Skip to content

[Lockdown Mode] Disable XSLT parsing for WebKit in Lockdown Mode #47305

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Draft
wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

[Lockdown Mode] Disable XSLT parsing for WebKit in Lockdown Mode #47305

wants to merge 1 commit into from
+210 −6

Conversation

ronan-apple
Copy link

@ronan-apple ronan-apple commented Jun 27, 2025 •
edited by webkit-early-warning-system
Loading

1dfd8d8

[Lockdown Mode] Disable XSLT parsing for WebKit in Lockdown Mode
https://bugs.webkit.org/show_bug.cgi?id=295107
<rdar://problem/151845594>

Reviewed by NOBODY (OOPS!).

This patch disables XSLT support when in Lockdown Mode by removing
access to the XSLTProcessor constructor to prevent JavaScript usage,
and preventing detection of a stylesheet as XSL unless a newly
introduced feature flag is enabled.

The feature flag is enabled by default and disabled in LDM to prevent
any change in current behaviour.

Added LayoutTests that ensure XSLTProcessor is inaccessible, and suitably
check an XML document with a stylesheet is not processed when in LDM.

* LayoutTests/dom/xsl/lockdown-mode/XSLT-disabled.xml: Added.
* LayoutTests/dom/xsl/lockdown-mode/XSLT-disabled.xsl: Added.
* LayoutTests/js/dom/lockdown-mode/XSLTProcessor-disabled-expected.txt: Added.
* LayoutTests/js/dom/lockdown-mode/XSLTProcessor-disabled.html: Added.
* LayoutTests/js/dom/lockdown-mode/script-tests/XSLTProcessor-disabled.js: Added.
* LayoutTests/platform/glib/TestExpectations:
* LayoutTests/platform/ios/dom/xsl/lockdown-mode/XSLT-disabled-expected.txt: Added.
* LayoutTests/platform/mac-wk1/TestExpectations:
* LayoutTests/platform/mac/dom/xsl/lockdown-mode/XSLT-disabled-expected.txt: Added.
* LayoutTests/platform/win/TestExpectations:
* LayoutTests/platform/wpe/TestExpectations:
* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:
* Source/WebCore/bindings/js/WebCoreBuiltinNames.h:
* Source/WebCore/dom/Document.cpp:
(WebCore::Document::scheduleToApplyXSLTransforms):
* Source/WebCore/dom/ProcessingInstruction.cpp:
(WebCore::ProcessingInstruction::checkStyleSheet):
* Source/WebCore/xml/XSLTProcessor.idl:

1dfd8d8

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
❌ 🧪 style ❌ 🛠 ios ❌ 🛠 mac ❌ 🛠 wpe ⏳ 🛠 win
❌ 🧪 bindings ❌ 🛠 ios-sim ❌ 🛠 mac-AS-debug ❌ 🧪 wpe-wk2 ⏳ 🧪 win-tests
❌ 🧪 webkitperl ❌ 🧪 ios-wk2 ❌ 🧪 api-mac ❌ 🧪 api-wpe
❌ 🧪 ios-wk2-wpt ❌ 🧪 mac-wk1 ❌ 🛠 wpe-cairo
❌ 🛠 🧪 jsc ❌ 🧪 api-ios ❌ 🧪 mac-wk2 ❌ 🛠 gtk
❌ 🛠 🧪 jsc-arm64 ❌ 🛠 vision ❌ 🧪 mac-AS-debug-wk2 ❌ 🧪 gtk-wk2
❌ 🛠 vision-sim ❌ 🧪 mac-wk2-stress ❌ 🧪 api-gtk
⏳ 🧪 vision-wk2 ❌ 🧪 mac-intel-wk2 ❌ 🛠 playstation
❌ 🛠 tv ❌ 🛠 mac-safer-cpp ❌ 🛠 jsc-armv7
❌ 🛠 tv-sim ❌ 🧪 jsc-armv7-tests
❌ 🛠 watch
❌ 🛠 watch-sim

@ronan-apple ronan-apple requested review from cdumez, rniwa and a team as code owners June 27, 2025 16:33
@ronan-apple ronan-apple self-assigned this Jun 27, 2025
@ronan-apple ronan-apple added the New Bugs Unclassified bugs are placed in this component until the correct component can be determined. label Jun 27, 2025
@webkit-early-warning-system
Copy link
Collaborator

webkit-early-warning-system commented Jun 27, 2025 •
edited
Loading

EWS run on previous version of this PR (hash bcc70c6)

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 win
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ❌ 🧪 wpe-wk2 ⏳ 🧪 win-tests
✅ 🧪 webkitperl ❌ 🧪 ios-wk2 ✅ 🧪 api-mac ❌ 🧪 api-wpe
❌ 🧪 ios-wk2-wpt ❌ 🧪 mac-wk1 ✅ 🛠 wpe-cairo
✅ 🛠 🧪 jsc ✅ 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64 ✅ 🛠 vision ✅ 🧪 mac-AS-debug-wk2 ❌ 🧪 gtk-wk2
✅ 🛠 vision-sim ✅ 🧪 mac-wk2-stress ✅ 🧪 api-gtk
✅ 🧪 vision-wk2 ✅ 🧪 mac-intel-wk2   🛠 playstation
✅ 🛠 tv loading 🛠 mac-safer-cpp ✅ 🛠 jsc-armv7
✅ 🛠 tv-sim ❌ 🧪 jsc-armv7-tests
✅ 🛠 watch
✅ 🛠 watch-sim

@ronan-apple
Copy link
Author

Didn't realise this would kick off adding people as reviewers already! Pre-emptively pushing this one up to check tests (I think I'll need to sort out expected results for other platforms for new LayoutTests), and to get an early review from people. Feedback welcome!

lilyspiniolas
lilyspiniolas reviewed Jun 27, 2025
View reviewed changes
LayoutTests/dom/xsl/lockdown-mode/XSLT-disabled.xsl Outdated
Transform - <xsl:value-of select="."/>
</xsl:template>

</xsl:stylesheet>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: add empty newline at EOF

lilyspiniolas
lilyspiniolas reviewed Jun 27, 2025
View reviewed changes
LayoutTests/js/dom/lockdown-mode/script-tests/XSLTProcessor-disabled.js Outdated
"XSLTProcessor disabled test"
);

shouldBeTrue("typeof(XSLTProcessor) === 'undefined'");
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: add empty newline at EOF

@webkit-ews-buildbot webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Jun 27, 2025
@ronan-apple ronan-apple removed the merging-blocked Applied to prevent a change from being merged label Jun 30, 2025
@webkit-early-warning-system
Copy link
Collaborator

webkit-early-warning-system commented Jun 30, 2025 •
edited
Loading

EWS run on previous version of this PR (hash c90770b)

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
❌ 🧪 style ❌ 🛠 ios ❌ 🛠 mac ❌ 🛠 wpe   🛠 win
❌ 🧪 bindings ❌ 🛠 ios-sim ❌ 🛠 mac-AS-debug ❌ 🧪 wpe-wk2   🧪 win-tests
❌ 🧪 webkitperl ❌ 🧪 ios-wk2 ❌ 🧪 api-mac ❌ 🧪 api-wpe
❌ 🧪 ios-wk2-wpt ❌ 🧪 mac-wk1   🛠 wpe-cairo
❌ 🛠 🧪 jsc ❌ 🧪 api-ios ❌ 🧪 mac-wk2 ❌ 🛠 gtk
❌ 🛠 🧪 jsc-arm64 ❌ 🛠 vision ❌ 🧪 mac-AS-debug-wk2 ❌ 🧪 gtk-wk2
❌ 🛠 vision-sim ❌ 🧪 mac-wk2-stress ❌ 🧪 api-gtk
⏳ 🧪 vision-wk2 ❌ 🧪 mac-intel-wk2   🛠 playstation
❌ 🛠 tv ❌ 🛠 mac-safer-cpp ❌ 🛠 jsc-armv7
❌ 🛠 tv-sim ❌ 🧪 jsc-armv7-tests
❌ 🛠 watch
❌ 🛠 watch-sim

@webkit-early-warning-system
Copy link
Collaborator

webkit-early-warning-system commented Jun 30, 2025 •
edited
Loading

EWS run on previous version of this PR (hash 4978d53)

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe   🛠 win
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug   🧪 wpe-wk2   🧪 win-tests
✅ 🧪 webkitperl   🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
  🧪 ios-wk2-wpt   🧪 mac-wk1 ✅ 🛠 wpe-cairo
✅ 🛠 🧪 jsc ✅ 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64 ✅ 🛠 vision   🧪 mac-AS-debug-wk2   🧪 gtk-wk2
✅ 🛠 vision-sim ✅ 🧪 mac-wk2-stress   🧪 api-gtk
✅ 🧪 vision-wk2 ✅ 🧪 mac-intel-wk2   🛠 playstation
✅ 🛠 tv ✅ 🛠 mac-safer-cpp ✅ 🛠 jsc-armv7
✅ 🛠 tv-sim ❌ 🧪 jsc-armv7-tests
✅ 🛠 watch
✅ 🛠 watch-sim

@webkit-early-warning-system
Copy link
Collaborator

webkit-early-warning-system commented Jun 30, 2025 •
edited
Loading

EWS run on previous version of this PR (hash ff86c20)

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 win
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ✅ 🧪 wpe-wk2 ⏳ 🧪 win-tests
✅ 🧪 webkitperl ❌ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
❌ 🧪 ios-wk2-wpt ❌ 🧪 mac-wk1 ✅ 🛠 wpe-cairo
✅ 🛠 🧪 jsc ✅ 🧪 api-ios ✅ 🧪 mac-wk2 ❌ 🛠 gtk
✅ 🛠 🧪 jsc-arm64 ✅ 🛠 vision ✅ 🧪 mac-AS-debug-wk2 ❌ 🧪 gtk-wk2
✅ 🛠 vision-sim ✅ 🧪 mac-wk2-stress ❌ 🧪 api-gtk
✅ 🧪 vision-wk2 ✅ 🧪 mac-intel-wk2   🛠 playstation
✅ 🛠 tv ✅ 🛠 mac-safer-cpp ✅ 🛠 jsc-armv7
✅ 🛠 tv-sim ✅ 🧪 jsc-armv7-tests
✅ 🛠 watch
✅ 🛠 watch-sim

