Implement navigation rate limiter to prevent recursive navigation crashes by roberto-apple · Pull Request #52691 · WebKit/WebKit

roberto-apple · 2025-10-20T23:07:31Z

`b97666d`

Implement navigation rate limiter to prevent recursive navigation crashes
https://bugs.webkit.org/show_bug.cgi?id=301144
rdar://161094454

Reviewed by NOBODY (OOPS!).

Recursive navigation.navigate() calls from event listeners can trigger stack overflow.
During resource cleanup for a ReadableStream, this causes an exception assertion in
ReadableStreamDefaultController. However, clearing the exception locally
simply reveals more downstream assertions, pointing to a need to prevent
stack overflow from occuring instead.

Add a sliding window rate limiter (100 navigations per 5 second window)
to prevent IPC flooding and stack overflow from recursive calls.
This matches Chromium's sustained rate (~20 navigations/second).

Tests: navigation-api/navigation-api-rate-limit-exceeded.html
       navigation-api/navigation-api-rate-limit-readable-stream-no-crash.html
       navigation-api/navigation-api-rate-limit-window-reset.html

* LayoutTests/navigation-api/navigation-api-rate-limit-exceeded-expected.txt: Added.
* LayoutTests/navigation-api/navigation-api-rate-limit-exceeded.html: Added.
* LayoutTests/navigation-api/navigation-api-rate-limit-readable-stream-no-crash-expected.txt: Added.
* LayoutTests/navigation-api/navigation-api-rate-limit-readable-stream-no-crash.html: Added.
* LayoutTests/navigation-api/navigation-api-rate-limit-window-reset-expected.txt: Added.
* LayoutTests/navigation-api/navigation-api-rate-limit-window-reset.html: Added.
* Source/WebCore/page/LocalDOMWindow.h:
* Source/WebCore/page/Navigation.cpp:
(WebCore::Navigation::innerDispatchNavigateEvent):
(WebCore::Navigation::RateLimiter::navigationAllowed):
* Source/WebCore/page/Navigation.h:
* Source/WebCore/testing/Internals.cpp:
(WebCore::Internals::setNavigationRateLimiterParameters):
(WebCore::Internals::resetNavigationRateLimiter):
* Source/WebCore/testing/Internals.h:
* Source/WebCore/testing/Internals.idl:

b97666d

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 win	✅ 🛠 ios-apple
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	✅ 🧪 win-tests	✅ 🛠 mac-apple
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe		✅ 🛠 vision-apple
	✅ 🧪 ios-wk2-wpt	✅ 🧪 mac-wk1	✅ 🛠 wpe-cairo
	✅ 🧪 api-ios	✅ 🧪 mac-wk2	✅ 🛠 gtk
	✅ 🛠 vision	❌ 🧪 mac-AS-debug-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
	✅ 🧪 vision-wk2	✅ 🧪 mac-intel-wk2	✅ 🛠 playstation
	✅ 🛠 tv	✅ 🛠 mac-safer-cpp
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

webkit-early-warning-system · 2025-10-20T23:07:37Z

EWS run on previous version of this PR (hash e87e08f)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 win	✅ 🛠 ios-apple
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	✅ 🧪 win-tests	✅ 🛠 mac-apple
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe		✅ 🛠 vision-apple
	✅ 🧪 ios-wk2-wpt	❌ 🧪 mac-wk1	✅ 🛠 wpe-cairo
	✅ 🧪 api-ios	✅ 🧪 mac-wk2	✅ 🛠 gtk
	✅ 🛠 vision	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
	✅ 🧪 vision-wk2	✅ 🧪 mac-intel-wk2	✅ 🛠 playstation
	✅ 🛠 tv	✅ 🛠 mac-safer-cpp
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

webkit-early-warning-system · 2025-10-21T20:46:17Z

EWS run on previous version of this PR (hash f754826)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 win	✅ 🛠 ios-apple
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	❌ 🧪 win-tests	✅ 🛠 mac-apple
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe		✅ 🛠 vision-apple
	✅ 🧪 ios-wk2-wpt	✅ 🧪 mac-wk1	✅ 🛠 wpe-cairo
	✅ 🧪 api-ios	✅ 🧪 mac-wk2	✅ 🛠 gtk
	✅ 🛠 vision	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
	✅ 🧪 vision-wk2	✅ 🧪 mac-intel-wk2	✅ 🛠 playstation
	✅ 🛠 tv	❌ 🛠 mac-safer-cpp
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

