[webkit-changes] [WebKit/WebKit] bcd222: [SOUP] webkit_web_context_allow_tls_certificate_fo...

[Michael Catanzaro]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: bcd2223c93620870bc4b5dc8d077b10d1a3a0df3
      https://github.com/WebKit/WebKit/commit/bcd2223c93620870bc4b5dc8d077b10d1a3a0df3
  Author: Michael Catanzaro <mcatanzaro at redhat.com>
  Date:   2023-11-21 (Tue, 21 Nov 2023)

  Changed paths:
    M Source/WebCore/platform/network/soup/SoupNetworkSession.cpp
    M Source/WebKit/UIProcess/API/glib/WebKitNetworkSession.cpp
    M Source/WebKit/UIProcess/API/glib/WebKitWebContext.cpp

  Log Message:
  -----------
  [SOUP] webkit_web_context_allow_tls_certificate_for_host() fails for IPv6 URIs produced by SoupURI
https://bugs.webkit.org/show_bug.cgi?id=195908

Reviewed by Carlos Garcia Campos.

Nowadays SoupURI has been replaced by GUri, but the underlying problem
remains: IPv6 addresses in URLs have to be surrounded by [] brackets,
and WTF::URL considers these brackets to be part of the host component,
but SoupURI and GUri do not. Alas!

Let's also clarify expected usage of the API. It might be even better to
accept input in both forms and normalize it, but GUri documents that the
brackets are not part of the host, so probably fine for us to do so too.

Finally, note this is a little awkward to test, so I have omitted tests.
We could change WebKitTestServer::run to allow selecting IPV6 and then
run all of TestSSL again twice, and skip them if IPv6 is not enabled. I
was a little tempted to attempt this, but decided I'm lazy and would
rather not spend time on it. This is already an edge case and it's not
the end of the world if it breaks again in the future.

* Source/WebCore/platform/network/soup/SoupNetworkSession.cpp:
(WebCore::hostForComparison):
(WebCore::SoupNetworkSession::checkTLSErrors):
* Source/WebKit/UIProcess/API/glib/WebKitNetworkSession.cpp:
* Source/WebKit/UIProcess/API/glib/WebKitWebContext.cpp:

Canonical link: https://commits.webkit.org/271013@main