@webkit-ews-buildbot webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Jun 30, 2025
@ronan-apple ronan-apple marked this pull request as draft July 1, 2025 08:37
[Lockdown Mode] Disable XSLT parsing for WebKit in Lockdown Mode
1dfd8d8 
https://bugs.webkit.org/show_bug.cgi?id=295107
<rdar://problem/151845594>

Reviewed by NOBODY (OOPS!).

This patch disables XSLT support when in Lockdown Mode by removing
access to the XSLTProcessor constructor to prevent JavaScript usage,
and preventing detection of a stylesheet as XSL unless a newly
introduced feature flag is enabled.

The feature flag is enabled by default and disabled in LDM to prevent
any change in current behaviour.

Added LayoutTests that ensure XSLTProcessor is inaccessible, and suitably
check an XML document with a stylesheet is not processed when in LDM.

* LayoutTests/dom/xsl/lockdown-mode/XSLT-disabled.xml: Added.
* LayoutTests/dom/xsl/lockdown-mode/XSLT-disabled.xsl: Added.
* LayoutTests/js/dom/lockdown-mode/XSLTProcessor-disabled-expected.txt: Added.
* LayoutTests/js/dom/lockdown-mode/XSLTProcessor-disabled.html: Added.
* LayoutTests/js/dom/lockdown-mode/script-tests/XSLTProcessor-disabled.js: Added.
* LayoutTests/platform/glib/TestExpectations:
* LayoutTests/platform/ios/dom/xsl/lockdown-mode/XSLT-disabled-expected.txt: Added.
* LayoutTests/platform/mac-wk1/TestExpectations:
* LayoutTests/platform/mac/dom/xsl/lockdown-mode/XSLT-disabled-expected.txt: Added.
* LayoutTests/platform/win/TestExpectations:
* LayoutTests/platform/wpe/TestExpectations:
* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:
* Source/WebCore/bindings/js/WebCoreBuiltinNames.h:
* Source/WebCore/dom/Document.cpp:
(WebCore::Document::scheduleToApplyXSLTransforms):
* Source/WebCore/dom/ProcessingInstruction.cpp:
(WebCore::ProcessingInstruction::checkStyleSheet):
* Source/WebCore/xml/XSLTProcessor.idl:
@ronan-apple ronan-apple removed the merging-blocked Applied to prevent a change from being merged label Jul 1, 2025
@webkit-early-warning-system
Copy link
Collaborator

webkit-early-warning-system commented Jul 1, 2025 •
edited
Loading

EWS run on current version of this PR (hash 1dfd8d8)

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
❌ 🧪 style ❌ 🛠 ios ❌ 🛠 mac ❌ 🛠 wpe ⏳ 🛠 win
❌ 🧪 bindings ❌ 🛠 ios-sim ❌ 🛠 mac-AS-debug ❌ 🧪 wpe-wk2 ⏳ 🧪 win-tests
❌ 🧪 webkitperl ❌ 🧪 ios-wk2 ❌ 🧪 api-mac ❌ 🧪 api-wpe
❌ 🧪 ios-wk2-wpt ❌ 🧪 mac-wk1 ❌ 🛠 wpe-cairo
❌ 🛠 🧪 jsc ❌ 🧪 api-ios ❌ 🧪 mac-wk2 ❌ 🛠 gtk
❌ 🛠 🧪 jsc-arm64 ❌ 🛠 vision ❌ 🧪 mac-AS-debug-wk2 ❌ 🧪 gtk-wk2
❌ 🛠 vision-sim ❌ 🧪 mac-wk2-stress ❌ 🧪 api-gtk
⏳ 🧪 vision-wk2 ❌ 🧪 mac-intel-wk2 ❌ 🛠 playstation
❌ 🛠 tv ❌ 🛠 mac-safer-cpp ❌ 🛠 jsc-armv7
❌ 🛠 tv-sim ❌ 🧪 jsc-armv7-tests
❌ 🛠 watch
❌ 🛠 watch-sim

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@lilyspiniolas lilyspiniolas lilyspiniolas left review comments

@cdumez cdumez Awaiting requested review from cdumez cdumez is a code owner

@rniwa rniwa Awaiting requested review from rniwa rniwa is a code owner

Assignees

@ronan-apple ronan-apple

Labels
New Bugs Unclassified bugs are placed in this component until the correct component can be determined.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@ronan-apple @webkit-early-warning-system @lilyspiniolas @webkit-ews-buildbot