Skip to content

[Cocoa] Calling -regularFileContents on a directory NSFileWrapper crashes the web content process#63020

Merged
webkit-commit-queue merged 1 commit into
WebKit:mainfrom
kmonsen:eng/WebKit-Main-SU-0de8fcf584c54561-ASAN_ABRT-NSFileWrapper-regularFileContents-HTMLConverter-_addAttachmentForElement-HTMLConverter-_processElement
Apr 20, 2026
Merged

[Cocoa] Calling -regularFileContents on a directory NSFileWrapper crashes the web content process#63020
webkit-commit-queue merged 1 commit into
WebKit:mainfrom
kmonsen:eng/WebKit-Main-SU-0de8fcf584c54561-ASAN_ABRT-NSFileWrapper-regularFileContents-HTMLConverter-_addAttachmentForElement-HTMLConverter-_processElement

Conversation

@kmonsen
Copy link
Copy Markdown
Contributor

@kmonsen kmonsen commented Apr 18, 2026

dad1793

[Cocoa] Calling -regularFileContents on a directory NSFileWrapper crashes the web content process
https://bugs.webkit.org/show_bug.cgi?id=312594
rdar://174642216

Reviewed by Ryosuke Niwa.

When copying content containing an <img> element whose resolved URL points to a directory (e.g. srcset="."), WebKit
can end up with a directory-backed NSFileWrapper. Calling -regularFileContents on such a wrapper raises an
NSInvalidArgumentException. Because the exception unwinds through C++ stack frames in HTMLConverter and
AttributedString, it is not caught and terminates the web content process.

Fix by guarding both -regularFileContents call sites with -isRegularFile before extracting attachment data. The
preferredFilename and other metadata are still read regardless of file type.

Test: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/CopyRTF.mm

* Source/WebCore/editing/cocoa/AttributedString.mm:
(WebCore::extractValue):
* Source/WebCore/editing/cocoa/NodeHTMLConverter.mm:
(HTMLConverter::_addAttachmentForElement):
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/CopyRTF.mm:
(TEST(CopyRTF, DoesNotCrashWithDirectoryFileWrapperFromImageSrcset)):

Canonical link: https://commits.webkit.org/311610@main

704d7a1

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows Apple Internal
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 win ⏳ 🛠 ios-apple
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ✅ 🧪 wpe-wk2 ❌ 🧪 win-tests ⏳ 🛠 mac-apple
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe ⏳ 🛠 vision-apple
✅ 🧪 ios-wk2-wpt ✅ 🧪 api-mac-debug ✅ 🛠 gtk3-libwebrtc
✅ 🧪 api-ios ✅ 🧪 mac-wk1 ✅ 🛠 gtk
✅ 🛠 ios-safer-cpp ✅ 🧪 mac-wk2 ✅ 🧪 gtk-wk2
✅ 🛠 vision ✅ 🧪 mac-AS-debug-wk2 ✅ 🧪 api-gtk
✅ 🛠 🧪 merge ✅ 🛠 vision-sim ✅ 🧪 mac-wk2-stress ✅ 🛠 playstation
✅ 🧪 vision-wk2 ✅ 🧪 mac-intel-wk2
✅ 🛠 tv ✅ 🛠 mac-safer-cpp
✅ 🛠 tv-sim
✅ 🛠 watch
✅ 🛠 watch-sim

@kmonsen kmonsen requested a review from rniwa as a code owner April 18, 2026 02:06
@kmonsen kmonsen self-assigned this Apr 18, 2026
@kmonsen kmonsen added the HTML Editing For bugs in HTML editing support (including designMode and contentEditable). label Apr 18, 2026
@rniwa rniwa requested a review from whsieh April 18, 2026 16:37
@kmonsen kmonsen added the merge-queue Applied to send a pull request to merge-queue label Apr 20, 2026
…shes the web content process

https://bugs.webkit.org/show_bug.cgi?id=312594
rdar://174642216

Reviewed by Ryosuke Niwa.

When copying content containing an <img> element whose resolved URL points to a directory (e.g. srcset="."), WebKit
can end up with a directory-backed NSFileWrapper. Calling -regularFileContents on such a wrapper raises an
NSInvalidArgumentException. Because the exception unwinds through C++ stack frames in HTMLConverter and
AttributedString, it is not caught and terminates the web content process.

Fix by guarding both -regularFileContents call sites with -isRegularFile before extracting attachment data. The
preferredFilename and other metadata are still read regardless of file type.

Test: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/CopyRTF.mm

* Source/WebCore/editing/cocoa/AttributedString.mm:
(WebCore::extractValue):
* Source/WebCore/editing/cocoa/NodeHTMLConverter.mm:
(HTMLConverter::_addAttachmentForElement):
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/CopyRTF.mm:
(TEST(CopyRTF, DoesNotCrashWithDirectoryFileWrapperFromImageSrcset)):

Canonical link: https://commits.webkit.org/311610@main
@webkit-commit-queue webkit-commit-queue force-pushed the eng/WebKit-Main-SU-0de8fcf584c54561-ASAN_ABRT-NSFileWrapper-regularFileContents-HTMLConverter-_addAttachmentForElement-HTMLConverter-_processElement branch from 704d7a1 to dad1793 Compare April 20, 2026 19:39
@webkit-commit-queue
Copy link
Copy Markdown
Collaborator

Committed 311610@main (dad1793): https://commits.webkit.org/311610@main

Reviewed commits have been landed. Closing PR #63020 and removing active labels.

@webkit-commit-queue webkit-commit-queue merged commit dad1793 into WebKit:main Apr 20, 2026
@webkit-commit-queue webkit-commit-queue removed the merge-queue Applied to send a pull request to merge-queue label Apr 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

HTML Editing For bugs in HTML editing support (including designMode and contentEditable).

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants