WebKit Bugzilla
New
Browse
Search+
Log In
×
Sign in with GitHub
or
Remember my login
Create Account
·
Forgot Password
Forgotten password account recovery
RESOLVED FIXED
314382
Digital Credentials: Missing empty-vector guard after request validation allows empty picker presentation
https://bugs.webkit.org/show_bug.cgi?id=314382
Summary
Digital Credentials: Missing empty-vector guard after request validation allo...
Marcos Caceres
Reported
2026-05-08 01:48:45 PDT
When all org-iso-mdoc credential requests fail protocol-specific validation in the IdentityDocumentServices framework, CredentialRequestCoordinator::prepareCredentialRequest() proceeds to show the credential picker with an empty request data set, instead of rejecting the promise with a TypeError as required by the spec. Steps to reproduce: 1. A website calls navigator.credentials.get() with one or more org-iso-mdoc requests 2. ALL requests contain malformed deviceRequest or encryptionInfo data that fails framework validation 3. The IdentityDocumentWebPresentmentRawRequestValidator rejects each request (console warnings are logged) 4. DigitalCredentials::validateRequests() returns an empty vector (no exception) Expected: The promise should be rejected with a TypeError, matching the spec's "Prepare credential requests" algorithm step 7: "If validatedRequests is empty, reject the credential request with a newly created TypeError." Actual: The empty vector is passed to DigitalCredentialsRequestDataBuilder::build(), which wraps it in a DigitalCredentialsRequestData struct, then showDigitalCredentialsPicker() is called with empty request data. Fix: Insert isEmpty() check after releaseReturnValue() and before setCurrentPromise() in CredentialRequestCoordinator::prepareCredentialRequest(). Spec reference:
https://w3c-fedid.github.io/digital-credentials/#prepare-credential-requests
(step 7)
rdar://176530716
Attachments
Add attachment
proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1
2026-05-08 01:48:50 PDT
<
rdar://problem/176536555
>
Marcos Caceres
Comment 2
2026-05-08 01:58:18 PDT
Pull request:
https://github.com/WebKit/WebKit/pull/64534
EWS
Comment 3
2026-07-15 16:21:09 PDT
Committed
317276@main
(fa01ab0b2a9c): <
https://commits.webkit.org/317276@main
> Reviewed commits have been landed. Closing PR #64534 and removing active labels.
Note
You need to
log in
before you can comment on or make changes to this bug.
Top of Page
Format For Printing
XML
Clone This Bug