roberto-apple · 2025-10-21T21:41:47Z

Source/WebCore/page/Navigation.h

@@ -230,6 +232,25 @@ class Navigation final : public RefCounted<Navigation>, public EventTarget, publ
    RefPtr<NavigationAPIMethodTracker> m_upcomingNonTraverseMethodTracker;
    HashMap<String, Ref<NavigationAPIMethodTracker>> m_upcomingTraverseMethodTrackers;
    WeakHashSet<AbortHandler> m_abortHandlers;
+
+    static constexpr int maxNavigateCalls { 64 };


Arbitrary constant for now

I'm not sure how this number is practical.

webkit-ews-buildbot · 2025-10-21T22:41:25Z

Safer C++ Build #60121 (`f754826`)

❌ Found 1 failing file with 1 issue. Please address these issues before landing. See WebKit Guidelines for Safer C++ Programming.
(cc @rniwa)

basuke

As we talked offline, we should align the Chrome behavior. But crashing easily like this is not the great situation.

Source/WebCore/page/Navigation.cpp

basuke · 2025-10-22T00:03:59Z

Source/WebCore/page/Navigation.h

@@ -230,6 +232,25 @@ class Navigation final : public RefCounted<Navigation>, public EventTarget, publ
    RefPtr<NavigationAPIMethodTracker> m_upcomingNonTraverseMethodTracker;
    HashMap<String, Ref<NavigationAPIMethodTracker>> m_upcomingTraverseMethodTrackers;
    WeakHashSet<AbortHandler> m_abortHandlers;
+
+    static constexpr int maxNavigateCalls { 64 };


I'm not sure how this number is practical.

webkit-early-warning-system · 2025-10-26T15:02:48Z

EWS run on previous version of this PR (hash 7882240)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 win	✅ 🛠 ios-apple
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	❌ 🧪 wpe-wk2	❌ 🧪 win-tests	✅ 🛠 mac-apple
✅ 🧪 webkitperl	~~🧪 ios-wk2~~	✅ 🧪 api-mac	❌ 🧪 api-wpe		✅ 🛠 vision-apple
	❌ 🧪 ios-wk2-wpt	~~🧪 mac-wk1~~	✅ 🛠 wpe-cairo
	✅ 🧪 api-ios	~~🧪 mac-wk2~~	✅ 🛠 gtk
	✅ 🛠 vision	~~🧪 mac-AS-debug-wk2~~	❌ 🧪 gtk-wk2
	✅ 🛠 vision-sim	❌ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
	✅ 🧪 vision-wk2	~~🧪 mac-intel-wk2~~	✅ 🛠 playstation
	✅ 🛠 tv	❌ 🛠 mac-safer-cpp
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

webkit-ews-buildbot · 2025-10-26T16:01:54Z

Safer C++ Build #62842 (`7882240`)

❌ Found 2 failing files with 3 issues. Please address these issues before landing. See WebKit Guidelines for Safer C++ Programming.
(cc @rniwa)

webkit-early-warning-system · 2025-10-26T16:47:36Z

EWS run on previous version of this PR (hash 672f5e4)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	❌ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 win	✅ 🛠 ios-apple
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	❌ 🧪 win-tests	✅ 🛠 mac-apple
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe		✅ 🛠 vision-apple
	✅ 🧪 ios-wk2-wpt	❌ 🧪 mac-wk1	✅ 🛠 wpe-cairo
	✅ 🧪 api-ios	✅ 🧪 mac-wk2	✅ 🛠 gtk
	✅ 🛠 vision	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	❌ 🧪 api-gtk
	✅ 🧪 vision-wk2	✅ 🧪 mac-intel-wk2	✅ 🛠 playstation
	✅ 🛠 tv	✅ 🛠 mac-safer-cpp
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

webkit-early-warning-system · 2025-10-27T18:41:36Z

EWS run on previous version of this PR (hash 5f65d5c)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 win	✅ 🛠 ios-apple
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	❌ 🧪 win-tests	✅ 🛠 mac-apple
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe		✅ 🛠 vision-apple
	✅ 🧪 ios-wk2-wpt	✅ 🧪 mac-wk1	✅ 🛠 wpe-cairo
	✅ 🧪 api-ios	✅ 🧪 mac-wk2	✅ 🛠 gtk
	✅ 🛠 vision	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
	✅ 🧪 vision-wk2	✅ 🧪 mac-intel-wk2	✅ 🛠 playstation
	✅ 🛠 tv	❌ 🛠 mac-safer-cpp
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

webkit-ews-buildbot · 2025-10-27T19:24:43Z

Safer C++ Build #63669 (`5f65d5c`)

❌ Found 1 failing file with 1 issue. Please address these issues before landing. See WebKit Guidelines for Safer C++ Programming.
(cc @rniwa)

RupinMittal · 2025-10-27T19:58:50Z

Hey, thanks for looking into this! Have we checked what Chrome does about this problem? Do they also limit the number of calls to a certain number (if so, what number)? Or do they have a different solution?

webkit-early-warning-system · 2025-10-28T04:33:15Z

EWS run on previous version of this PR (hash 610f1dc)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 win	🛠 ios-apple
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	❌ 🧪 win-tests	🛠 mac-apple
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe		✅ 🛠 vision-apple
	✅ 🧪 ios-wk2-wpt	✅ 🧪 mac-wk1	✅ 🛠 wpe-cairo
	✅ 🧪 api-ios	✅ 🧪 mac-wk2	✅ 🛠 gtk
	✅ 🛠 vision	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
	✅ 🧪 vision-wk2	✅ 🧪 mac-intel-wk2	✅ 🛠 playstation
	✅ 🛠 tv	✅ 🛠 mac-safer-cpp
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

roberto-apple · 2025-10-28T04:50:20Z

@RupinMittal I'm not aware of any explicit cap by Chrome so the number chosen (currently 10) is entirely an implementation detail. On Chrome (using the layout test attached) the behavior is to navigate to about:blank#blocked from what I observed.

basuke · 2025-10-28T23:09:55Z

I took a look into Chromium and they have a throttler for each frame that limit any sort of navigation 200 times per last 10 seconds. The best thing is to implement similar throttler or limiter.

third_party/blink/renderer/core/frame/navigation_rate_limiter.cc

basuke

As I wrote in the previous message, we should add navigation count limiter, not only for Navigation API.

basuke · 2025-10-28T23:12:43Z

LayoutTests/http/tests/navigation/recursive-navigate-event.html

+        result.finished.catch(checkAbortError);
+    });
+
+    const stream = new Blob().stream();


What is this unused stream?

It came from the original fuzzer test case that was supplied in the radar. Having this present was causing an assertion exception in ReadableStreamDefaultController once the navigation events started stack overflowing.

I'll move it to a separate test to be more explicit.

basuke · 2025-10-28T23:15:00Z

Source/WebCore/page/Navigation.h

@@ -230,6 +234,23 @@ class Navigation final : public RefCounted<Navigation>, public EventTarget, publ
    RefPtr<NavigationAPIMethodTracker> m_upcomingNonTraverseMethodTracker;
    HashMap<String, Ref<NavigationAPIMethodTracker>> m_upcomingTraverseMethodTrackers;
    WeakHashSet<AbortHandler> m_abortHandlers;
+
+    static constexpr int maxNavigateCalls { 10 };


From the number from Chromium, 200 seems the good number.

basuke · 2025-10-29T19:28:02Z

Source/WebCore/page/Navigation.h

+        explicit NavigateCallCounter(Navigation& nav)
+            : m_navigation { nav }
+        {
+            m_navigation->m_navigateCalls++;


Just incrementing and no decrement. This logic seems broken.

The decrement is in destructor in Navigation.cpp. Maybe I'll move the constructor there as well so that they will be next to each other.

webkit-early-warning-system · 2025-11-04T22:08:47Z

EWS run on previous version of this PR (hash 7b556d0)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 win	✅ 🛠 ios-apple
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	❌ 🧪 wpe-wk2	✅ 🧪 win-tests	✅ 🛠 mac-apple
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe		✅ 🛠 vision-apple
	❌ 🧪 ios-wk2-wpt	✅ 🧪 mac-wk1	✅ 🛠 wpe-cairo
	✅ 🧪 api-ios	❌ 🧪 mac-wk2	✅ 🛠 gtk
	✅ 🛠 vision	❌ 🧪 mac-AS-debug-wk2	❌ 🧪 gtk-wk2
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
	✅ 🧪 vision-wk2	❌ 🧪 mac-intel-wk2	✅ 🛠 playstation
	✅ 🛠 tv	❌ 🛠 mac-safer-cpp
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

webkit-ews-buildbot · 2025-11-04T23:44:03Z

Safer C++ Build #64975 (`7b556d0`)

❌ Found 1 failing file with 1 issue. Please address these issues before landing. See WebKit Guidelines for Safer C++ Programming.
(cc @rniwa)

webkit-early-warning-system · 2025-11-05T21:09:49Z

EWS run on previous version of this PR (hash c25adfa)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	❌ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	~~🛠 win~~	✅ 🛠 ios-apple
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	~~🧪 win-tests~~	✅ 🛠 mac-apple
✅ 🧪 webkitperl	⏳ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe		⏳ 🛠 vision-apple
	⏳ 🧪 ios-wk2-wpt	✅ 🧪 mac-wk1	✅ 🛠 wpe-cairo
	~~🧪 api-ios~~	✅ 🧪 mac-wk2	✅ 🛠 gtk
	❌ 🛠 vision	✅ 🧪 mac-AS-debug-wk2	~~🧪 gtk-wk2~~
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
	~~🧪 vision-wk2~~	✅ 🧪 mac-intel-wk2	✅ 🛠 playstation
	✅ 🛠 tv	❌ 🛠 mac-safer-cpp
	~~🛠 tv-sim~~
	~~🛠 watch~~
	✅ 🛠 watch-sim

webkit-early-warning-system · 2025-11-05T23:34:14Z

EWS run on previous version of this PR (hash b0233a1)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 win	✅ 🛠 ios-apple
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	✅ 🧪 win-tests	🛠 mac-apple
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe		🛠 vision-apple
	✅ 🧪 ios-wk2-wpt	✅ 🧪 mac-wk1	✅ 🛠 wpe-cairo
	✅ 🧪 api-ios	✅ 🧪 mac-wk2	✅ 🛠 gtk
	✅ 🛠 vision	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
	✅ 🧪 vision-wk2	✅ 🧪 mac-intel-wk2	✅ 🛠 playstation
	✅ 🛠 tv	✅ 🛠 mac-safer-cpp
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

basuke · 2025-11-06T17:12:56Z

Source/WebCore/page/Navigation.h

+    private:
+        // Sliding window rate limiter: allows 80 navigations per 4 second window (~20/sec sustained).
+        // Chromium uses 200 navigations per 10 seconds. Both prevent IPC flooding and stack overflow
+        // from recursive navigation patterns.


Why did you change the number from chromium? Didn't that prevent the crash? Also please add the url of chromium project that is the reason of this decision.

basuke · 2025-11-06T17:20:05Z

Source/WebCore/page/Navigation.h

@@ -195,6 +197,28 @@ class Navigation final : public RefCounted<Navigation>, public EventTarget, publ
    static Vector<Ref<HistoryItem>> filterHistoryItemsForNavigationAPI(Vector<Ref<HistoryItem>>&&, HistoryItem&);

 private:
+    // Rate limiter to prevent excessive navigation requests.
+    class NavigationRateLimiter {


Please add one of the allocation macro. Read FastMalloc.h for the detail.

Most classes should use WTF_MAKE_TZONE_ALLOCATED(ClassName).

basuke · 2025-11-06T17:24:44Z

Source/WebCore/page/Navigation.h

+    class NavigationRateLimiter {
+    public:
+        NavigationRateLimiter() = default;
+        NavigationRateLimiter(const Navigation&) = delete;


Use WTF_MAKE_NONCOPYABLE and WTF_MAKE_NONMOVABLE macros.

These Navigation should be this class name, right? That's one of the reason we use macro.

basuke · 2025-11-06T17:26:23Z

Source/WebCore/page/Navigation.h

@@ -195,6 +197,28 @@ class Navigation final : public RefCounted<Navigation>, public EventTarget, publ
    static Vector<Ref<HistoryItem>> filterHistoryItemsForNavigationAPI(Vector<Ref<HistoryItem>>&&, HistoryItem&);

 private:
+    // Rate limiter to prevent excessive navigation requests.
+    class NavigationRateLimiter {


The class name can be simply RateLimiter if you define this class as internal class.

