◆
webkit security monitor
autonomous cve → commit → rca pipeline
Released July 29, 2025

CVE-2025-43227

CVSS 7.5 severity high CWE-359 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Overview

Impact:

Description: Processing maliciously crafted web content may disclose sensitive user information

Researchers: Gilad Moav, Yehuda Afek, Anat Bremler-Barr, and Amit Klein

Key insight. The vulnerability was an incomplete security denylist: port 0 was absent from WebKit’s blocked-port list, so a reserved, non-connectable port slipped past the port policy and became a side-channel/probing vector — fixed by adopting the Fetch spec list and explicitly blocking port 0.

Patch Details

diff --git a/LayoutTests/http/tests/security/block-connection-to-zero-port.https-expected.txt b/LayoutTests/http/tests/security/block-connection-to-zero-port.https-expected.txt
new file mode 100644
index 000000000000..08549eb14739
--- /dev/null
+++ b/LayoutTests/http/tests/security/block-connection-to-zero-port.https-expected.txt
@@ -0,0 +1,2 @@
+CONSOLE MESSAGE: Not allowed to use restricted network port 0: https://does-not-exist.com:0/
+This attempts to measure performance based on the zero port.
diff --git a/LayoutTests/http/tests/security/block-connection-to-zero-port.https.html b/LayoutTests/http/tests/security/block-connection-to-zero-port.https.html
new file mode 100644
index 000000000000..045d1a73ce6e
--- /dev/null
+++ b/LayoutTests/http/tests/security/block-connection-to-zero-port.https.html
@@ -0,0 +1,15 @@
+<html>
+<body>
+<script>
+    if (window.testRunner) {
+        testRunner.dumpAsText();
+        testRunner.waitUntilDone();
+    }
+    fetch("https://does-not-exist.com:0/").catch((e) => {
+        const t1 = performance.now();
+        testRunner.notifyDone(); 
+    });
+</script>
+<p>This attempts to measure performance based on the zero port.</p>
+</body>
+</html>
diff --git a/LayoutTests/platform/gtk-wk2/security/block-test-expected.txt b/LayoutTests/platform/gtk-wk2/security/block-test-expected.txt
new file mode 100644
index 000000000000..27ecb5cf99fd
--- /dev/null
+++ b/LayoutTests/platform/gtk-wk2/security/block-test-expected.txt
@@ -0,0 +1,91 @@
+CONSOLE MESSAGE: Not allowed to use restricted network port 1: http://255.255.255.255:1/test.jpg
+block-test.html - didFinishLoading
+CONSOLE MESSAGE: Not allowed to use restricted network port 7: http://255.255.255.255:7/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 9: http://255.255.255.255:9/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 11: http://255.255.255.255:11/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 13: http://255.255.255.255:13/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 15: http://255.255.255.255:15/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 17: http://255.255.255.255:17/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 19: http://255.255.255.255:19/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 20: http://255.255.255.255:20/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 21: http://255.255.255.255:21/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 22: http://255.255.255.255:22/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 23: http://255.255.255.255:23/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 25: http://255.255.255.255:25/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 37: http://255.255.255.255:37/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 42: http://255.255.255.255:42/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 43: http://255.255.255.255:43/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 53: http://255.255.255.255:53/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 77: http://255.255.255.255:77/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 79: http://255.255.255.255:79/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 87: http://255.255.255.255:87/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 95: http://255.255.255.255:95/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 101: http://255.255.255.255:101/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 102: http://255.255.255.255:102/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 103: http://255.255.255.255:103/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 104: http://255.255.255.255:104/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 109: http://255.255.255.255:109/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 110: http://255.255.255.255:110/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 111: http://255.255.255.255:111/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 113: http://255.255.255.255:113/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 115: http://255.255.255.255:115/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 117: http://255.255.255.255:117/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 119: http://255.255.255.255:119/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 123: http://255.255.255.255:123/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 135: http://255.255.255.255:135/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 139: http://255.255.255.255:139/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 143: http://255.255.255.255:143/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 179: http://255.255.255.255:179/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 389: http://255.255.255.255:389/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 465: http://255.255.255.255:465/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 512: http://255.255.255.255:512/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 513: http://255.255.255.255:513/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 514: http://255.255.255.255:514/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 515: http://255.255.255.255:515/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 526: http://255.255.255.255:526/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 530: http://255.255.255.255:530/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 531: http://255.255.255.255:531/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 532: http://255.255.255.255:532/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 540: http://255.255.255.255:540/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 548: http://255.255.255.255:548/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 556: http://255.255.255.255:556/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 563: http://255.255.255.255:563/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 587: http://255.255.255.255:587/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 601: http://255.255.255.255:601/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 636: http://255.255.255.255:636/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 993: http://255.255.255.255:993/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 995: http://255.255.255.255:995/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 2049: http://255.255.255.255:2049/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 3659: http://255.255.255.255:3659/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 4045: http://255.255.255.255:4045/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 4190: http://255.255.255.255:4190/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6000: http://255.255.255.255:6000/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6665: http://255.255.255.255:6665/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6666: http://255.255.255.255:6666/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6667: http://255.255.255.255:6667/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6668: http://255.255.255.255:6668/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6669: http://255.255.255.255:6669/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6679: http://255.255.255.255:6679/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6697: http://255.255.255.255:6697/test.jpg
+http://255.255.255.255:65535/test.jpg - willSendRequest <NSURLRequest URL http://255.255.255.255:65535/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+http://255.255.255.255:65535/test.jpg - didFailLoadingWithError: <NSError domain g-io-error-quark, code 38, failing URL "http://255.255.255.255:65535/test.jpg">
+CONSOLE MESSAGE: Not allowed to use restricted network port 0: http://255.255.255.255:0/test.jpg
+http://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL http://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+http://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain g-io-error-quark, code 38, failing URL "http://255.255.255.255/test.jpg">
+http://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL http://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+http://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain g-io-error-quark, code 38, failing URL "http://255.255.255.255/test.jpg">
+ftp://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL ftp://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+CONSOLE MESSAGE: FTP URLs are disabled
+CONSOLE MESSAGE: Cannot load image ftp://255.255.255.255/test.jpg due to access control checks.
+ftp://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain WebKitInternal, code 0, failing URL "ftp://255.255.255.255/test.jpg">
+ftp://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL ftp://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+CONSOLE MESSAGE: FTP URLs are disabled
+CONSOLE MESSAGE: Cannot load image ftp://255.255.255.255/test.jpg due to access control checks.
+ftp://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain WebKitInternal, code 0, failing URL "ftp://255.255.255.255/test.jpg">
+ftp://255.255.255.255:22/test.jpg - willSendRequest <NSURLRequest URL ftp://255.255.255.255:22/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+CONSOLE MESSAGE: FTP URLs are disabled
+CONSOLE MESSAGE: Cannot load image ftp://255.255.255.255:22/test.jpg due to access control checks.
+ftp://255.255.255.255:22/test.jpg - didFailLoadingWithError: <NSError domain WebKitInternal, code 0, failing URL "ftp://255.255.255.255:22/test.jpg">
+This test attempts to change the src of an IMG tag to all blocked ports to confirm that WebKit returns the correct error for them - blocked instead of cannot find. It also tries the FTP ports for exemptions. Due to the nature of this test, the results can only be processed automatically via DumpRenderTree
+
+
diff --git a/LayoutTests/platform/wpe/security/block-test-expected.txt b/LayoutTests/platform/wpe/security/block-test-expected.txt
new file mode 100644
index 000000000000..27ecb5cf99fd
--- /dev/null
+++ b/LayoutTests/platform/wpe/security/block-test-expected.txt
@@ -0,0 +1,91 @@
+CONSOLE MESSAGE: Not allowed to use restricted network port 1: http://255.255.255.255:1/test.jpg
+block-test.html - didFinishLoading
