Skip to content
Permalink
Browse files
Prevent NSAttributedString crashes when AppSSO URLs are provided
https://bugs.webkit.org/show_bug.cgi?id=240739
<rdar://93656000>

Reviewed by Chris Dumez.

When NSAttributedString is used in a sandboxed app, it is prevented from checking in with the
AppSSO plugin manager, causing a Sandbox Violation and crash. We don't want NSAttributedString
to ever hand-off to AppSSO, so we should configure it's internal WKWebView to do the right thing.
Reviewed by Chris Dumez.

* Source/WebKit/UIProcess/API/Cocoa/NSAttributedString.mm:
(+[_WKAttributedStringWebViewCache configuration]): Turn off AppSSO for string uses.
* Source/WebKit/UIProcess/Cocoa/NavigationState.mm:
(WebKit::trySOAuthorization): Use new lazy loading approach.
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::trySOAuthorization): Ditto.
* Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.cpp:
(WebKit::WebsiteDataStore::WebsiteDataStore):
(WebKit::WebsiteDataStore::soAuthorizationCoordinator): Lazily initialize, and RELEASE_ASSERT
if we somehow reach this code without enabling AppSSO.
* Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.h:
(WebKit::WebsiteDataStore::soAuthorizationCoordinator): Deleted.

Canonical link: https://commits.webkit.org/250981@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@294831 268f45cc-cd09-0410-ab3c-d52691b4dbfc
  • Loading branch information
brentfulgham committed May 25, 2022
1 parent b9964a9 commit f3f187aeda4ffc5ee0edfda8ecd26ac0d3c38a7b
Showing 5 changed files with 19 additions and 10 deletions.
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2019 Apple Inc. All rights reserved.
* Copyright (C) 2019-2022 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -144,6 +144,7 @@ + (WKWebViewConfiguration *)configuration
[configuration _setAllowsJavaScriptMarkup:NO];
[configuration _setAllowsMetaRefresh:NO];
[configuration _setAttachmentElementEnabled:YES];
[configuration preferences]._extensibleSSOEnabled = NO;
[configuration _setInvisibleAutoplayNotPermitted:YES];
[configuration _setMediaDataLoadsAutomatically:NO];
[configuration _setNeedsStorageAccessFromFileURLsQuirk:NO];
@@ -424,7 +424,7 @@ static void trySOAuthorization(Ref<API::NavigationAction>&& navigationAction, We
completionHandler(false);
return;
}
page.websiteDataStore().soAuthorizationCoordinator().tryAuthorize(WTFMove(navigationAction), page, WTFMove(completionHandler));
page.websiteDataStore().soAuthorizationCoordinator(page).tryAuthorize(WTFMove(navigationAction), page, WTFMove(completionHandler));
#else
completionHandler(false);
#endif
@@ -5996,7 +5996,7 @@ using UIClientCallback = Function<void(Ref<API::NavigationAction>&&, NewPageCall
static void trySOAuthorization(Ref<API::NavigationAction>&& navigationAction, WebPageProxy& page, NewPageCallback&& newPageCallback, UIClientCallback&& uiClientCallback)
{
#if HAVE(APP_SSO)
page.websiteDataStore().soAuthorizationCoordinator().tryAuthorize(WTFMove(navigationAction), page, WTFMove(newPageCallback), WTFMove(uiClientCallback));
page.websiteDataStore().soAuthorizationCoordinator(page).tryAuthorize(WTFMove(navigationAction), page, WTFMove(newPageCallback), WTFMove(uiClientCallback));
#else
uiClientCallback(WTFMove(navigationAction), WTFMove(newPageCallback));
#endif
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2014-2020 Apple Inc. All rights reserved.
* Copyright (C) 2014-2022 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -135,9 +135,6 @@ WebsiteDataStore::WebsiteDataStore(Ref<WebsiteDataStoreConfiguration>&& configur
, m_authenticatorManager(makeUniqueRef<AuthenticatorManager>())
#endif
, m_client(makeUniqueRef<WebsiteDataStoreClient>())
#if HAVE(APP_SSO)
, m_soAuthorizationCoordinator(makeUniqueRef<SOAuthorizationCoordinator>())
#endif
, m_webLockRegistry(WebCore::LocalWebLockRegistry::create())
{
WTF::setProcessPrivileges(allPrivileges());
@@ -208,6 +205,17 @@ WebsiteDataStore* WebsiteDataStore::existingDataStoreForSessionID(PAL::SessionID
return allDataStores().get(sessionID);
}

#if HAVE(APP_SSO)
SOAuthorizationCoordinator& WebsiteDataStore::soAuthorizationCoordinator(const WebPageProxy& pageProxy)
{
RELEASE_ASSERT(pageProxy.preferences().isExtensibleSSOEnabled());
if (!m_soAuthorizationCoordinator)
m_soAuthorizationCoordinator = WTF::makeUnique<SOAuthorizationCoordinator>();

return *m_soAuthorizationCoordinator;
}
#endif

static Ref<NetworkProcessProxy> networkProcessForSession(PAL::SessionID sessionID)
{
#if PLATFORM(GTK) || PLATFORM(WPE)
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2014-2020 Apple Inc. All rights reserved.
* Copyright (C) 2014-2022 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -336,7 +336,7 @@ class WebsiteDataStore : public API::ObjectImpl<API::Object::Type::WebsiteDataSt
#endif

#if HAVE(APP_SSO)
SOAuthorizationCoordinator& soAuthorizationCoordinator() { return m_soAuthorizationCoordinator.get(); }
SOAuthorizationCoordinator& soAuthorizationCoordinator(const WebPageProxy&);
#endif

static WTF::String defaultServiceWorkerRegistrationDirectory();
@@ -488,7 +488,7 @@ class WebsiteDataStore : public API::ObjectImpl<API::Object::Type::WebsiteDataSt
RefPtr<NetworkProcessProxy> m_networkProcess;

#if HAVE(APP_SSO)
UniqueRef<SOAuthorizationCoordinator> m_soAuthorizationCoordinator;
std::unique_ptr<SOAuthorizationCoordinator> m_soAuthorizationCoordinator;
#endif
#if ENABLE(INTELLIGENT_TRACKING_PREVENTION)
mutable std::optional<WebCore::ThirdPartyCookieBlockingMode> m_thirdPartyCookieBlockingMode; // Lazily computed.

0 comments on commit f3f187a

Please sign in to comment.