fix: use requesting frame origin in permission helper and device choosers#50052
Merged
VerteDinde merged 2 commits intomainfrom Mar 9, 2026
Merged
fix: use requesting frame origin in permission helper and device choosers#50052VerteDinde merged 2 commits intomainfrom
VerteDinde merged 2 commits intomainfrom
Conversation
…ions `WebContentsPermissionHelper::RequestPermission` passes `web_contents_->GetLastCommittedURL()` as the origin to the permission manager instead of the actual requesting frame's origin. This enables origin confusion when granting permissions to embedded third-party iframes, since app permission handlers see the top-level origin instead of the iframe's. The same pattern exists in the HID, USB, and Serial device choosers, where grants are keyed to the primary main frame's origin rather than the requesting frame's. Fix this by using `requesting_frame->GetLastCommittedOrigin()` in all affected code paths, renaming `details.requestingUrl` to `details.requestingOrigin`, and populating it with the serialized origin only.
ee110a5 to
b287b8e
Compare
deepak1556
reviewed
Mar 6, 2026
Member
deepak1556
left a comment
There was a problem hiding this comment.
Nice 👍
Possible to have a deprecation warning for requestingUrl ?
The previous commit changed the details.requestingUrl field to details.requestingOrigin in permission request/check handlers. That field was already populated from the requesting frame's RFH, so the rename was unnecessary and would break apps that read the existing property. Revert to requestingUrl to preserve the existing API shape. The functional changes to use the requesting frame in WebContentsPermissionHelper and the HID/USB/Serial choosers remain.
deepak1556
approved these changes
Mar 7, 2026
|
Release Notes Persisted
|
This was referenced Mar 9, 2026
Contributor
|
I have automatically backported this PR to "39-x-y", please check out #50147 |
Contributor
|
I have automatically backported this PR to "41-x-y", please check out #50148 |
Contributor
|
I have automatically backported this PR to "40-x-y", please check out #50149 |
Member
|
/trop run backport-to 38-x-y |
Contributor
|
The backport process for this PR has been manually initiated - sending your PR to |
Contributor
|
I have automatically backported this PR to "38-x-y", please check out #50151 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of Change
WebContentsPermissionHelper::RequestPermissionwas passingweb_contents_->GetLastCommittedURL()as the requesting origin instead of the actual requesting frame's origin. When a subframe initiates a permission request, this meant the top-level page's URL was forwarded rather than the subframe's. The HID, USB, and Serial device choosers had the same pattern — they keyed grants to the primary main frame's origin instead of the requesting frame's.This PR switches all of these paths to use
requesting_frame->GetLastCommittedOrigin()so the origin matches the frame that actually initiated the request.No API changes —
details.requestingUrlis unchanged (it was already derived from the requesting RFH inElectronPermissionManager).Checklist
npm testpassesRelease Notes
Notes: Fixed an issue where permission and device-chooser handlers received the top-level page origin instead of the requesting subframe's origin.