[1] [WebKit] Remove SetCORSDisablingPatterns IPC from NetworkConnectionToWebProcess

UI process took the renderer's word on which origin owned a lock — until someone asked what `committedOrigins` actually contained.

Severity: High | Component: WebKit NetworkProcess | 841ad59

Rated High because the diff removes a WebContent-reachable IPC that wrote arbitrary URL patterns into m_pageCORSDisablingPatterns/originAccessPatterns, directly silencing same-origin enforcement on outbound cross-origin loads for the renderer's page; the primitive is reached without further escalation from a compromised WebProcess.

Removes SetCORSDisablingPatterns(PageIdentifier, Vector<String>) from NetworkConnectionToWebProcess and re-routes the policy delivery to flow directly WebPageProxy → NetworkProcess. Previously the NetworkProcess parsed each pattern into a UserContentURLPattern, stored it keyed by PageIdentifier, and added it to the per-connection NetworkOriginAccessPatterns consulted by shouldDisableCORSForRequestTo().

Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp

-void NetworkConnectionToWebProcess::setCORSDisablingPatterns(PageIdentifier pageIdentifier, Vector<String>&& patterns)
-{
-    Vector<UserContentURLPattern> parsedPatterns;
-    parsedPatterns.reserveInitialCapacity(patterns.size());
-    for (auto&& pattern : WTFMove(patterns)) {
-        UserContentURLPattern parsedPattern(WTFMove(pattern));
-        if (parsedPattern.isValid()) {
-            originAccessPatterns().allowAccessTo(parsedPattern);
-            parsedPatterns.append(WTFMove(parsedPattern));
-        }
-    }
-    parsedPatterns.shrinkToFit();
-    m_networkProcess->setCORSDisablingPatterns(pageIdentifier, WTFMove(parsedPatterns));
-}

Confused-deputy IPC: NetworkProcess treated WebContent as the source of trust for per-page CORS-disabling policy when the policy actually originates from the UIProcess SPI.

Patch Details

The renderer-originated path is deleted. WebPage::synchronizeCORSDisablingPatternsWithNetworkProcess is removed; APIPageConfiguration::setCORSDisablingPatterns now persists into WebPageProxy, which sends the parsed patterns to NetworkProcess over the UI→Network IPC channel. The m_pageCORSDisablingPatterns map and shouldDisableCORSForRequestTo() lookup remain — only the writer changes.

Background

WebKit's CORS implementation lives on both the WebContent (preflight, response checks) and NetworkProcess (cross-origin scheduling) sides. The per-page allow list m_pageCORSDisablingPatterns, plus the per-connection NetworkOriginAccessPatterns, is consulted in shouldDisableCORSForRequestTo() to skip CORS for matching URLs. The legitimate writer of this policy is the embedder, which calls -[WKWebView _setCORSDisablingPatterns:] and propagates through APIPageConfiguration in the UI process. The IPC sandbox boundary between UI/Network (trusted) and WebContent (untrusted) demands that any policy that loosens CORS must not flow through the renderer.

Analysis

The pre-fix path went UIProcess → WebContent → NetworkProcess: the WebContent process held the patterns and synchronised them to the NetworkProcess. A compromised WebContent process could craft SetCORSDisablingPatterns(pageIdentifier, ["*://*/*"]) over its existing NetworkConnectionToWebProcess endpoint. The NetworkProcess parsed each UserContentURLPattern without verifying caller authority and appended it to originAccessPatterns(). Every subsequent outbound load from that page hit shouldDisableCORSForRequestTo() with a positive match and skipped CORS — including same-origin preflight and credentials decisions on the network side.

The primitive is direct: a compromised renderer gains a cross-origin read primitive against any HTTP origin reachable from the NetworkProcess, scoped to its page identifier. SOP and CORS are the central web-platform isolation invariant; this IPC dissolves them for the calling page. The fix removes the renderer as a writer entirely — patterns now flow WebPageProxy → NetworkProcess directly, restoring the trust path.

This weakens the WebContent ↔ NetworkProcess trust boundary around cross-origin policy. The primitive is exploitation-grade against any HTTP origin: read of cookies, response bodies, and headers from cross-origin endpoints reachable by the page's network namespace.

Audit directions

WebContent → NetworkProcess IPC handlers that mutate per-page or per-connection security policy. Audit every receiver in NetworkConnectionToWebProcess.messages.in whose body writes into structures consulted by NetworkProcess::shouldDisableCORSForRequestTo, NetworkOriginAccessPatterns, NetworkStorageSession, or cookie/CSP policy. For each, confirm the policy origin is the UIProcess and that no renderer-originated re-entry exists.
UserContentURLPattern parsing reachable from untrusted callers. The matcher accepts * schemes/hosts and the wildcard expansion is liberal. Audit every caller that allows renderer or content-script-supplied patterns into a NetworkProcess allow list.
m_pageCORSDisablingPatterns and m_originAccessPatterns writers. Grep for all mutators; verify each is sourced from WebPageProxy or the UI process directly.