basuke · 2025-11-06T17:48:22Z

LayoutTests/TestExpectations

@@ -8157,3 +8157,6 @@ imported/w3c/web-platform-tests/css/CSS2/visudet/replaced-elements-min-width-80.

 imported/w3c/web-platform-tests/css/CSS2/stacking-context/opacity-affects-block-in-inline.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/CSS2/stacking-context/zindex-affects-block-in-inline.html [ ImageOnlyFailure ]
+
+# Navigation API rate limiting window reset test takes >10 seconds
+navigation-api/navigation-api-rate-limit-window-reset.html [ Slow ]


We don't like this kind of slow test. We can add Internal method to change those numbers for testing and also force resetting the limiter.

basuke · 2025-11-06T17:50:16Z

Source/WebCore/page/Navigation.cpp

@@ -1267,4 +1271,32 @@ Vector<Ref<HistoryItem>> Navigation::filterHistoryItemsForNavigationAPI(Vector<R
    return filteredItems;
 }

+bool Navigation::NavigationRateLimiter::navigationAllowed(Navigation& navigation)


This argument only used to get Document from the navigation.window(). It's better to pass Document to the constructor of the RateLimiter.

basuke · 2025-11-06T17:58:21Z

Source/WebCore/page/Navigation.cpp

@@ -400,6 +400,10 @@ Navigation::Result Navigation::reload(ReloadOptions&& options, Ref<DeferredPromi
 // https://html.spec.whatwg.org/multipage/nav-history-apis.html#dom-navigation-navigate
 Navigation::Result Navigation::navigate(const String& url, NavigateOptions&& options, Ref<DeferredPromise>&& committed, Ref<DeferredPromise>&& finished)
 {
+    // Enforce rate limiting to prevent excessive navigation requests.
+    if (RefPtr navigation = this; navigation && !m_rateLimiter.navigationAllowed(*navigation))


It seems weird. We can simply check !m_rateLimiter.navigationAllowed() if we don't pass Navigation. More over, moving back the duty to send message to console from RateLimiter to this class, the limiter just don't care about reference counted objects. Let's move them here and add the method wasReported() and markReported() to manage that.

Actually this is not the only place that invokes NavigateEvent. i.e. history.push(), setting location.href, etc. Look at innerDispatchNavigateEvent() that all invocation of NavigateEvent uses.

webkit-early-warning-system · 2025-11-08T05:06:50Z

EWS run on previous version of this PR (hash 3c2fd15)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 win	❌ 🛠 ios-apple
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	❌ 🧪 wpe-wk2	❌ 🧪 win-tests	✅ 🛠 mac-apple
✅ 🧪 webkitperl	❌ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe		✅ 🛠 vision-apple
	❌ 🧪 ios-wk2-wpt	❌ 🧪 mac-wk1	✅ 🛠 wpe-cairo
	✅ 🧪 api-ios	❌ 🧪 mac-wk2	✅ 🛠 gtk
	✅ 🛠 vision	❌ 🧪 mac-AS-debug-wk2	❌ 🧪 gtk-wk2
	✅ 🛠 vision-sim	❌ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
	❌ 🧪 vision-wk2	❌ 🧪 mac-intel-wk2	✅ 🛠 playstation
	✅ 🛠 tv	❌ 🛠 mac-safer-cpp
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

webkit-ews-buildbot · 2025-11-08T06:48:27Z

Safer C++ Build #65620 (`3c2fd15`)

❌ Found 1 failing file with 1 issue. Please address these issues before landing. See WebKit Guidelines for Safer C++ Programming.
(cc @rniwa)

