← WebKit — 2026-W36
f2a07be9fb7478e9b44a6ed50a7b9f07b8c793b1 WKWebView does not enforce CORS response header validation for apps' custom schemes after registerURLSchemeAsCORSEnabled()
severity medium
class CrossOrigin
confidence 0.65
signal score 8.07
Source/WebCore/loader
patch-now
Primitive: Web (http/https) content could issue cross-origin no-cors subresource loads into a custom WKURLSchemeHandler app scheme and probe its contents.
Triage note: CachedResourceLoader::canRequest/canRequestAfterRedirection add isNoCorsCrossOriginRequestToURLSchemeHandler, which blocks no-cors cross-scheme subresource loads to custom scheme-handler schemes (excluding http-family, webkit-extension, and same-scheme/app-loaded origins) when origin->canRequest fails, enforcing SOP against app custom schemes. DocumentThreadableLoader also skips the redirect same-URL guess for scheme-handler URLs.
Triage note: CachedResourceLoader::canRequest/canRequestAfterRedirection add isNoCorsCrossOriginRequestToURLSchemeHandler, which blocks no-cors cross-scheme subresource loads to custom scheme-handler schemes (excluding http-family, webkit-extension, and same-scheme/app-loaded origins) when origin->canRequest fails, enforcing SOP against app custom schemes. DocumentThreadableLoader also skips the redirect same-URL guess for scheme-handler URLs.
Structural signals: smartptr_member_added (+4.87), null_guard (+1.2), area:Source/WebCore/loader (+2.0)
Commit message
WKWebView does not enforce CORS response header validation for apps' custom schemes after registerURLSchemeAsCORSEnabled()
rdar://174287004
Reviewed by Chris Dumez.
We mean for app provided custom URL schemes to participate in CORS, but our implementation had a few holes.
- The network process was never informed of the custom scheme registrations
- Some types of requests that would never hit the network process skipped needed checks in the web process.
A lot of care was taken to make sure app-provided content still works with custom schemes as it always had.
This patch makes those changes and tests them.
Tests: Tools/TestWebKitAPI/Tests/WebKitCocoa/CreateWebArchive.mm
Tools/TestWebKitAPI/Tests/WebKitCocoa/WKURLSchemeHandler-1.mm
Tools/TestWebKitAPI/Tests/WebKitCocoa/WebsitePolicies.mm
* Source/WebCore/loader/DocumentThreadableLoader.cpp:
(WebCore::DocumentThreadableLoader::loadRequest):
* Source/WebCore/loader/cache/CachedResourceLoader.cpp:
(WebCore::CachedResourceLoader::canRequest):
(WebCore::CachedResourceLoader::canRequestAfterRedirection const):
(WebCore::CachedResourceLoader::isNoCorsCrossOriginRequestToURLSchemeHandler const):
* Source/WebCore/loader/cache/CachedResourceLoader.h:
* Source/WebCore/platform/LegacySchemeRegistry.cpp:
(WebCore::LegacySchemeRegistry::isBuiltInWebKitHandledScheme):
(WebCore::LegacySchemeRegistry::registerURLSchemeAsCORSEnabled):
* Source/WebCore/platform/LegacySchemeRegistry.h:
* Source/WebKit/NetworkProcess/NetworkProcess.h:
* Source/WebKit/WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::registerURLSchemeHandler):
* Source/WebKit/WebProcess/WebProcess.cpp:
(WebKit::WebProcess::registerURLSchemeAsCORSEnabled):
* Source/WebKit/WebProcess/WebProcess.h:
* Tools/TestWebKitAPI/Tests/WebKitCocoa/CreateWebArchive.mm:
(TestWebKitAPI::(WebArchive, CreateCustomScheme)):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/WKURLSchemeHandler-1.mm:
(TEST(URLSchemeHandler, BasicWithHTTPS)):
((URLSchemeHandler, DisableCORSCanvas)):
((URLSchemeHandler, SameSchemeSubresourcesAllowed)):
((URLSchemeHandler, CrossOriginNoCorsSubresourcesBlocked)):
((URLSchemeHandler, CrossOriginIframeCORSEnforcementForCustomScheme)):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/WebsitePolicies.mm:
Originally-landed-as: 305413.959@safari-7624-branch (1011610c6800). rdar://184744641
Canonical link: https://commits.webkit.org/320522@main
Before / after
Loading diff…
On This Page