[Model Element] Require CORS for loading model sources and environment maps by achan00 · Pull Request #45447 · WebKit/WebKit

achan00 · 2025-05-15T21:28:16Z

`74ab595`

[Model Element] Require CORS for loading model sources and environment maps
https://bugs.webkit.org/show_bug.cgi?id=293063
rdar://151364606

Reviewed by Youenn Fablet and Anne van Kesteren.

Make sure CORS is always enabled with model source and environment
map requests, by passing a non-null crossorigin attribute to
createPotentialAccessControlRequest().

Also make sure we null out m_model once source is reset.

* LayoutTests/TestExpectations:
* LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-all-access-header-expected.txt: Added.
* LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-all-access-header.html: Added.
* LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-header-expected.txt: Added.
* LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-header.html: Added.
* LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-same-origin-expected.txt: Added.
* LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-same-origin.html: Added.
* LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-with-header-expected.txt: Added.
* LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-with-header.html: Added.
* LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-with-use-credentials-and-all-access-header-expected.txt: Added.
* LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-with-use-credentials-and-all-access-header.html: Added.
* LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-without-header-expected.txt: Added.
* LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-without-header.html: Added.
* LayoutTests/http/tests/security/resources/cube.usdz: Added.
* LayoutTests/http/tests/security/resources/model-access-control.py: Added.
* Source/WebCore/Modules/model-element/HTMLModelElement.cpp:
(WebCore::HTMLModelElement::setSourceURL):
(WebCore::HTMLModelElement::environmentMapRequestResource):

Canonical link: https://commits.webkit.org/295219@main

2409c48

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	~~🛠 win~~
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	~~🧪 wpe-wk2~~	~~🧪 win-tests~~
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe
	~~🧪 ios-wk2-wpt~~	✅ 🧪 mac-wk1	❌ 🛠 wpe-cairo
	~~🧪 api-ios~~	✅ 🧪 mac-wk2	✅ 🛠 gtk
	✅ 🛠 vision	~~🧪 mac-AS-debug-wk2~~	~~🧪 gtk-wk2~~
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
✅ 🛠 🧪 merge	✅ 🧪 vision-wk2	✅ 🧪 mac-intel-wk2	✅ 🛠 playstation
	✅ 🛠 tv	~~🛠 mac-safer-cpp~~
	✅ 🛠 tv-sim
	✅ 🛠 watch
	~~🛠 watch-sim~~

webkit-early-warning-system · 2025-05-15T21:28:25Z

EWS run on previous version of this PR (hash c45724a)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	~~🛠 wpe~~	~~🛠 win~~
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	~~🧪 wpe-wk2~~	~~🧪 win-tests~~
✅ 🧪 webkitperl	~~🧪 ios-wk2~~	~~🧪 api-mac~~	~~🧪 api-wpe~~
	~~🧪 ios-wk2-wpt~~	~~🧪 mac-wk1~~	~~🛠 wpe-cairo~~
	~~🧪 api-ios~~	~~🧪 mac-wk2~~	~~🛠 gtk~~
	✅ 🛠 vision	~~🧪 mac-AS-debug-wk2~~	~~🧪 gtk-wk2~~
	✅ 🛠 vision-sim	~~🧪 mac-wk2-stress~~	~~🧪 api-gtk~~
	~~🧪 vision-wk2~~	~~🧪 mac-intel-wk2~~	~~🛠 playstation~~
	✅ 🛠 tv	✅ 🛠 mac-safer-cpp
	~~🛠 tv-sim~~
	✅ 🛠 watch
	~~🛠 watch-sim~~

webkit-early-warning-system · 2025-05-15T21:30:54Z

EWS run on previous version of this PR (hash f57ea62)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 win
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	⏳ 🧪 win-tests
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe
	⏳ 🧪 ios-wk2-wpt	✅ 🧪 mac-wk1	✅ 🛠 wpe-cairo
	⏳ 🧪 api-ios	✅ 🧪 mac-wk2	✅ 🛠 gtk
	✅ 🛠 vision	⏳ 🧪 mac-AS-debug-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
	✅ 🧪 vision-wk2	⏳ 🧪 mac-intel-wk2	✅ 🛠 playstation
	✅ 🛠 tv	✅ 🛠 mac-safer-cpp
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

achan00 · 2025-05-16T03:01:14Z

Actually, this is not correct yet. I need to look more into this.

annevk · 2025-05-16T06:11:17Z

Yeah, this will hit an assert in createPotentialAccessControlRequest(). Not sure what @youennf thinks, but one thing that comes to mind is that when parseCORSSettingsAttribute returns nullString(), you use "anonymous"_s instead.

webkit-early-warning-system · 2025-05-16T07:56:15Z

EWS run on previous version of this PR (hash 0eb5c74)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 win
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	⏳ 🧪 win-tests
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe
	✅ 🧪 ios-wk2-wpt	✅ 🧪 mac-wk1	✅ 🛠 wpe-cairo
	~~🧪 api-ios~~	✅ 🧪 mac-wk2	✅ 🛠 gtk
	✅ 🛠 vision	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
	✅ 🧪 vision-wk2	✅ 🧪 mac-intel-wk2	✅ 🛠 playstation
	✅ 🛠 tv	✅ 🛠 mac-safer-cpp
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

annevk

This looks good to me, but let's wait for Youenn as well to be sure.

youennf

LGTM with a test where load would fail.

webkit-early-warning-system · 2025-05-17T23:33:37Z

EWS run on previous version of this PR (hash 282b48b)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 win
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	⏳ 🧪 win-tests
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe
	✅ 🧪 ios-wk2-wpt	✅ 🧪 mac-wk1	✅ 🛠 wpe-cairo
	❌ 🧪 api-ios	✅ 🧪 mac-wk2	✅ 🛠 gtk
	✅ 🛠 vision	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
	✅ 🧪 vision-wk2	✅ 🧪 mac-intel-wk2	✅ 🛠 playstation
	✅ 🛠 tv	✅ 🛠 mac-safer-cpp
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

webkit-early-warning-system · 2025-05-19T06:54:55Z

EWS run on previous version of this PR (hash 3aa42ef)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 win
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	⏳ 🧪 win-tests
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe
	✅ 🧪 ios-wk2-wpt	✅ 🧪 mac-wk1	✅ 🛠 wpe-cairo
	❌ 🧪 api-ios	✅ 🧪 mac-wk2	✅ 🛠 gtk
	✅ 🛠 vision	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
~~🛠 🧪 merge~~	✅ 🧪 vision-wk2	✅ 🧪 mac-intel-wk2	✅ 🛠 playstation
	✅ 🛠 tv	✅ 🛠 mac-safer-cpp
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

webkit-early-warning-system · 2025-05-20T19:02:38Z

EWS run on previous version of this PR (hash 2ec5bbd)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	~~🛠 wpe~~	~~🛠 win~~
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	~~🧪 wpe-wk2~~	~~🧪 win-tests~~
✅ 🧪 webkitperl	~~🧪 ios-wk2~~	~~🧪 api-mac~~	~~🧪 api-wpe~~
	⏳ 🧪 ios-wk2-wpt	~~🧪 mac-wk1~~	✅ 🛠 wpe-cairo
	⏳ 🧪 api-ios	~~🧪 mac-wk2~~	✅ 🛠 gtk
🛠 🧪 jsc-arm64	~~🛠 vision~~	⏳ 🧪 mac-AS-debug-wk2	~~🧪 gtk-wk2~~
🧪 services	✅ 🛠 vision-sim	~~🧪 mac-wk2-stress~~	~~🧪 api-gtk~~
	~~🧪 vision-wk2~~	⏳ 🧪 mac-intel-wk2	~~🛠 playstation~~
	✅ 🛠 tv	✅ 🛠 mac-safer-cpp
	~~🛠 tv-sim~~
	~~🛠 watch~~
	~~🛠 watch-sim~~