+CONSOLE MESSAGE: Not allowed to use restricted network port 7: http://255.255.255.255:7/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 9: http://255.255.255.255:9/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 11: http://255.255.255.255:11/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 13: http://255.255.255.255:13/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 15: http://255.255.255.255:15/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 17: http://255.255.255.255:17/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 19: http://255.255.255.255:19/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 20: http://255.255.255.255:20/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 21: http://255.255.255.255:21/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 22: http://255.255.255.255:22/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 23: http://255.255.255.255:23/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 25: http://255.255.255.255:25/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 37: http://255.255.255.255:37/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 42: http://255.255.255.255:42/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 43: http://255.255.255.255:43/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 53: http://255.255.255.255:53/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 77: http://255.255.255.255:77/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 79: http://255.255.255.255:79/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 87: http://255.255.255.255:87/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 95: http://255.255.255.255:95/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 101: http://255.255.255.255:101/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 102: http://255.255.255.255:102/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 103: http://255.255.255.255:103/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 104: http://255.255.255.255:104/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 109: http://255.255.255.255:109/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 110: http://255.255.255.255:110/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 111: http://255.255.255.255:111/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 113: http://255.255.255.255:113/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 115: http://255.255.255.255:115/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 117: http://255.255.255.255:117/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 119: http://255.255.255.255:119/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 123: http://255.255.255.255:123/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 135: http://255.255.255.255:135/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 139: http://255.255.255.255:139/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 143: http://255.255.255.255:143/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 179: http://255.255.255.255:179/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 389: http://255.255.255.255:389/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 465: http://255.255.255.255:465/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 512: http://255.255.255.255:512/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 513: http://255.255.255.255:513/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 514: http://255.255.255.255:514/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 515: http://255.255.255.255:515/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 526: http://255.255.255.255:526/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 530: http://255.255.255.255:530/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 531: http://255.255.255.255:531/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 532: http://255.255.255.255:532/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 540: http://255.255.255.255:540/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 548: http://255.255.255.255:548/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 556: http://255.255.255.255:556/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 563: http://255.255.255.255:563/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 587: http://255.255.255.255:587/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 601: http://255.255.255.255:601/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 636: http://255.255.255.255:636/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 993: http://255.255.255.255:993/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 995: http://255.255.255.255:995/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 2049: http://255.255.255.255:2049/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 3659: http://255.255.255.255:3659/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 4045: http://255.255.255.255:4045/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 4190: http://255.255.255.255:4190/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6000: http://255.255.255.255:6000/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6665: http://255.255.255.255:6665/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6666: http://255.255.255.255:6666/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6667: http://255.255.255.255:6667/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6668: http://255.255.255.255:6668/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6669: http://255.255.255.255:6669/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6679: http://255.255.255.255:6679/test.jpg

