[webkit-changes] [WebKit/WebKit] e949df: [GTK][WPE][a11y] Allow receiving event listener si...

[Georges Basile Stavracas Neto]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: e949df8b32a3700cf8ef333c33b9c34badcdca8f
      https://github.com/WebKit/WebKit/commit/e949df8b32a3700cf8ef333c33b9c34badcdca8f
  Author: Georges Basile Stavracas Neto <feaneron at igalia.com>
  Date:   2024-07-09 (Tue, 09 Jul 2024)

  Changed paths:
    M Source/WebKit/UIProcess/Launcher/glib/XDGDBusProxy.cpp

  Log Message:
  -----------
  [GTK][WPE][a11y] Allow receiving event listener signals from the a11y bus
https://bugs.webkit.org/show_bug.cgi?id=240522

Reviewed by Michael Catanzaro.

When a process - usually an AT - registers event listeners, AT-SPI
broadcasts the EventListenerRegistered signal so that clients know
about it. The EventListenerDeregistered signal is broadcasted when
event listeners are removed.

The web process monitors for these signal so that it can reduce the
number of signal emissions on the a11y bus. Now consider that the web
process runs in a sandbox (most of the time anyway), either by using
Bubblewrap directly, or flatpak-spawn. These sandboxing mechanisms
filter D-Bus messages and signals, including on the a11y bus. And
here's the problem: both of them end up preventing the web process to
receive the event listener signals!

As a consequence, the web process never learns when the user turns
on or off the screen reader, or auxiliary accessibility programs.
And without that knowledge, the web process doesn't emit any event
necessary for proper accessibility.

Allow the Bubblewrap sandbox to receive the EventListenerRegistered
and EventListenerDeregistered signals from org.a11y.atspi.Registry.
This is safe, as there is insufficient information in these signals
for any malicious usage, and the bus name in the messages are already
from apps that purposefully advertise themselves.

A similar patch is proposed for Flatpak, and there's nothing to be
done from WebKit side to influence that.

* Source/WebKit/UIProcess/Launcher/glib/XDGDBusProxy.cpp:
(WebKit::XDGDBusProxy::accessibilityProxy):

Canonical link: https://commits.webkit.org/280770@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications