From c92d2531b571b2172852dc1e169ecde12e9bfb4c Mon Sep 17 00:00:00 2001 From: Cheng Zhao Date: Wed, 17 Dec 2014 16:32:25 -0800 Subject: [PATCH 1/6] Add "disablewebsecurity" attribute for --- atom/browser/lib/guest-view-manager.coffee | 1 + atom/browser/web_view/web_view_manager.cc | 8 ++++++-- atom/browser/web_view/web_view_manager.h | 1 + atom/browser/web_view/web_view_renderer_state.h | 1 + atom/renderer/lib/web-view/web-view-attributes.coffee | 1 + atom/renderer/lib/web-view/web-view-constants.coffee | 1 + 6 files changed, 11 insertions(+), 2 deletions(-) diff --git a/atom/browser/lib/guest-view-manager.coffee b/atom/browser/lib/guest-view-manager.coffee index bbabf3c5d6..51e7bdf91d 100644 --- a/atom/browser/lib/guest-view-manager.coffee +++ b/atom/browser/lib/guest-view-manager.coffee @@ -93,6 +93,7 @@ attachGuest = (embedder, elementInstanceId, guestInstanceId, params) -> webViewManager.addGuest guestInstanceId, elementInstanceId, embedder, guest, nodeIntegration: params.nodeintegration plugins: params.plugins + disableWebSecurity: params.disablewebsecurity preloadUrl: params.preload ? '' guest.attachParams = params diff --git a/atom/browser/web_view/web_view_manager.cc b/atom/browser/web_view/web_view_manager.cc index c638c18e12..20c5088109 100644 --- a/atom/browser/web_view/web_view_manager.cc +++ b/atom/browser/web_view/web_view_manager.cc @@ -41,7 +41,8 @@ struct Converter { return false; return options.Get("nodeIntegration", &(out->node_integration)) && options.Get("plugins", &(out->plugins)) && - options.Get("preloadUrl", &(out->preload_url)); + options.Get("preloadUrl", &(out->preload_url)) && + options.Get("disableWebSecurity", &(out->disable_web_security)); } }; @@ -63,7 +64,10 @@ void WebViewManager::AddGuest(int guest_instance_id, web_contents_map_[guest_instance_id] = { web_contents, embedder }; WebViewRendererState::WebViewInfo web_view_info = { - guest_instance_id, options.node_integration, options.plugins + guest_instance_id, + options.node_integration, + options.plugins, + options.disable_web_security, }; net::FileURLToFilePath(options.preload_url, &web_view_info.preload_script); content::BrowserThread::PostTask( diff --git a/atom/browser/web_view/web_view_manager.h b/atom/browser/web_view/web_view_manager.h index e14d31cec0..bc58bd34f4 100644 --- a/atom/browser/web_view/web_view_manager.h +++ b/atom/browser/web_view/web_view_manager.h @@ -24,6 +24,7 @@ class WebViewManager : public content::BrowserPluginGuestManager { struct WebViewOptions { bool node_integration; bool plugins; + bool disable_web_security; GURL preload_url; }; diff --git a/atom/browser/web_view/web_view_renderer_state.h b/atom/browser/web_view/web_view_renderer_state.h index bddf803704..57373b5449 