Background

Advisory: Apple Security Advisory

Attribute Value
CVE CVE-2025-43227
Bugzilla 292888
Component WTF
Bug Class Bypass
Severity medium
Commit c3811ccef9594d3a…
Advisory Apple Advisory

Terminology

  • portAllowed — The WTF/URL routine that returns whether a URL’s port may be connected to, consulted before WebKit issues network requests.
  • Port blocking / blockedPortList — A denylist of TCP ports (e.g. FTP, SMTP, NetBIOS) that browsers refuse to connect to over web protocols to prevent protocol-confusion and abuse.
  • Fetch spec port blocking — The WHATWG-standardized list of bad ports (https://fetch.spec.whatwg.org/#port-blocking) that user agents must block; WebKit now aligns to it plus port 0.
  • Port 0 — A reserved TCP port not valid for real connections and used by some systems as a wildcard/ephemeral selector, whose acceptance can enable probing or inconsistent behavior across platforms.
  • Timing side channel — Inferring otherwise-hidden information (like host/service reachability) from measurable differences in how long operations take or which callbacks fire.

Root Cause Analysis

This is a logic error (a missing entry in a security denylist) in wtf::portAllowed in Source/WTF/wtf/URL.cpp, the function WebKit uses to decide whether a URL’s port is permitted for outbound connections. The function early-returns true when the port is falsy (if (!port) return true;) and otherwise checks the port against a static blockedPortList. Before the patch that list was derived from Mozilla’s historical port-banning list and did not contain port 0; combined with the !port early return, port 0 was treated as ’no port specified’ / allowed rather than as an explicit, attacker-supplied restricted port. The invariant that should hold is that reserved/dangerous ports — including port 0, which is not a valid connectable TCP port and is used by some stacks as a wildcard/ephemeral selector — must be blocked so web content cannot direct the browser to attempt connections to them. The fix rewrites the list to follow the WHATWG Fetch spec’s port-blocking list ‘with the addition of port 0’, adding 0, // reserved as the first entry (and updating the guiding comment/URL from the Mozilla reference to https://fetch.spec.whatwg.org/#port-blocking). The added layout tests confirm the new behavior: a fetch to https://does-not-exist.com:0/ now yields the console message ‘Not allowed to use restricted network port 0’, and the platform block-test expectations now include port 0 among the blocked ports. Note the !port early return is unchanged in the shown diff; whether an explicit ‘:0’ reaches portAllowed as port==0 (and is now caught by the list) versus being normalized earlier is only partially visible, but the added test proving port 0 is blocked and the CVE’s information-disclosure framing indicate the observable gap was that connections/attempts to port 0 were previously permitted.

Attack Path

1. Serve malicious web content

The attacker gets a victim to load a page under attacker control (or injects script into a context that can issue fetches/resource loads).

2. Issue a request to port 0

From the page, initiate a subresource load or fetch("https://host:0/") targeting an internal or arbitrary host on port 0, which pre-patch was not in the blocked port list and thus not rejected by portAllowed.

3. Measure timing/behavioral side channels

As the test’s own comment (‘attempts to measure performance based on the zero port’) hints, observe timing or error-callback differences between allowed vs. blocked/failed connections to infer information such as host reachability or network state.

4. Disclose sensitive information

Aggregate the observed differences to disclose sensitive user/network information (e.g. probe internal services), the impact the CVE describes; post-patch the request is rejected with ‘Not allowed to use restricted network port 0’ before any such attempt.

Impact Assessment

This is a policy/denylist logic error, not a memory-safety bug: there is no OOB/UAF primitive and no path to code execution from the diff. The realistic impact, matching the CVE, is information disclosure — web content could direct connection attempts to port 0 and use timing/behavioral differences to probe network or host state that should be off-limits. The connection policy is enforced in the process that performs URL loading (WebContent/Network path); the fix simply denies port 0, closing the probing avenue rather than mitigating corruption.

Audit Directions

Completeness of blockedPortList vs. Fetch spec

Diff WebKit’s blockedPortList against the current WHATWG Fetch port-blocking list for any other missing or stale entries; grep URL.cpp for blockedPortList and confirm ordering/binary-search assumptions still hold after inserting 0.

The !port early-return and port normalization

Trace how ‘:0’ and empty ports are parsed and normalized before portAllowed (grep for port(), parsePort, defaultPortForProtocol, !port) to ensure port 0 is not still short-circuited to ‘allowed’ on some path or protocol.

Other connection-policy denylists

Look for parallel allow/deny checks (mixed-content, local-network/private-network access, scheme allowlists) that gate outbound requests; grep for ‘restricted network port’, ‘Not allowed to use’, and per-scheme port defaults to find lists that may similarly omit reserved values.

Changed Functions

Function File Change Note
portAllowed Source/WTF/wtf/URL.cpp modified Replaces the Mozilla-derived blockedPortList with the WHATWG Fetch-spec port-blocking list and adds 0 // reserved as a blocked port; updates the reference comment/URL. Net effect: URLs with port 0 are now rejected instead of allowed.

Files Changed

Source Files

  • Source/WTF/wtf/URL.cpp

Test Files

  • LayoutTests/http/tests/security/block-connection-to-zero-port.https-expected.txt
  • LayoutTests/http/tests/security/block-connection-to-zero-port.https.html
  • LayoutTests/platform/gtk-wk2/security/block-test-expected.txt
  • LayoutTests/platform/wpe/security/block-test-expected.txt

