RESOLVED FIXED319906
Classify the real resolved connection IP for Local Network Access on Cocoa 
https://bugs.webkit.org/show_bug.cgi?id=319906
Summary Classify the real resolved connection IP for Local Network Access on Cocoa
Ian Gower
Reported 2026-07-21 11:02:19 PDT
Adds classifyIPAddressSpace(const IPAddress&) and wires it into NetworkDataTaskCocoa so the resolved connection address, not the request URL's host, is what gets classified for Local Network Access — the host string is attacker-controlled via DNS rebinding, so the policy decision needs to be based on what actually got connected to. Part of the Local Network Access enforcement work (meta bug 250607).
Attachments
Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2026-07-21 11:02:26 PDT
<rdar://problem/182830220>
Ian Gower
Comment 2 2026-07-21 14:28:33 PDT
Pull request: https://github.com/WebKit/WebKit/pull/69874
Ian Gower
Comment 3 2026-07-21 15:56:47 PDT
Pull request: https://github.com/WebKit/WebKit/pull/69886
EWS
Comment 4 2026-07-23 17:50:09 PDT
Committed 317821@main (40d5429223ca): <https://commits.webkit.org/317821@main> Reviewed commits have been landed. Closing PR #69886 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.