100644 --- a/atom/browser/web_view/web_view_renderer_state.h +++ b/atom/browser/web_view/web_view_renderer_state.h @@ -24,6 +24,7 @@ class WebViewRendererState { int guest_instance_id; bool node_integration; bool plugins; + bool disable_web_security; base::FilePath preload_script; }; diff --git a/atom/renderer/lib/web-view/web-view-attributes.coffee b/atom/renderer/lib/web-view/web-view-attributes.coffee index a3e97b5be4..00d076cdd8 100644 --- a/atom/renderer/lib/web-view/web-view-attributes.coffee +++ b/atom/renderer/lib/web-view/web-view-attributes.coffee @@ -195,6 +195,7 @@ WebViewImpl::setupWebViewAttributes = -> @attributes[webViewConstants.ATTRIBUTE_HTTPREFERRER] = new HttpReferrerAttribute(this) @attributes[webViewConstants.ATTRIBUTE_NODEINTEGRATION] = new BooleanAttribute(webViewConstants.ATTRIBUTE_NODEINTEGRATION, this) @attributes[webViewConstants.ATTRIBUTE_PLUGINS] = new BooleanAttribute(webViewConstants.ATTRIBUTE_PLUGINS, this) + @attributes[webViewConstants.ATTRIBUTE_DISABLEWEBSECURITY] = new BooleanAttribute(webViewConstants.ATTRIBUTE_DISABLEWEBSECURITY, this) @attributes[webViewConstants.ATTRIBUTE_PRELOAD] = new PreloadAttribute(this) autosizeAttributes = [ diff --git a/atom/renderer/lib/web-view/web-view-constants.coffee b/atom/renderer/lib/web-view/web-view-constants.coffee index f40f14c4d7..9c9beaecf9 100644 --- a/atom/renderer/lib/web-view/web-view-constants.coffee +++ b/atom/renderer/lib/web-view/web-view-constants.coffee @@ -12,6 +12,7 @@ module.exports = ATTRIBUTE_HTTPREFERRER: 'httpreferrer' ATTRIBUTE_NODEINTEGRATION: 'nodeintegration' ATTRIBUTE_PLUGINS: 'plugins' + ATTRIBUTE_DISABLEWEBSECURITY: 'disablewebsecurity' ATTRIBUTE_PRELOAD: 'preload' # Internal attribute. From 947e6aca9b933cfd2487cac8231a646e8af8ca84 Mon Sep 17 00:00:00 2001 From: Cheng Zhao Date: Wed, 17 Dec 2014 18:13:39 -0800 Subject: [PATCH 2/6] Set web preferences for guest page --- atom/browser/atom_browser_client.cc | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/atom/browser/atom_browser_client.cc b/atom/browser/atom_browser_client.cc index 7b908676b1..827dbe4e15 100644 --- a/atom/browser/atom_browser_client.cc +++ b/atom/browser/atom_browser_client.cc @@ -96,6 +96,14 @@ void AtomBrowserClient::OverrideWebkitPrefs( return; } + // Custom preferences of guest page. + int guest_process_id = render_view_host->GetProcess()->GetID(); + WebViewRendererState::WebViewInfo info; + if (WebViewRendererState::GetInstance()->GetInfo(guest_process_id, &info)) { + prefs->web_security_enabled = !info.disable_web_security; + return; + } + NativeWindow* window = NativeWindow::FromRenderView( render_view_host->GetProcess()->GetID(), render_view_host->GetRoutingID()); From 40ab21d9dfa7dd501de94d2c1b364c21e4ebf697 