webkit-early-warning-system · 2025-05-20T19:07:45Z

EWS run on previous version of this PR (hash 40d70b3)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 win
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	⏳ 🧪 win-tests
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe
	~~🧪 ios-wk2-wpt~~	✅ 🧪 mac-wk1	✅ 🛠 wpe-cairo
	✅ 🧪 api-ios	✅ 🧪 mac-wk2	✅ 🛠 gtk
	✅ 🛠 vision	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
	✅ 🧪 vision-wk2	✅ 🧪 mac-intel-wk2	✅ 🛠 playstation
	✅ 🛠 tv	✅ 🛠 mac-safer-cpp
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

youennf

LGTM.
If you have some time, we could add a few additional tests:

a data URL load from a HTTP origin (should succeed)
a blob URL load from a HTTP origin (should succeed)
a file URL load from a file origin (should succeed)
a file URL load with a crossorigin attribute (whatever value, should fail)
a HTTP URL load with an empty crossorigin attribute (should be the same as anonymous).

youennf · 2025-05-21T06:34:52Z

Source/WebCore/Modules/model-element/HTMLModelElement.cpp

Suggested change

CachedResourceRequest HTMLModelElement::createResourceRequest(const URL& resourceURL, const FetchOptions::Destination& destination)

CachedResourceRequest HTMLModelElement::createResourceRequest(const URL& resourceURL, FetchOptions::Destination destination)

I'll add more tests in a separate PR.

Filed: https://bugs.webkit.org/show_bug.cgi?id=293371 (Add more tests around model source loading across different origins)

webkit-early-warning-system · 2025-05-21T16:43:50Z

EWS run on current version of this PR (hash 2409c48)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	~~🛠 win~~
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	~~🧪 wpe-wk2~~	~~🧪 win-tests~~
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe
	~~🧪 ios-wk2-wpt~~	✅ 🧪 mac-wk1	❌ 🛠 wpe-cairo
	~~🧪 api-ios~~	✅ 🧪 mac-wk2	✅ 🛠 gtk
	✅ 🛠 vision	~~🧪 mac-AS-debug-wk2~~	~~🧪 gtk-wk2~~
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
✅ 🛠 🧪 merge	✅ 🧪 vision-wk2	✅ 🧪 mac-intel-wk2	✅ 🛠 playstation
	✅ 🛠 tv	~~🛠 mac-safer-cpp~~
	✅ 🛠 tv-sim
	✅ 🛠 watch
	~~🛠 watch-sim~~

…t maps https://bugs.webkit.org/show_bug.cgi?id=293063 rdar://151364606 Reviewed by Youenn Fablet and Anne van Kesteren. Make sure CORS is always enabled with model source and environment map requests, by passing a non-null crossorigin attribute to createPotentialAccessControlRequest(). Also make sure we null out m_model once source is reset. * LayoutTests/TestExpectations: * LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-all-access-header-expected.txt: Added. * LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-all-access-header.html: Added. * LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-header-expected.txt: Added. * LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-header.html: Added. * LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-same-origin-expected.txt: Added. * LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-same-origin.html: Added. * LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-with-header-expected.txt: Added. * LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-with-header.html: Added. * LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-with-use-credentials-and-all-access-header-expected.txt: Added. * LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-with-use-credentials-and-all-access-header.html: Added. * LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-without-header-expected.txt: Added. * LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-without-header.html: Added. * LayoutTests/http/tests/security/resources/cube.usdz: Added. * LayoutTests/http/tests/security/resources/model-access-control.py: Added. * Source/WebCore/Modules/model-element/HTMLModelElement.cpp: (WebCore::HTMLModelElement::setSourceURL): (WebCore::HTMLModelElement::environmentMapRequestResource): Canonical link: https://commits.webkit.org/295219@main

webkit-commit-queue · 2025-05-21T18:31:56Z

Committed 295219@main (74ab595): https://commits.webkit.org/295219@main

Reviewed commits have been landed. Closing PR #45447 and removing active labels.

