Bug 250510 - Validate animation key paths sent over IPC
Summary: Validate animation key paths sent over IPC
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Animations (show other bugs)
Version: Safari Technology Preview
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Antoine Quint
URL:
Keywords: InRadar
Depends on: 250509 250519 250520 250641 250642 250744
Blocks:
  Show dependency tree / graph
 
Reported: 2023-01-12 04:16 PST by Antoine Quint
Modified: 2023-02-01 11:33 PST (History)
5 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Antoine Quint 2023-01-12 04:16:40 PST 
We currently send a CAAnimation's keyPath over IPC as a String. We should send this as a struct for the string to be generated in the UI Process for added security.
Comment 1 Antoine Quint 2023-01-12 04:16:54 PST 
rdar://102433824
Comment 2 Antoine Quint 2023-01-12 12:14:17 PST 
Pull request: https://github.com/WebKit/WebKit/pull/8587
Comment 3 Antoine Quint 2023-01-16 01:16:13 PST 
Simon suggested that we keep using strings to represent animation key paths but instead validate the string in the UIProcess once received before creating the CAAnimation. Renaming bug to track this effort.
Comment 4 Antoine Quint 2023-01-16 01:28:28 PST 
Pull request: https://github.com/WebKit/WebKit/pull/8680
Comment 5 EWS 2023-01-17 08:58:18 PST 
Committed 258986@main (a4467affde12): <https://commits.webkit.org/258986@main>

Reviewed commits have been landed. Closing PR #8680 and removing active labels.
Comment 6 WebKit Commit Bot 2023-01-17 17:43:34 PST 
Re-opened since this is blocked by bug 250744
Comment 7 Antoine Quint 2023-01-18 02:03:33 PST 
Pull request: https://github.com/WebKit/WebKit/pull/8760
Comment 8 EWS 2023-01-18 22:44:37 PST 
Committed 259066@main (f554fc01c126): <https://commits.webkit.org/259066@main>

Reviewed commits have been landed. Closing PR #8760 and removing active labels.
Comment 9 Antoine Quint 2023-02-01 11:30:40 PST 
Re-opening for pull request https://github.com/WebKit/WebKit/pull/9466
Comment 10 Antoine Quint 2023-02-01 11:33:51 PST 
Mistakenly re-opened this, closing it again.