314382 2026-05-08 01:48:45 -0700 Digital Credentials: Missing empty-vector guard after request validation allows empty picker presentation 2026-07-15 16:21:11 -0700 1 1 1 Unclassified WebKit WebCore Misc. WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 268516 1 marcosc marcosc webkit-bug-importer oldest_to_newest 2208914 0 marcosc 2026-05-08 01:48:45 -0700 When all org-iso-mdoc credential requests fail protocol-specific validation in the IdentityDocumentServices framework, CredentialRequestCoordinator::prepareCredentialRequest() proceeds to show the credential picker with an empty request data set, instead of rejecting the promise with a TypeError as required by the spec. Steps to reproduce: 1. A website calls navigator.credentials.get() with one or more org-iso-mdoc requests 2. ALL requests contain malformed deviceRequest or encryptionInfo data that fails framework validation 3. The IdentityDocumentWebPresentmentRawRequestValidator rejects each request (console warnings are logged) 4. DigitalCredentials::validateRequests() returns an empty vector (no exception) Expected: The promise should be rejected with a TypeError, matching the spec's "Prepare credential requests" algorithm step 7: "If validatedRequests is empty, reject the credential request with a newly created TypeError." Actual: The empty vector is passed to DigitalCredentialsRequestDataBuilder::build(), which wraps it in a DigitalCredentialsRequestData struct, then showDigitalCredentialsPicker() is called with empty request data. Fix: Insert isEmpty() check after releaseReturnValue() and before setCurrentPromise() in CredentialRequestCoordinator::prepareCredentialRequest(). Spec reference: https://w3c-fedid.github.io/digital-credentials/#prepare-credential-requests (step 7) rdar://176530716 2208915 1 webkit-bug-importer 2026-05-08 01:48:50 -0700 <rdar://problem/176536555> 2208918 2 marcosc 2026-05-08 01:58:18 -0700 Pull request: https://github.com/WebKit/WebKit/pull/64534 2230770 3 ews-feeder 2026-07-15 16:21:09 -0700 Committed 317276@main (fa01ab0b2a9c): <https://commits.webkit.org/317276@main> Reviewed commits have been landed. Closing PR #64534 and removing active labels.