Regression Test

The fix ships this proof-of-concept / regression test:

diff --git a/LayoutTests/http/tests/security/block-connection-to-zero-port.https-expected.txt b/LayoutTests/http/tests/security/block-connection-to-zero-port.https-expected.txt
new file mode 100644
index 000000000000..08549eb14739
--- /dev/null
+++ b/LayoutTests/http/tests/security/block-connection-to-zero-port.https-expected.txt
@@ -0,0 +1,2 @@
+CONSOLE MESSAGE: Not allowed to use restricted network port 0: https://does-not-exist.com:0/
+This attempts to measure performance based on the zero port.
diff --git a/LayoutTests/http/tests/security/block-connection-to-zero-port.https.html b/LayoutTests/http/tests/security/block-connection-to-zero-port.https.html
new file mode 100644
index 000000000000..045d1a73ce6e
--- /dev/null
+++ b/LayoutTests/http/tests/security/block-connection-to-zero-port.https.html
@@ -0,0 +1,15 @@
+<html>
+<body>
+<script>
+    if (window.testRunner) {
+        testRunner.dumpAsText();
+        testRunner.waitUntilDone();
+    }
+    fetch("https://does-not-exist.com:0/").catch((e) => {
+        const t1 = performance.now();
+        testRunner.notifyDone(); 
+    });
+</script>
+<p>This attempts to measure performance based on the zero port.</p>
+</body>
+</html>
diff --git a/LayoutTests/platform/gtk-wk2/security/block-test-expected.txt b/LayoutTests/platform/gtk-wk2/security/block-test-expected.txt
new file mode 100644
index 000000000000..27ecb5cf99fd
--- /dev/null
+++ b/LayoutTests/platform/gtk-wk2/security/block-test-expected.txt
@@ -0,0 +1,91 @@
+CONSOLE MESSAGE: Not allowed to use restricted network port 1: http://255.255.255.255:1/test.jpg
+block-test.html - didFinishLoading
+CONSOLE MESSAGE: Not allowed to use restricted network port 7: http://255.255.255.255:7/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 9: http://255.255.255.255:9/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 11: http://255.255.255.255:11/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 13: http://255.255.255.255:13/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 15: http://255.255.255.255:15/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 17: http://255.255.255.255:17/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 19: http://255.255.255.255:19/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 20: http://255.255.255.255:20/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 21: http://255.255.255.255:21/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 22: http://255.255.255.255:22/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 23: http://255.255.255.255:23/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 25: http://255.255.255.255:25/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 37: http://255.255.255.255:37/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 42: http://255.255.255.255:42/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 43: http://255.255.255.255:43/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 53: http://255.255.255.255:53/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 77: http://255.255.255.255:77/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 79: http://255.255.255.255:79/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 87: http://255.255.255.255:87/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 95: http://255.255.255.255:95/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 101: http://255.255.255.255:101/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 102: http://255.255.255.255:102/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 103: http://255.255.255.255:103/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 104: http://255.255.255.255:104/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 109: http://255.255.255.255:109/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 110: http://255.255.255.255:110/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 111: http://255.255.255.255:111/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 113: http://255.255.255.255:113/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 115: http://255.255.255.255:115/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 117: http://255.255.255.255:117/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 119: http://255.255.255.255:119/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 123: http://255.255.255.255:123/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 135: http://255.255.255.255:135/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 139: http://255.255.255.255:139/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 143: http://255.255.255.255:143/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 179: http://255.255.255.255:179/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 389: http://255.255.255.255:389/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 465: http://255.255.255.255:465/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 512: http://255.255.255.255:512/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 513: http://255.255.255.255:513/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 514: http://255.255.255.255:514/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 515: http://255.255.255.255:515/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 526: http://255.255.255.255:526/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 530: http://255.255.255.255:530/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 531: http://255.255.255.255:531/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 532: http://255.255.255.255:532/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 540: http://255.255.255.255:540/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 548: http://255.255.255.255:548/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 556: http://255.255.255.255:556/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 563: http://255.255.255.255:563/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 587: http://255.255.255.255:587/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 601: http://255.255.255.255:601/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 636: http://255.255.255.255:636/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 993: http://255.255.255.255:993/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 995: http://255.255.255.255:995/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 2049: http://255.255.255.255:2049/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 3659: http://255.255.255.255:3659/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 4045: http://255.255.255.255:4045/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 4190: http://255.255.255.255:4190/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6000: http://255.255.255.255:6000/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6665: http://255.255.255.255:6665/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6666: http://255.255.255.255:6666/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6667: http://255.255.255.255:6667/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6668: http://255.255.255.255:6668/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6669: http://255.255.255.255:6669/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6679: http://255.255.255.255:6679/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6697: http://255.255.255.255:6697/test.jpg
+http://255.255.255.255:65535/test.jpg - willSendRequest <NSURLRequest URL http://255.255.255.255:65535/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+http://255.255.255.255:65535/test.jpg - didFailLoadingWithError: <NSError domain g-io-error-quark, code 38, failing URL "http://255.255.255.255:65535/test.jpg">
+CONSOLE MESSAGE: Not allowed to use restricted network port 0: http://255.255.255.255:0/test.jpg
+http://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL http://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+http://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain g-io-error-quark, code 38, failing URL "http://255.255.255.255/test.jpg">
+http://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL http://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+http://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain g-io-error-quark, code 38, failing URL "http://255.255.255.255/test.jpg">
+ftp://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL ftp://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+CONSOLE MESSAGE: FTP URLs are disabled
+CONSOLE MESSAGE: Cannot load image ftp://255.255.255.255/test.jpg due to access control checks.
+ftp://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain WebKitInternal, code 0, failing URL "ftp://255.255.255.255/test.jpg">
+ftp://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL ftp://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+CONSOLE MESSAGE: FTP URLs are disabled
+CONSOLE MESSAGE: Cannot load image ftp://255.255.255.255/test.jpg due to access control checks.
+ftp://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain WebKitInternal, code 0, failing URL "ftp://255.255.255.255/test.jpg">
+ftp://255.255.255.255:22/test.jpg - willSendRequest <NSURLRequest URL ftp://255.255.255.255:22/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+CONSOLE MESSAGE: FTP URLs are disabled
+CONSOLE MESSAGE: Cannot load image ftp://255.255.255.255:22/test.jpg due to access control checks.
+ftp://255.255.255.255:22/test.jpg - didFailLoadingWithError: <NSError domain WebKitInternal, code 0, failing URL "ftp://255.255.255.255:22/test.jpg">
+This test attempts to change the src of an IMG tag to all blocked ports to confirm that WebKit returns the correct error for them - blocked instead of cannot find. It also tries the FTP ports for exemptions. Due to the nature of this test, the results can only be processed automatically via DumpRenderTree
+
+
diff --git a/LayoutTests/platform/wpe/security/block-test-expected.txt b/LayoutTests/platform/wpe/security/block-test-expected.txt
new file mode 100644
index 000000000000..27ecb5cf99fd
--- /dev/null
+++ b/LayoutTests/platform/wpe/security/block-test-expected.txt
@@ -0,0 +1,91 @@
+CONSOLE MESSAGE: Not allowed to use restricted network port 1: http://255.255.255.255:1/test.jpg
+block-test.html - didFinishLoading
+CONSOLE MESSAGE: Not allowed to use restricted network port 7: http://255.255.255.255:7/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 9: http://255.255.255.255:9/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 11: http://255.255.255.255:11/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 13: http://255.255.255.255:13/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 15: http://255.255.255.255:15/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 17: http://255.255.255.255:17/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 19: http://255.255.255.255:19/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 20: http://255.255.255.255:20/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 21: http://255.255.255.255:21/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 22: http://255.255.255.255:22/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 23: http://255.255.255.255:23/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 25: http://255.255.255.255:25/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 37: http://255.255.255.255:37/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 42: http://255.255.255.255:42/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 43: http://255.255.255.255:43/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 53: http://255.255.255.255:53/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 77: http://255.255.255.255:77/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 79: http://255.255.255.255:79/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 87: http://255.255.255.255:87/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 95: http://255.255.255.255:95/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 101: http://255.255.255.255:101/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 102: http://255.255.255.255:102/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 103: http://255.255.255.255:103/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 104: http://255.255.255.255:104/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 109: