Check iframe navigations for Local Network Access against their initiator

Local Network Access checked the fetches, but not the iframe pointed at localhost.

Component: WebKit NetworkProcess Local Network Access | c62d29d

LayoutTests/http/wpt/fetch/local-network-access/navigating-a-frame-is-checked-against-the-initiator-expected.txt

+PASS a non-secure local initiator cannot navigate a frame to loopback
+PASS a secure local initiator needs permission to navigate a frame to loopback
+PASS a non-secure public initiator cannot navigate a frame to loopback
+PASS a loopback initiator can navigate a frame to loopback without permission
+PASS a secure public initiator needs permission to navigate a frame to loopback
+PASS a secure public initiator with permission can navigate a frame to loopback

Local Network Access (LNA) is a WICG spec that gates requests from more-public address spaces (public, then local, then loopback) to less-public ones, requiring a secure context and a permissions-policy grant. For subresource loads the network process judges the request against the requesting document's own address space. A navigation differs, because its client is the initiator document and not the frame being navigated. WebKit passes initiator info to the network process through NavigationRequester, which is serialized over IPC from the web process, and whether a load is top-level also comes from the web process in this design.

NetworkResourceLoader no longer skips LNA checks for iframe main-resource loads. NavigationRequester now carries the initiator's secure-context flag and its local-network and loopback-network permissions-policy state, next to the address space it already held. The check uses these values and the initiator's origins for iframe navigations. A navigation with no initiator is treated as a non-secure public client instead of being skipped, and top-level navigations stay exempt.

Before:                                  After:
WebContent (public page)                 WebContent (initiator)
  └─► iframe nav -> 127.0.0.1              └─► iframe nav -> 127.0.0.1
        │                                        │ NavigationRequester{addrSpace,
        ▼                                        │   isSecureContext, LNA/loopback PP}
NetworkResourceLoader                            ▼
  main resource? ──► skip LNA            NetworkResourceLoader::checkLocalNetworkAccess
        │                                  top-level? ──► exempt
        ▼                                  iframe?     ──► check vs initiator
   load proceeds unchecked                 no initiator? ─► non-secure public
                                                │
                                                ▼ allow / deny

Significance

Before this, a public page could navigate an iframe to a loopback or local address with no LNA check, even from a non-secure context, a gap in the feature's protection against web-to-intranet and localhost requests.

Audit directions

This changes a security boundary check and adds new IPC-serialized fields (secure-context flag, two permissions-policy bits) to NavigationRequester. The commit says both the top-level determination and the initiator's fields still come from the web process, so a compromised WebContent process could control the inputs to this check. Narrow: audit which code paths build NavigationRequester::from, and whether any leave the initiator unset, misattribute it or pick the wrong document. The commit lists history traversal and reload as special cases judged against the frame's own document. Wider: navigation types that bypass the iframe path, such as redirects, form submissions, window.open or target-named navigations, srcdoc/about:blank, and cross-process or site-isolation navigations where requester data may be lost or defaulted. Also check whether a redirect chain from a public address to a local one is re-checked against the same initiator, whether the false defaults on the new fields are fail-closed in every consumer, and whether the top-level exemption can be reached for what is really a subframe load.