signed extension
bundle. Inline data: and symbol: URLs remain supported where extensions legitimately use them, such as icons,
but not for a resource request.
Test: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionController.mm
* Source/WebKit/UIProcess/Extensions/WebExtension.h:
Declare AllowInlineResourceURLs and add the resourceDataForPath parameter.
* Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionCocoa.mm:
(WebKit::WebExtension::resourceDataForPath): Gate the data:/symbol: decode on AllowInlineResourceURLs::Yes.
* Source/WebKit/UIProcess/Extensions/glib/WebExtensionGLib.cpp:
(WebKit::WebExtension::resourceDataForPath): Ditto.
* Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionURLSchemeHandlerCocoa.mm:
(WebKit::WebExtensionURLSchemeHandler::platformStartTask): Pass AllowInlineResourceURLs::No.
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionController.mm:
(TestWebKitAPI::TEST(WKWebExtensionController, DataURLResourcePathsAreNotServed)): Added.
Identifier: 316606.645@safari-7625-branch
Before / after
Loading diff…
On This Page