← All issues

[17] [WebKit] Validate Permissions Query identifier/source combination

Severity: Medium | Component: WebKit UIProcess Permissions | e118db0

Rated Medium because the diff adds a MESSAGE_CHECK_COMPLETION to WebPermissionControllerProxy::query() so that an IPC with identifier == nullopt and a source outside SharedWorker/ServiceWorker no longer reaches mostReasonableWebPageProxy()'s RELEASE_ASSERT_NOT_REACHED(); pre-fix a compromised renderer could abort the UI process.

query() validates that either identifier is set or source is one of the worker sources before falling through to mostReasonableWebPageProxy.

Source/WebKit/UIProcess/WebPermissionControllerProxy.cpp

+ MESSAGE_CHECK_COMPLETION(identifier || source == SharedWorker || source == ServiceWorker, completionHandler({ }));
mostReasonableWebPageProxy(clientOrigin.topOrigin, source);

Renderer-reachable UI-process abort: missing IPC argument validation reached an unreachable-asserted code path under attacker-shaped inputs.

MESSAGE_CHECK_COMPLETION lifts the implicit invariant (identifier set OR source is a worker) into an explicit check. Violation routes to the kill-the-sender path.

WebPermissionControllerProxy::query services navigator.permissions.query() and its worker equivalents. mostReasonableWebPageProxy() is invoked when no specific page identifier is supplied; its prologue asserts source == SharedWorker || source == ServiceWorker and its switch ends with RELEASE_ASSERT_NOT_REACHED() on the default arm.

Pre-fix, a WebProcess that sent Query with identifier == nullopt and any source other than SharedWorker/ServiceWorker (for example Window) caused the RELEASE_ASSERT to fire in the UI process.

🔒

Explores how an internal helper's assertion became an attacker-reachable UIProcess abort, and what the trust boundary actually buys here.

Subscribe to read more

🔒

Three reusable IPC-validation audit patterns identified, with concrete starting points across multiple UIProcess proxy receivers.

Subscribe to read more