…shes https://bugs.webkit.org/show_bug.cgi?id=301144 rdar://161094454 Reviewed by NOBODY (OOPS!). Recursive navigation.navigate() calls from event listeners can trigger stack overflow. During resource cleanup for a ReadableStream, this causes an exception assertion in ReadableStreamDefaultController. However, clearing the exception locally simply reveals more downstream assertions, pointing to a need to prevent stack overflow from occuring instead. Add a sliding window rate limiter (100 navigations per 5 second window) to prevent IPC flooding and stack overflow from recursive calls. This matches Chromium's sustained rate (~20 navigations/second). Tests: navigation-api/navigation-api-rate-limit-exceeded.html navigation-api/navigation-api-rate-limit-readable-stream-no-crash.html navigation-api/navigation-api-rate-limit-window-reset.html * LayoutTests/navigation-api/navigation-api-rate-limit-exceeded-expected.txt: Added. * LayoutTests/navigation-api/navigation-api-rate-limit-exceeded.html: Added. * LayoutTests/navigation-api/navigation-api-rate-limit-readable-stream-no-crash-expected.txt: Added. * LayoutTests/navigation-api/navigation-api-rate-limit-readable-stream-no-crash.html: Added. * LayoutTests/navigation-api/navigation-api-rate-limit-window-reset-expected.txt: Added. * LayoutTests/navigation-api/navigation-api-rate-limit-window-reset.html: Added. * Source/WebCore/page/LocalDOMWindow.h: * Source/WebCore/page/Navigation.cpp: (WebCore::Navigation::innerDispatchNavigateEvent): (WebCore::Navigation::RateLimiter::navigationAllowed): * Source/WebCore/page/Navigation.h: * Source/WebCore/testing/Internals.cpp: (WebCore::Internals::setNavigationRateLimiterParameters): (WebCore::Internals::resetNavigationRateLimiter): * Source/WebCore/testing/Internals.h: * Source/WebCore/testing/Internals.idl:

webkit-early-warning-system · 2025-11-09T04:56:00Z

EWS run on current version of this PR (hash b97666d)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 win	✅ 🛠 ios-apple
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	✅ 🧪 win-tests	✅ 🛠 mac-apple
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe		✅ 🛠 vision-apple
	✅ 🧪 ios-wk2-wpt	✅ 🧪 mac-wk1	✅ 🛠 wpe-cairo
	✅ 🧪 api-ios	✅ 🧪 mac-wk2	✅ 🛠 gtk
	✅ 🛠 vision	❌ 🧪 mac-AS-debug-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
	✅ 🧪 vision-wk2	✅ 🧪 mac-intel-wk2	✅ 🛠 playstation
	✅ 🛠 tv	✅ 🛠 mac-safer-cpp
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

roberto-apple · 2025-11-12T17:32:55Z

Closing PR as it is associated with a fuzzer bug that is now resolved.
The work for adding a navigation rate limiter will be addressed here: #53798

roberto-apple self-assigned this Oct 20, 2025

roberto-apple added the New Bugs Unclassified bugs are placed in this component until the correct component can be determined. label Oct 20, 2025

webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Oct 21, 2025

roberto-apple removed the merging-blocked Applied to prevent a change from being merged label Oct 21, 2025

roberto-apple changed the title ~~Prevent ReadableStreamDefaultControllerFunction from crashing on stack overflow~~ Limit recursive calls to navigate Oct 21, 2025

roberto-apple force-pushed the eng/Prevent-ReadableStreamDefaultControllerFunction-from-crashing-on-stack-overflow branch from e87e08f to f754826 Compare October 21, 2025 20:46

roberto-apple marked this pull request as ready for review October 21, 2025 21:40

roberto-apple requested a review from cdumez as a code owner October 21, 2025 21:40

roberto-apple commented Oct 21, 2025

View reviewed changes

roberto-apple requested review from RupinMittal and basuke October 21, 2025 21:59

basuke reviewed Oct 22, 2025

View reviewed changes

roberto-apple force-pushed the eng/Prevent-ReadableStreamDefaultControllerFunction-from-crashing-on-stack-overflow branch from f754826 to 7882240 Compare October 26, 2025 15:02

webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Oct 26, 2025

roberto-apple removed the merging-blocked Applied to prevent a change from being merged label Oct 26, 2025

roberto-apple force-pushed the eng/Prevent-ReadableStreamDefaultControllerFunction-from-crashing-on-stack-overflow branch from 7882240 to 672f5e4 Compare October 26, 2025 16:47

webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Oct 26, 2025

roberto-apple removed the merging-blocked Applied to prevent a change from being merged label Oct 27, 2025

roberto-apple force-pushed the eng/Prevent-ReadableStreamDefaultControllerFunction-from-crashing-on-stack-overflow branch from 672f5e4 to 5f65d5c Compare October 27, 2025 18:41

roberto-apple force-pushed the eng/Prevent-ReadableStreamDefaultControllerFunction-from-crashing-on-stack-overflow branch from 5f65d5c to 610f1dc Compare October 28, 2025 04:33