achan00 requested a review from marcoscaceres as a code owner May 15, 2025 21:28

achan00 self-assigned this May 15, 2025

achan00 added the WebKit Misc. For miscellaneous bugs in the WebKit framework (and not JavaScriptCore or WebCore). label May 15, 2025

achan00 force-pushed the eng/Model-Element-Require-CORS-for-loading-model-sources-and-environment-maps branch from c45724a to f57ea62 Compare May 15, 2025 21:30

achan00 requested review from annevk, eddydas and youennf May 15, 2025 21:31

achan00 force-pushed the eng/Model-Element-Require-CORS-for-loading-model-sources-and-environment-maps branch from f57ea62 to 0eb5c74 Compare May 16, 2025 07:56

annevk approved these changes May 16, 2025

View reviewed changes

youennf approved these changes May 16, 2025

View reviewed changes

achan00 force-pushed the eng/Model-Element-Require-CORS-for-loading-model-sources-and-environment-maps branch from 0eb5c74 to 282b48b Compare May 17, 2025 23:33

achan00 force-pushed the eng/Model-Element-Require-CORS-for-loading-model-sources-and-environment-maps branch from 282b48b to 3aa42ef Compare May 19, 2025 06:53

webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label May 19, 2025

achan00 added merge-queue Applied to send a pull request to merge-queue merging-blocked Applied to prevent a change from being merged and removed merging-blocked Applied to prevent a change from being merged merge-queue Applied to send a pull request to merge-queue labels May 19, 2025

achan00 force-pushed the eng/Model-Element-Require-CORS-for-loading-model-sources-and-environment-maps branch from 3aa42ef to 2ec5bbd Compare May 20, 2025 19:02

achan00 force-pushed the eng/Model-Element-Require-CORS-for-loading-model-sources-and-environment-maps branch from 2ec5bbd to 40d70b3 Compare May 20, 2025 19:06

youennf approved these changes May 21, 2025

View reviewed changes

achan00 force-pushed the eng/Model-Element-Require-CORS-for-loading-model-sources-and-environment-maps branch from 40d70b3 to 2409c48 Compare May 21, 2025 16:43

achan00 added the merge-queue Applied to send a pull request to merge-queue label May 21, 2025

webkit-commit-queue force-pushed the eng/Model-Element-Require-CORS-for-loading-model-sources-and-environment-maps branch from 2409c48 to 74ab595 Compare May 21, 2025 18:31

webkit-commit-queue merged commit 74ab595 into WebKit:main May 21, 2025

webkit-commit-queue removed the merge-queue Applied to send a pull request to merge-queue label May 21, 2025

	CachedResourceRequest HTMLModelElement::createResourceRequest(const URL& resourceURL, const FetchOptions::Destination& destination)
	CachedResourceRequest HTMLModelElement::createResourceRequest(const URL& resourceURL, FetchOptions::Destination destination)

Conversation

achan00 commented May 15, 2025 • edited by webkit-early-warning-system Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

74ab595

Uh oh!

webkit-early-warning-system commented May 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webkit-early-warning-system commented May 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

achan00 commented May 16, 2025

Uh oh!

annevk commented May 16, 2025

Uh oh!

webkit-early-warning-system commented May 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

annevk left a comment

Choose a reason for hiding this comment

Uh oh!

youennf left a comment

Choose a reason for hiding this comment

Uh oh!

webkit-early-warning-system commented May 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webkit-early-warning-system commented May 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webkit-early-warning-system commented May 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webkit-early-warning-system commented May 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

youennf left a comment

Choose a reason for hiding this comment

Uh oh!

youennf May 21, 2025

Choose a reason for hiding this comment

Uh oh!

achan00 May 21, 2025

Choose a reason for hiding this comment

Uh oh!

achan00 May 21, 2025

Choose a reason for hiding this comment

Uh oh!

webkit-early-warning-system commented May 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webkit-commit-queue commented May 21, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

achan00 commented May 15, 2025 •

edited by webkit-early-warning-system

Loading

`74ab595`

webkit-early-warning-system commented May 15, 2025 •

edited

Loading

webkit-early-warning-system commented May 15, 2025 •

edited

Loading

webkit-early-warning-system commented May 16, 2025 •

edited

Loading

webkit-early-warning-system commented May 17, 2025 •

edited

Loading

webkit-early-warning-system commented May 19, 2025 •

edited

Loading

webkit-early-warning-system commented May 20, 2025 •

edited

Loading

webkit-early-warning-system commented May 20, 2025 •

edited

Loading

webkit-early-warning-system commented May 21, 2025 •

edited

Loading