WebContent-to-UI origin parameters move to real validators

Component: WebKit IPC | 8e14834

Source/WebKit/Platform/IPC/Untrusted.h

+#define EXTRACT_WITH_MESSAGE_CHECK_BASE(connection, name, untrusted, completion, ...) \
+    auto name##Validated = WTF::move(untrusted).validate(__VA_ARGS__); \
+    MESSAGE_CHECK_COMPLETION_BASE(IPC::valueMayBeLegitimate(name##Validated), connection, completion); \
+    if (!name##Validated) { \
+        { completion; } \
+        return; \
+    } \
+    auto name = WTF::move(*name##Validated)

Under site isolation, each site gets its own WebContent process, and the UI process must treat everything a WebContent process sends as attacker-controlled. IPC::Untrusted<T> requires every origin to pass a validator, such as ProcessSpeaksForDomain (the sending process is allowed to speak for that domain) or ProcessCommittedClientOrigin, or to be extracted with an explicit UnvalidatedReason. Earlier commits added these checks as no-ops, and this commit enforces them.

32 of 37 origin parameters now pass real validators. They cover capture/DRM permission prompts, Web Locks, app badge, WebAuthn, prewarm/autofill/user-gesture bookkeeping, XR, speech recognition, inspector frameNavigated and CSP upgrade origins. EXTRACT_WITH_MESSAGE_CHECK_BASE centralizes the validate/MESSAGE_CHECK/early-return pattern. The WebAuthn signal* handlers also check rpId against the origin's registrable domain. WebFrameProxy now records the origin the web process reports for web-archive and opaque-origin commits.

Significance

A compromised WebContent process can no longer claim another site's origin in 32 IPC origin parameters under site isolation, closing a large part of the origin-spoofing surface. The commit also documents which parameters are still bypassed.

Audit directions

Verify the claims behind the five documented bypasses: PostMessageToRemote targetOrigin/sourceOrigin, GetAssertion parentOrigin, Geolocation StartUpdating domain, and Automation ScriptRealmCreated origin. In particular, check whether the getAssertion ancestor-chain walk, which applies only where an ancestor is HTTP-family, and the token-bound geolocation domain really cover every path.
For web-archive and opaque-origin commits, the expected origin is whatever the web process reported at commit time. Look for ways a compromised process can choose that value, and for mismatches between the load the UI process requested (LoadedWebArchive) and what gets recorded.
Capture messages validate the top-level origin against the main frame's process, not the sender. Check that this holds across process swaps, provisional pages and remote frames.
Most checks apply only under site isolation. App badge (ShouldCheckWithoutSiteIsolation::Yes) and the WebAuthn rpId comparisons are exceptions. Map which handlers still rely on the old trust when site isolation is off.
On the "can't be sure" path, make sure each WebAuthn completion (handler(false), handler({ }), SecurityError) fires exactly once and leaves no state half-updated.
ProvisionalPageProxy::didCommitLoadForFrame bypasses validation and forwards CSP upgrade origins. Look for any route that skips the WebPageProxy check. Also confirm that the geolocation stopUpdating/setEnableHighAccuracy handlers stay consistent with the token-bound domain check.