Web Inspector: BackendResourceDataStore for Site Isolation response bodies

ccf6c82

Source/WebKit/WebProcess/Inspector/WebInspectorBackend.messages.in

+ GetResponseBody(String requestId) -> (String body, bool base64Encoded, String errorMessage) Async

Source/WebCore/inspector/InspectorIdentifierRegistry.h

+ std::optional<DeterministicRequestId> parseDeterministicRequestId(const String&);

Source/JavaScriptCore/inspector/protocol/Network.json

- { "name": "getResponseBody", ... }

+ { "name": "getResponseBody", "async": true, ... }

Under WebKit's Site Isolation, cross-origin iframes run in separate WebContent processes. Web Inspector's UIProcess hosts ProxyingNetworkAgent which proxies CDP-style commands to per-frame agents in the appropriate WebProcess. Previously, Network.getResponseBody was synchronous and relied on CachedResource references in NetworkResourcesData — a structure that does not cross process boundaries.

This commit adds BackendResourceDataStore, a WebProcess-side buffer for HTTP response metadata and content that lives in each WebProcess, copies response data at instrumentation time (decoupled from CachedResource lifetime), and is owned by WebInspectorBackend. Network.getResponseBody is converted from synchronous to asynchronous. ProxyingNetworkAgent parses frontend-provided requestId strings via parseDeterministicRequestId to extract the target WebProcess identifier, then sends an async GetResponseBody IPC message to that process.

Significance

This commit extends Web Inspector's reach across Site Isolation process boundaries by introducing a new IPC path and requestId-based routing mechanism — any trust or validation bugs here could allow the inspector frontend to exfiltrate response bodies from WebProcesses it should not reach.

Audit directions

a Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaa Aa Aaaaaaaaaaaaaaaaaaa Aaaaaaaa Aaaa Aaa Aaaaaaaaa Aaaaaaaa Aa Aaaaaaaaa Aaaaa Aaaaaaaaaa Aaaaaaaa Aa Aaa Aaaaaaaa Aaaaaaaaaaaa Aaaaaaaaaa Aaaaa Aaaaaa Aaaaaaaaaaaaaaa Aaaaaaa Aa Aaaaaaaaa Aaaa Aaaaaaaaaaa Aaaaaaaaa Aaaaaaaaaaaaaaaaa Aa a Aaaaaaaaaa Aaa Aaaaaaaaa Aaaaaaaa Aaaaaa Aaa Aaaaaaaa
a Aaaaaaaaaaaa Aaaaaaaaaaaaaaaaa Aaaaaaaaaa Aaaaaa Aaaa Aaa Aaaaaaaaa Aaaaaaa Aa a Aaaaaaaa Aaa Aaaaaaaaaa Aaaaaaaa Aaaaaaa Aa Aaa Aaaaaa Aa Aaaaaa Aaaaaaaaaaaa Aaaaaaa Aaaaaa Aa Aaaaa Aaaaaaaaaaa a Aaaaaaa Aaaaaaaaa Aaaaa Aaaaaaaaaa Aaaaaa Aaaa Aaaaaaaaaa Aaaaa Aaaaaaaaa
a Aaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaa Aaaaaaaa Aa Aaaaaaaaa Aaaa Aaaaaaaaaaaaaaaa Aaaaaaaaaaa Aaaaaa Aaaaa Aaa Aa Aaaaaaaaaaaaaa Aa Aaaaaaaaaaaaaaa Aaaaaaa Aa Aaa Aaaaa Aaa Aaaaaaaaaa Aaaaa Aaaaaaaaaaaa Aaaaaa Aaaa Aaaaaaaa Aaaaaa Aaaa Aaaaaaaaa Aaaaaaaaaaaaaaaaa Aaaaaaaa
a Aaa Aaaaaa Aaaaaaaaaa Aaaaaaaaaaaa Aaa Aaaaaaa Aaaaaa Aa a Aaaaaaaaaa Aaaaaa Aaaaaa Aaaa a Aaaaaaa Aaaaaaaaa Aaaa Aaaa Aaaaaa Aaa Aaaaaaaa Aaaaaaaaaaaaa Aaa Aaaaaa

🔒

The new IPC routing logic parses frontend-controlled identifiers to target WebProcesses — actionable audit directions are included for this path.

Subscribe to read more