Bug 319906

Summary:	Classify the real resolved connection IP for Local Network Access on Cocoa
Product:	WebKit	Reporter:	Ian Gower <i_gower>
Component:	Page Loading	Assignee:	Nobody <webkit-unassigned>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	beidson, webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified
Bug Depends on:	250607
Bug Blocks:

Ian Gower

Reported 2026-07-21 11:02:19 PDT

Adds classifyIPAddressSpace(const IPAddress&) and wires it into NetworkDataTaskCocoa so the resolved connection address, not the request URL's host, is what gets classified for Local Network Access — the host string is attacker-controlled via DNS rebinding, so the policy decision needs to be based on what actually got connected to. Part of the Local Network Access enforcement work (meta bug 250607).

Attachments
Add attachment proposed patch, testcase, etc.

Radar WebKit Bug Importer

Comment 1 2026-07-21 11:02:26 PDT

<rdar://problem/182830220>

Ian Gower

Comment 2 2026-07-21 14:28:33 PDT

Pull request: https://github.com/WebKit/WebKit/pull/69874

Ian Gower

Comment 3 2026-07-21 15:56:47 PDT

Pull request: https://github.com/WebKit/WebKit/pull/69886

EWS

Comment 4 2026-07-23 17:50:09 PDT

Committed 317821@main (40d5429223ca): <https://commits.webkit.org/317821@main> Reviewed commits have been landed. Closing PR #69886 and removing active labels.

Note You need to log in before you can comment on or make changes to this bug.