roberto-apple requested a review from basuke October 28, 2025 17:10

basuke requested changes Oct 29, 2025

View reviewed changes

roberto-apple changed the title ~~Limit recursive calls to navigate~~ Implement navigation rate limiter to prevent recursive navigation crashes Nov 4, 2025

roberto-apple force-pushed the eng/Prevent-ReadableStreamDefaultControllerFunction-from-crashing-on-stack-overflow branch from 610f1dc to 7b556d0 Compare November 4, 2025 22:08

webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Nov 4, 2025

roberto-apple removed the merging-blocked Applied to prevent a change from being merged label Nov 5, 2025

roberto-apple force-pushed the eng/Prevent-ReadableStreamDefaultControllerFunction-from-crashing-on-stack-overflow branch from 7b556d0 to c25adfa Compare November 5, 2025 21:09

roberto-apple force-pushed the eng/Prevent-ReadableStreamDefaultControllerFunction-from-crashing-on-stack-overflow branch from c25adfa to b0233a1 Compare November 5, 2025 23:34

roberto-apple requested a review from basuke November 6, 2025 17:07

basuke requested changes Nov 6, 2025

View reviewed changes

roberto-apple force-pushed the eng/Prevent-ReadableStreamDefaultControllerFunction-from-crashing-on-stack-overflow branch from b0233a1 to 3c2fd15 Compare November 8, 2025 05:06

webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Nov 8, 2025

roberto-apple removed the merging-blocked Applied to prevent a change from being merged label Nov 9, 2025

roberto-apple force-pushed the eng/Prevent-ReadableStreamDefaultControllerFunction-from-crashing-on-stack-overflow branch from 3c2fd15 to b97666d Compare November 9, 2025 04:55

webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Nov 9, 2025

roberto-apple requested a review from basuke November 10, 2025 17:59

roberto-apple closed this Nov 12, 2025

roberto-apple mentioned this pull request Nov 12, 2025

Implement navigation rate limiting #53798

Merged

Conversation

roberto-apple commented Oct 20, 2025 • edited by webkit-early-warning-system Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webkit-early-warning-system commented Oct 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webkit-early-warning-system commented Oct 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

webkit-ews-buildbot commented Oct 21, 2025

Safer C++ Build #60121 (f754826)

Uh oh!

basuke left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

webkit-early-warning-system commented Oct 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webkit-ews-buildbot commented Oct 26, 2025

Safer C++ Build #62842 (7882240)

Uh oh!

webkit-early-warning-system commented Oct 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webkit-early-warning-system commented Oct 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webkit-ews-buildbot commented Oct 27, 2025

Safer C++ Build #63669 (5f65d5c)

Uh oh!

RupinMittal commented Oct 27, 2025

Uh oh!

webkit-early-warning-system commented Oct 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

roberto-apple commented Oct 28, 2025

Uh oh!

basuke commented Oct 28, 2025

Uh oh!

basuke left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

webkit-early-warning-system commented Nov 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webkit-ews-buildbot commented Nov 4, 2025

Safer C++ Build #64975 (7b556d0)

Uh oh!

webkit-early-warning-system commented Nov 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webkit-early-warning-system commented Nov 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

roberto-apple commented Oct 20, 2025 •

edited by webkit-early-warning-system

Loading

webkit-early-warning-system commented Oct 20, 2025 •

edited

Loading

webkit-early-warning-system commented Oct 21, 2025 •

edited

Loading

Safer C++ Build #60121 (`f754826`)

webkit-early-warning-system commented Oct 26, 2025 •

edited

Loading

Safer C++ Build #62842 (`7882240`)

webkit-early-warning-system commented Oct 26, 2025 •

edited

Loading

webkit-early-warning-system commented Oct 27, 2025 •

edited

Loading

Safer C++ Build #63669 (`5f65d5c`)

webkit-early-warning-system commented Oct 28, 2025 •

edited

Loading

webkit-early-warning-system commented Nov 4, 2025 •

edited

Loading

Safer C++ Build #64975 (`7b556d0`)

webkit-early-warning-system commented Nov 5, 2025 •

edited

Loading

webkit-early-warning-system commented Nov 5, 2025 •

edited

Loading

webkit-early-warning-system commented Nov 8, 2025 •

edited

Loading

Safer C++ Build #65620 (`3c2fd15`)

webkit-early-warning-system commented Nov 9, 2025 •

edited

Loading