RESOLVED FIXED314382
Digital Credentials: Missing empty-vector guard after request validation allows empty picker presentation
https://bugs.webkit.org/show_bug.cgi?id=314382
Summary Digital Credentials: Missing empty-vector guard after request validation allo...
Marcos Caceres
Reported 2026-05-08 01:48:45 PDT
When all org-iso-mdoc credential requests fail protocol-specific validation in the IdentityDocumentServices framework, CredentialRequestCoordinator::prepareCredentialRequest() proceeds to show the credential picker with an empty request data set, instead of rejecting the promise with a TypeError as required by the spec. Steps to reproduce: 1. A website calls navigator.credentials.get() with one or more org-iso-mdoc requests 2. ALL requests contain malformed deviceRequest or encryptionInfo data that fails framework validation 3. The IdentityDocumentWebPresentmentRawRequestValidator rejects each request (console warnings are logged) 4. DigitalCredentials::validateRequests() returns an empty vector (no exception) Expected: The promise should be rejected with a TypeError, matching the spec's "Prepare credential requests" algorithm step 7: "If validatedRequests is empty, reject the credential request with a newly created TypeError." Actual: The empty vector is passed to DigitalCredentialsRequestDataBuilder::build(), which wraps it in a DigitalCredentialsRequestData struct, then showDigitalCredentialsPicker() is called with empty request data. Fix: Insert isEmpty() check after releaseReturnValue() and before setCurrentPromise() in CredentialRequestCoordinator::prepareCredentialRequest(). Spec reference: https://w3c-fedid.github.io/digital-credentials/#prepare-credential-requests (step 7) rdar://176530716
Attachments
Radar WebKit Bug Importer
Comment 1 2026-05-08 01:48:50 PDT
Marcos Caceres
Comment 2 2026-05-08 01:58:18 PDT
EWS
Comment 3 2026-07-15 16:21:09 PDT
Committed 317276@main (fa01ab0b2a9c): <https://commits.webkit.org/317276@main> Reviewed commits have been landed. Closing PR #64534 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.