Disable file access in data transfer operations, except for Cocoa ports

mcatanzaro · mcatanzaro · commit 89838b9164a1 · 2025-12-03T06:18:22.000-08:00
https://bugs.webkit.org/show_bug.cgi?id=303434 Reviewed by Adrian Perez de Castro. This isn't implemented properly for WebKitGTK and most likely also not for other ports. My initial attempts to fix things have failed, so let's just completely disable it for now. However, Apple has confirmed that Safari is OK, so let's leave file access enabled there. Canonical link: https://commits.webkit.org/303828@main
diff --git a/LayoutTests/platform/gtk/editing/pasteboard/paste-image-does-not-reveal-file-url-expected.txt b/LayoutTests/platform/gtk/editing/pasteboard/paste-image-does-not-reveal-file-url-expected.txt
@@ -0,0 +1,14 @@
+Tests that pasting images do not reveal its file URL. To manually test, copy the image below in the context menu and paste into the red box.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+FAIL event.clipboardData.types.includes("Files") should be true. Was false.
+PASS event.clipboardData.getData("url") is ""
+PASS event.clipboardData.getData("text/plain") is ""
+PASS event.clipboardData.getData("text/uri-list") is ""
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
+
diff --git a/Source/WebCore/dom/DataTransfer.h b/Source/WebCore/dom/DataTransfer.h
@@ -123,7 +123,12 @@ class DataTransfer : public RefCountedAndCanMakeWeakPtr<DataTransfer> {
 
     bool allowsFileAccess() const
     {
+#if PLATFORM(COCOA)
         return !forDrag() || forFileDrag();
+#else
+        // Check https://webkit.org/b/271957 before allowing file access for your port.
+        return false;
+#endif
     }
 
 #if ENABLE(DRAG_SUPPORT)

Original file line number	Diff line number	Diff line change
`@@ -123,7 +123,12 @@ class DataTransfer : public RefCountedAndCanMakeWeakPtr<DataTransfer> {`
`123`	`123`
`124`	`124`	`bool allowsFileAccess() const`
`125`	`125`	`{`
	`126`	`+#if PLATFORM(COCOA)`
`126`	`127`	`return !forDrag() \|\| forFileDrag();`
	`128`	`+#else`
	`129`	`+ // Check https://webkit.org/b/271957 before allowing file access for your port.`
	`130`	`+ return false;`
	`131`	`+#endif`
`127`	`132`	`}`
`128`	`133`
`129`	`134`	`#if ENABLE(DRAG_SUPPORT)`