Repository navigation
Conversation
|
EWS run on previous version of this PR (hash e086e4b) Details |
e086e4b to
b92b12f
Compare
|
EWS run on previous version of this PR (hash b92b12f) Details |
| ) | ||
|
|
||
| if (ENABLE_WEBDRIVER_BIDI) | ||
| set(WebDriver_BIDI_PROTOCOL_INPUTS |
There was a problem hiding this comment.
This is another instance of the list in Source/WebKit/CMakeLists.txt, DerivedSources.make and DerivedSources-input.xcfilelist, and it has already drifted. BidiInput.json landed on main last week (7f43fa7) and isn't here, so after a rebase every input.* command gets unknown command from WebKitWebDriver instead of being relayed. There's no build error when that happens, which is what worries me.
Followup: can we keep one source of truth? Either a shared include that both directories read, or have the generator read the already combined CombinedWebDriverBidiDomains.json, which also gets condition filtering for free.
There was a problem hiding this comment.
i have picked the generator using the CombinedWebDriverBidiDomains.json
| RELEASE_LOG(WebDriverBiDi, "BiDi-only sessions are not supported yet. Rejecting handshake."); | ||
| return false; | ||
| } | ||
| if (*foundResource == "/session"_s) |
There was a problem hiding this comment.
Now that /session handshakes are accepted, any page on the machine can open a socket to the driver (browsers don't apply CORS to WebSockets), and as far as I can tell we don't check Origin or Host anywhere in the soup handshake. Today that only exposes session.status, but once session.new lands in #75992 it becomes a way to create and drive a session. I'm going to ask for the check on that PR, but if it's easier to do here in acceptHandshake, even better.
Nit: the // FIXME Add support for bidi-only sessions went away with nothing replacing it. If this lands well before #75992, please put back a FIXME pointing at https://bugs.webkit.org/show_bug.cgi?id=281722, since session.new on this connection currently says "Unknown command".
There was a problem hiding this comment.
i have added a patch for handshake validation #77457
b92b12f to
c6a64a4
Compare
|
EWS run on previous version of this PR (hash c6a64a4) Details |
c6a64a4 to
61c473b
Compare
|
EWS run on previous version of this PR (hash 61c473b) Details |
https://bugs.webkit.org/show_bug.cgi?id=281721 Reviewed by NOBODY (OOPS!). Classify incoming BiDi commands before requiring the connection to have an associated session. Handle static session.status commands locally, reject known session-bound commands with invalid session id when no session is associated, and reject unknown methods with unknown command. Generate the session-bound command catalog from WebKit's combined BiDi protocol schema instead of maintaining a second protocol-file list. This keeps classification in sync with the domains used by WebKit's BiDi backend and automatically includes newly added domains such as input. Admit connections to the default /session resource, preserve the incoming connection on responses, and make connection cleanup safe when no session exists. WebDriverBidiProcessor remains unchanged and receives only commands that pass the session gate. Regression coverage for static, session-bound, and unknown commands without an active session is submitted upstream in web-platform-tests/wpt#63212 and was exercised locally with WebKitWebDriver. * Source/WebDriver/CMakeLists.txt: Generate the session-bound BiDi command-name header from WebKit's existing combined BiDi protocol schema. * Source/WebDriver/WebDriverService.cpp: (WebDriver::WebDriverService::s_staticBidiCommands): Rename the local table to state that it contains static commands. (WebDriver::WebDriverService::acceptHandshake): Admit connections to /session without requiring an active session and make session-specific validation null-safe. (WebDriver::WebDriverService::handleMessage): Distinguish static, session-bound, and unknown commands before applying the session gate. (WebDriver::WebDriverService::findStaticBidiCommand): Look up a static command descriptor by method name. (WebDriver::WebDriverService::clientDisconnected): Clean up unassociated connections without dereferencing the current session. * Source/WebDriver/WebDriverService.h: Rename the local command descriptor and lookup to identify their static scope. * Source/WebKit/Scripts/generate-webdriver-bidi-command-names.py: Added. (parse_arguments): Parse the output and combined protocol schema paths. (command_names): Collect and validate fully qualified command names from the combined schema's domains. (generate_header): Generate the sorted command-name set. (main): Write the generated header.
61c473b to
316e9d2
Compare
|
EWS run on current version of this PR (hash 316e9d2) Details |
[WebDriver][BiDi] Distinguish static and session-bound commands
https://bugs.webkit.org/show_bug.cgi?id=281721
Reviewed by NOBODY (OOPS!).
Classify incoming BiDi commands before requiring the connection to have an associated session. Handle static session.status commands locally, reject known session-bound commands with invalid session id when no session is associated, and reject unknown methods with unknown command.
Generate the session-bound command catalog from WebKit's current BiDi protocol schemas instead of maintaining a second manual list. Admit connections to the default /session resource, preserve the incoming connection on responses, and make connection cleanup safe when no session exists. WebDriverBidiProcessor remains unchanged and receives only commands that pass the session gate.
Regression coverage for static, session-bound, and unknown commands without an active session is submitted upstream in
web-platform-tests/wpt#63212 and was exercised locally with WebKitWebDriver.
(WebDriver::WebDriverService::acceptHandshake): Admit connections to /session without requiring an active session and make session-specific validation null-safe.
(WebDriver::WebDriverService::handleMessage): Distinguish static, session-bound, and unknown commands before applying the session gate. (WebDriver::WebDriverService::findStaticBidiCommand): Look up a static command descriptor by method name.
(WebDriver::WebDriverService::clientDisconnected): Clean up unassociated connections without dereferencing the current session.
316e9d2
🛠 playstation