http://255.255.255.255:109/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 110: http://255.255.255.255:110/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 111: http://255.255.255.255:111/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 113: http://255.255.255.255:113/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 115: http://255.255.255.255:115/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 117: http://255.255.255.255:117/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 119: http://255.255.255.255:119/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 123: http://255.255.255.255:123/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 135: http://255.255.255.255:135/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 139: http://255.255.255.255:139/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 143: http://255.255.255.255:143/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 179: http://255.255.255.255:179/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 389: http://255.255.255.255:389/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 465: http://255.255.255.255:465/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 512: http://255.255.255.255:512/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 513: http://255.255.255.255:513/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 514: http://255.255.255.255:514/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 515: http://255.255.255.255:515/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 526: http://255.255.255.255:526/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 530: http://255.255.255.255:530/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 531: http://255.255.255.255:531/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 532: http://255.255.255.255:532/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 540: http://255.255.255.255:540/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 548: http://255.255.255.255:548/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 556: http://255.255.255.255:556/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 563: http://255.255.255.255:563/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 587: http://255.255.255.255:587/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 601: http://255.255.255.255:601/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 636: http://255.255.255.255:636/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 993: http://255.255.255.255:993/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 995: http://255.255.255.255:995/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 2049: http://255.255.255.255:2049/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 3659: http://255.255.255.255:3659/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 4045: http://255.255.255.255:4045/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 4190: http://255.255.255.255:4190/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6000: http://255.255.255.255:6000/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6665: http://255.255.255.255:6665/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6666: http://255.255.255.255:6666/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6667: http://255.255.255.255:6667/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6668: http://255.255.255.255:6668/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6669: http://255.255.255.255:6669/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6679: http://255.255.255.255:6679/test.jpg
+CONSOLE MESSAGE: Not allowed to use restricted network port 6697: http://255.255.255.255:6697/test.jpg
+http://255.255.255.255:65535/test.jpg - willSendRequest <NSURLRequest URL http://255.255.255.255:65535/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+http://255.255.255.255:65535/test.jpg - didFailLoadingWithError: <NSError domain g-io-error-quark, code 38, failing URL "http://255.255.255.255:65535/test.jpg">
+CONSOLE MESSAGE: Not allowed to use restricted network port 0: http://255.255.255.255:0/test.jpg
+http://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL http://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+http://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain g-io-error-quark, code 38, failing URL "http://255.255.255.255/test.jpg">
+http://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL http://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+http://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain g-io-error-quark, code 38, failing URL "http://255.255.255.255/test.jpg">
+ftp://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL ftp://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+CONSOLE MESSAGE: FTP URLs are disabled
+CONSOLE MESSAGE: Cannot load image ftp://255.255.255.255/test.jpg due to access control checks.
+ftp://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain WebKitInternal, code 0, failing URL "ftp://255.255.255.255/test.jpg">
+ftp://255.255.255.255/test.jpg - willSendRequest <NSURLRequest URL ftp://255.255.255.255/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+CONSOLE MESSAGE: FTP URLs are disabled
+CONSOLE MESSAGE: Cannot load image ftp://255.255.255.255/test.jpg due to access control checks.
+ftp://255.255.255.255/test.jpg - didFailLoadingWithError: <NSError domain WebKitInternal, code 0, failing URL "ftp://255.255.255.255/test.jpg">
+ftp://255.255.255.255:22/test.jpg - willSendRequest <NSURLRequest URL ftp://255.255.255.255:22/test.jpg, main document URL block-test.html, http method GET> redirectResponse (null)
+CONSOLE MESSAGE: FTP URLs are disabled
+CONSOLE MESSAGE: Cannot load image ftp://255.255.255.255:22/test.jpg due to access control checks.
+ftp://255.255.255.255:22/test.jpg - didFailLoadingWithError: <NSError domain WebKitInternal, code 0, failing URL "ftp://255.255.255.255:22/test.jpg">
+This test attempts to change the src of an IMG tag to all blocked ports to confirm that WebKit returns the correct error for them - blocked instead of cannot find. It also tries the FTP ports for exemptions. Due to the nature of this test, the results can only be processed automatically via DumpRenderTree
+
+