colelao
WebCore contributor
Summary
colelao works primarily in WebCore, driving a sustained refactor of WebKit's site-specific Quirks machinery: per-site handler functions are being converted into a declarative Quirk table, `QuirkMatch` generalized into a URL matcher, and element-matching, parameterized, and global quirks folded into that same structure, with supporting churn in JSC, Platform, and WTF. Security-classified work is rare and sits outside that thread — the flagged fix is a JSC Wasm Memory64 bug where table imports failed to check that the address type matched, a type-confusion-shaped issue rather than anything quirk-related. The audit angle is the quirk rewrite itself: behavior that was previously hardcoded in individual handlers is now gated by a generic URL matcher, so a matching regression would apply quirks — including the fullscreen, simulated-mouse-event, and cookie-policy ones moved into the table — to origins that were never meant to receive them.
Components
Security Fix History
Hardening Commits
- No hardening commits recorded
Recent Commits
- 2026-09-18 [Quirks] Move UA string Quirks into the Quirk table
- 2026-09-18 [Quirks] Move more trivial Quirks into the Quirk table
- 2026-09-16 [Quirks] Add element matching conditions to the Quirk table
- 2026-09-12 [WTF] Make ASCIILiteral::isEmpty constexpr
- 2026-09-11 [Quirks] Add parameterized quirks to the table
- 2026-09-09 [Quirks] Introduce the QuirkBehavior struct
- 2026-09-04 [Quirks] Remove additional compile flags in the Quirk accessor functions
- 2026-09-03 Remove dead Quirk needsLaxSameSiteCookieQuirk
- 2026-09-03 [Quirks] Add global quirks to the quirk table
- 2026-09-02 [Quirks] Reduce compile flags in Quirks table
- 2026-09-02 REGRESSION(319533@main): Broke TestWebKitAPI.PrivateClickMeasurement.SKAdNetwork
- 2026-08-28 [Quirks] Make QuirkMatch a generic URL matcher
- 2026-08-28 [Quirks] Remove unused function declarations
- 2026-08-27 [Quirks] Move site specific quirk names to QuirkNames.h
- 2026-08-27 [Quirks] Move the Quirk table to it's own file