← WebKit — 2026-W37
1b00bc4536dcc4869b04349e2aff2bd77d28041a Seed a document's own IP address space
severity low
class PolicyBypass
confidence 0.3
signal score 6.95
Source/WebCore/loader
Primitive: blob/inherited document receiving wrong IP address space for Private Network Access classification
Triage note: Plumbs IPAddressSpace onto responses (soup), inherits it to blob documents from the initiator's policy container and to owner-inherited documents, adds it to PolicyContainer and an Internals test hook. Mostly Private Network Access feature build-out; the blob: inheritance is a classification correctness detail, not a demonstrated reachable bypass.
Triage note: Plumbs IPAddressSpace onto responses (soup), inherits it to blob documents from the initiator's policy container and to owner-inherited documents, adds it to PolicyContainer and an Internals test hook. Mostly Private Network Access feature build-out; the blob: inheritance is a classification correctness detail, not a demonstrated reachable bypass.
Structural signals: smartptr_member_added (+3.0), null_guard (+1.95), area:Source/WebCore/loader (+2.0)
Commit message
Seed a document's own IP address space
https://bugs.webkit.org/show_bug.cgi?id=323138
rdar://186398120
Reviewed by Youenn Fablet.
Feature work for Local Network Access (https://wicg.github.io/local-network-access/).
Every publicness comparison the feature makes is against the requesting document's own address
space, and nothing set it: PolicyContainer::ipAddressSpace existed but was never assigned, so every
document read the default of Public. This seeds it from the response in
FrameLoader::didBeginDocument and copies it on the javascript:/about: path in
DocumentWriter::begin. It was also missing from the struct's serialization entry, so it never
crossed IPC and subframes read Public whatever the parent had; padding absorbed the field, so the
generated size assertion could not catch that.
A blob: URL is a local scheme, so HTML's "determine navigation params policy container" takes the
initiator's policy container for it rather than building one from the response. That is applied in
DocumentLoader::responseReceived, where the response is committed, so
documentLoader->response().ipAddressSpace() answers correctly for every reader instead of each one
needing to special-case blob. With no initiator the response keeps its undetermined space and the
document keeps the Public default.
NetworkDataTaskSoup had no address space at all, so a GTK or WPE document had nothing to be seeded
from. It is derived in the ResourceResponse constructor that already takes the SoupMessage, next to
the TLS certificate and status it reads from the same message, so it is set once for every soup
response rather than by the caller. The curl ports still have no classifier, so on Windows the space
stays undetermined exactly as it does today.
internals.documentIPAddressSpace() is added because the value is otherwise invisible from a page.
It returns a string so that "unknown" is expressible, which the IDL enum has no member for.
* LayoutTests/http/wpt/fetch/local-network-access/document-address-space-expected.txt: Added.
* LayoutTests/http/wpt/fetch/local-network-access/document-address-space.html: Added.
* Source/WebCore/loader/DocumentLoader.cpp:
(WebCore::DocumentLoader::responseReceived):
* Source/WebCore/loader/DocumentWriter.cpp:
(WebCore::DocumentWriter::begin):
* Source/WebCore/loader/FrameLoader.cpp:
(WebCore::FrameLoader::didBeginDocument):
* Source/WebCore/platform/network/soup/ResourceResponseSoup.cpp:
(WebCore::resolvedIPAddressSpace):
(WebCore::ResourceResponse::ResourceResponse):
* Source/WebCore/testing/Internals.cpp:
(WebCore::Internals::documentIPAddressSpace const):
* Source/WebCore/testing/Internals.h:
* Source/WebCore/testing/Internals.idl:
* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:
Canonical link: https://commits.webkit.org/320955@main
Before / after
Loading diff…
On This Page