Bug 314382

Summary: Digital Credentials: Missing empty-vector guard after request validation allows empty picker presentation
Product: WebKit Reporter: Marcos Caceres <marcosc>
Component: WebCore Misc.Assignee: Marcos Caceres <marcosc>
Status: RESOLVED FIXED    
Severity: Normal CC: webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on:    
Bug Blocks: 268516    

Marcos Caceres
Reported 2026-05-08 01:48:45 PDT
When all org-iso-mdoc credential requests fail protocol-specific validation in the IdentityDocumentServices framework, CredentialRequestCoordinator::prepareCredentialRequest() proceeds to show the credential picker with an empty request data set, instead of rejecting the promise with a TypeError as required by the spec. Steps to reproduce: 1. A website calls navigator.credentials.get() with one or more org-iso-mdoc requests 2. ALL requests contain malformed deviceRequest or encryptionInfo data that fails framework validation 3. The IdentityDocumentWebPresentmentRawRequestValidator rejects each request (console warnings are logged) 4. DigitalCredentials::validateRequests() returns an empty vector (no exception) Expected: The promise should be rejected with a TypeError, matching the spec's "Prepare credential requests" algorithm step 7: "If validatedRequests is empty, reject the credential request with a newly created TypeError." Actual: The empty vector is passed to DigitalCredentialsRequestDataBuilder::build(), which wraps it in a DigitalCredentialsRequestData struct, then showDigitalCredentialsPicker() is called with empty request data. Fix: Insert isEmpty() check after releaseReturnValue() and before setCurrentPromise() in CredentialRequestCoordinator::prepareCredentialRequest(). Spec reference: https://w3c-fedid.github.io/digital-credentials/#prepare-credential-requests (step 7) rdar://176530716
Attachments
Radar WebKit Bug Importer
Comment 1 2026-05-08 01:48:50 PDT
Marcos Caceres
Comment 2 2026-05-08 01:58:18 PDT
EWS
Comment 3 2026-07-15 16:21:09 PDT
Committed 317276@main (fa01ab0b2a9c): <https://commits.webkit.org/317276@main> Reviewed commits have been landed. Closing PR #64534 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.