Documents finally get their own IP address space

Component: WebCore Loader / Local Network Access | 1b00bc4

Local Network Access compares a document's own address space against the address space of what it is fetching, so the document's classification is half the input to every LNA decision. PolicyContainer is the per-document security state bundle — CSP, referrer policy, and now address space — that must be correctly derived on navigation and propagated across the WebContent/Network process boundary over IPC.

This commit makes that derivation actually happen. FrameLoader::didBeginDocument now seeds Document::setIPAddressSpace() from the response; DocumentWriter::begin copies it into javascript: and about: documents from their owner document; and DocumentLoader::responseReceived makes blob: documents inherit the initiator's address space via PolicyContainer. Separately, PolicyContainer::ipAddressSpace — previously omitted from WebCoreArgumentCoders.serialization.in — now crosses IPC to subframes, and a new soup-specific classifier, resolvedIPAddressSpace, gives GTK and WPE responses an address space they previously lacked entirely. internals.documentIPAddressSpace() is added for testing.

Significance

Every document previously defaulted to Public — the least-trusted classification — regardless of where it was actually served from. Pages served from loopback or a local network were therefore misclassified, and LNA's comparisons produced wrong results rather than the check being bypassed or disabled outright.

The IPC half is the more instructive failure. PolicyContainer::ipAddressSpace existed in the struct but was never assigned, and was separately missing from the serialization descriptor — and struct padding coincidentally matched the expected size, so the generated size assertion designed to catch exactly this kind of omission did not fire.

Audit directions

Narrow: audit the remaining document-creation paths for address-space inheritance — srcdoc, sandboxed iframes, and any other synthesized document type beyond javascript:, about:, and blob: — since a path that misses the seeding falls back to Public and silently widens what LNA permits; the match tell is a Document construction site with no setIPAddressSpace() nearby. Wider: the padding-masked size assertion is the portable lesson. Any .serialization.in descriptor whose struct has trailing padding can lose a field without tripping the generated check, so the general hunt is for security-relevant PolicyContainer-adjacent fields present in headers but absent from serialization descriptors — and the review tell is a struct member added to a .h in one commit with no corresponding line in the matching .serialization.in. Widest: the pattern of a field that exists, compiles, and is never assigned applies well beyond IPC; wherever a security comparison reads a member whose only writer is a default initializer, the comparison is a constant in disguise.

---