Bug 250510

Summary:	Validate animation key paths sent over IPC
Product:	WebKit	Reporter:	Antoine Quint <graouts>
Component:	Animations	Assignee:	Antoine Quint <graouts>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	commit-queue, dino, graouts, simon.fraser, webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	Safari Technology Preview
Hardware:	Unspecified
OS:	Unspecified
Bug Depends on:	250509, 250519, 250520, 250641, 250642, 250744
Bug Blocks:

Description Antoine Quint 2023-01-12 04:16:40 PST

We currently send a CAAnimation's keyPath over IPC as a String. We should send this as a struct for the string to be generated in the UI Process for added security.

Comment 1 Antoine Quint 2023-01-12 04:16:54 PST

rdar://102433824

Comment 2 Antoine Quint 2023-01-12 12:14:17 PST

Pull request: https://github.com/WebKit/WebKit/pull/8587

Comment 3 Antoine Quint 2023-01-16 01:16:13 PST

Simon suggested that we keep using strings to represent animation key paths but instead validate the string in the UIProcess once received before creating the CAAnimation. Renaming bug to track this effort.

Comment 4 Antoine Quint 2023-01-16 01:28:28 PST

Pull request: https://github.com/WebKit/WebKit/pull/8680

Comment 5 EWS 2023-01-17 08:58:18 PST

Committed 258986@main (a4467affde12): <https://commits.webkit.org/258986@main>

Reviewed commits have been landed. Closing PR #8680 and removing active labels.

Comment 6 WebKit Commit Bot 2023-01-17 17:43:34 PST

Re-opened since this is blocked by bug 250744

Comment 7 Antoine Quint 2023-01-18 02:03:33 PST

Pull request: https://github.com/WebKit/WebKit/pull/8760

Comment 8 EWS 2023-01-18 22:44:37 PST

Committed 259066@main (f554fc01c126): <https://commits.webkit.org/259066@main>

Reviewed commits have been landed. Closing PR #8760 and removing active labels.

Comment 9 Antoine Quint 2023-02-01 11:30:40 PST

Re-opening for pull request https://github.com/WebKit/WebKit/pull/9466

Comment 10 Antoine Quint 2023-02-01 11:33:51 PST

Mistakenly re-opened this, closing it again.