fix: Disable Initialization Script Injection into Subframes on MacOS (#1269)

tweidinger · web-flow · commit 03d25357d2c2 · 2024-05-21T04:27:03.000+03:00
diff --git a/.changes/disable-script-inject-subframe.md b/.changes/disable-script-inject-subframe.md
@@ -0,0 +1,5 @@
+---
+"wry": patch
+---
+
+On macOS, disable initialization script injection into subframes.
diff --git a/src/webkitgtk/mod.rs b/src/webkitgtk/mod.rs
@@ -601,6 +601,7 @@ impl InnerWebView {
     if let Some(manager) = self.webview.user_content_manager() {
       let script = UserScript::new(
         js,
+        // TODO: feature to allow injecting into subframes
         UserContentInjectedFrames::TopFrame,
         UserScriptInjectionTime::Start,
         &[],
diff --git a/src/webview2/mod.rs b/src/webview2/mod.rs
@@ -1101,6 +1101,7 @@ impl InnerWebView {
     );
   }
 
+  // TODO: feature to allow injecting into (specific) subframes
   #[inline]
   fn add_script_to_execute_on_document_created(webview: &ICoreWebView2, js: String) -> Result<()> {
     let webview = webview.clone();
diff --git a/src/wkwebview/mod.rs b/src/wkwebview/mod.rs
@@ -1085,10 +1085,8 @@ r#"Object.defineProperty(window, 'ipc', {
     unsafe {
       let userscript: id = msg_send![class!(WKUserScript), alloc];
       let script: id =
-      // FIXME: We allow subframe injection because webview2 does and cannot be disabled (currently).
-      // once webview2 allows disabling all-frame script injection, forMainFrameOnly should be enabled
-      // if it does not break anything. (originally added for isolation pattern).
-        msg_send![userscript, initWithSource:NSString::new(js) injectionTime:0 forMainFrameOnly:0];
+      // TODO: feature to allow injecting into subframes
+        msg_send![userscript, initWithSource:NSString::new(js) injectionTime:0 forMainFrameOnly:1];
       let _: () = msg_send![self.manager, addUserScript: script];
     }
   }

-Original file line number
+Diff line change
@@ @@ -0,0 +1,5 @@ @@
 +---
 +"wry": patch
 +---
++
 +On macOS, disable initialization script injection into subframes.
Original file line number	Diff line number	Diff line change
`@@ -1101,6 +1101,7 @@ impl InnerWebView {`
`1101`	`1101`	`);`
`1102`	`1102`	`}`
`1103`	`1103`
	`1104`	`+ // TODO: feature to allow injecting into (specific) subframes`
`1104`	`1105`	`#[inline]`
`1105`	`1106`	`fn add_script_to_execute_on_document_created(webview: &ICoreWebView2, js: String) -> Result<()> {`
`1106`	`1107`	`let webview = webview.clone();`
Original file line number	Diff line number	Diff line change
`@@ -1085,10 +1085,8 @@ r#"Object.defineProperty(window, 'ipc', {`
`1085`	`1085`	`unsafe {`
`1086`	`1086`	`let userscript: id = msg_send![class!(WKUserScript), alloc];`
`1087`	`1087`	`let script: id =`
`1088`		`- // FIXME: We allow subframe injection because webview2 does and cannot be disabled (currently).`
`1089`		`- // once webview2 allows disabling all-frame script injection, forMainFrameOnly should be enabled`
`1090`		`- // if it does not break anything. (originally added for isolation pattern).`
`1091`		`- msg_send![userscript, initWithSource:NSString::new(js) injectionTime:0 forMainFrameOnly:0];`
	`1088`	`+ // TODO: feature to allow injecting into subframes`
	`1089`	`+ msg_send![userscript, initWithSource:NSString::new(js) injectionTime:0 forMainFrameOnly:1];`
`1092`	`1090`	`let _: () = msg_send![self.manager, addUserScript: script];`
`1093`	`1091`	`}`
`1094`	`1092`	`}`