Mon Sep 17 00:00:00 2001 From: Cheng Zhao Date: Wed, 17 Dec 2014 18:14:10 -0800 Subject: [PATCH 3/6] spec: "disablewebsecurity" attribute --- spec/fixtures/assets/logo.png | Bin 0 -> 14022 bytes spec/webview-spec.coffee | 30 ++++++++++++++++++++++++++++++ 2 files changed, 30 insertions(+) create mode 100644 spec/fixtures/assets/logo.png diff --git a/spec/fixtures/assets/logo.png b/spec/fixtures/assets/logo.png new file mode 100644 index 0000000000000000000000000000000000000000..1974f31885813d9a4c44a514b01ab09374849bd0 GIT binary patch literal 14022 zcmX}Tdpy(s`#-)p%&=k3o70?y9M*EmVT>V%kV@rjH069sD07-GM9e*f&b+vB=+UH9vL9UjlqvR#~Qp#lg20002Bx3hKw0JspG z@9kg^=QH}zy)6L1fMRcL>F&|R>gnAV>2JI*&d3l%jJv)i@!Bv9XExK*@7uLf2y1W;7?;(UQMd(F4UzWs~K zw$oQ59j%?eFP@u-#tm}+hhLZOb@Rhi-u(~rNd>gagrpH3kf?JceQ5n;c@7#~W5FV3 zq`tDV{mO5JP5OQ3P6}8kZ>}zlT#x~x(P9YzX&Zdf7cQI#`ftq;5Gu%K19RWj>?IR( zlr+mf@LQ(M%ov5CsOzQx_&UQ9kB1|OHbRS{($4&JSDU-8iA(^FkuCIthi(}WA!``7 z17U4{d%-=scnP!PeEwo0@cXNki_fDwNLl2^R&%BM4;~RSzTj{Wf(M6}xwTfH054n} zKndzt&dSW1Yjnktav(F^6F-Ql^jax6LXt*vx!4VMw%Q(k*y8D8kk1x;2iA;NJHIinEI-;wF&_QUv~vM#~z$*^yae zFSI|OBF5omu3XzjAL4-ml=wUrg!EFWLwpD|x4La(00KevgGwXbOhDyz^5&RQh#d@b z?{aveSzTA{?2YdGH(>;TFt58{s*N4q-9_hhDKFKPNAo-<3Z;(UvVBe_=xvolT+kUy z%agKrG{cXP{YT2k*L6LUxl_SLqKxunc6KG=7tTMoJyJ)h;^+c6x=?PiJi8JI&#?dN zNz4_kb4v%&x*|Od7%*;lIu1k!sub$>@{u0j+AKY4Le-a1t#@DGEOXrs$J!v)L9XC2RaPgv}1X^!&+Z%^2wf z?7W^P5uQ$z%Z;1uKU;+%=D^Twhzj1CiL6=orU0PGIkSH_;uu3xaG4Yq63rArgyDO8 zK{S|HOridB z4M1RQgl=-&camNmLrVNdfRhN?AU%9SrpgepJ69kZN$3w7g<9aPF}Bx^S^Q50hJevH z=#0=r2sC?KgblXa!{^TpAA>-Z(&ieoC+;8FO1~dEJ~dPFyHDM?j1ADq5kiUjV!sq{ zR0LrhmYsCa&*qfV*wU^X^Jk1ZyT7I5tRtk8ma;i5!72N3wp|t{L~BOmO6>`tfwc(Q zDm5(`SzwvQAvvs$LE}Q1kML7yX&|brb@u^?QPK?KN47fYUydi!v2$T4{203tOCTfB z=feorFL3o-rAC}-dIO)F5NE4$v?G)Q%!&=reCLes1@L_gir~!Jo(!BAJe>))4ES1m zja%)pH+wC$=hFly=|*7@>@kq^WCjkz(0|Bg2U#JNrR5AvA?Cpxp-wEJ*P0_xVpGEp zQB@hUF*@F=|C5{`s9-n}6E=I2m6Z)GIChgWq#dA$!7}7roNrP-mc$&7+L|C2%~Y-( zh~{7j{w{`8bU*e!k*RK+L@1;!@KUG?8XNz~)IpT{yZ?v>p&j|5_iJW~W(U7A4%U7!NZ{ramm{No}qHVUu{4O0PCky&-{e}s;44@3) z5Ea32Enr9F2nb1;qRqWlRL)iT=ptWuwp87`@E*@Ra)0EJq-fo9XRT8gSn(}UHYYFD zN7-QS8a~&N`i&NwJW##C8%aGy9qo?@%ucKCE}&H_mY?Pgu1w!HPM>V*yPkT~4l9B0 zZ>axlv3F*xep!BSC+7d#B*&&2e1!McLYHPUaTf6pp|Xgx<7uFkCM7po>-@v27U$Np z7bc?z94BK*Q?EueSB#<8A_os>7>W~ErA`|_pZ5BpA;#KvblN1$C6dP-$=xVYat2lt_t3Dzf<&JP{lTX%+`W^6?i~acPd%Qe z=ES%cPc`uP4xN}k8#K5($&CmN;p~lv#h0&ox%rZ1(0QX$xs9u@HmZ&+H7}d2wrE_O zO3jX`X!rJ(mNhk@yS~}l-q_^Ll#)00=J&jH#QSW&;wB-qHYeRQBJL68c2CfAr62N* z7me`F8#Utxj~p~=6bTP|Rd}*G(BX!5Mfuy_o=?vY8Luyqa~|69#EB@CAJc8AqvokC zMH_XT)}^B!D(X+TN)xu*MvUwU4K*|o_^*Hrtk(nPfHS4#AGg=Xa~Mzoyi@cay~T>B_6MzK5+ zp!<@0;rz6z=dEF(@O~%pdoLah3%rFC&3#KsI(9>V9ij*g;Bg9K>wMag>o>Aqhi)cy#foYmj-Snx3Ny z{ti29=cIBdp?CXt1u1`jJqJqO1nFIYn-OO6wB)LFnpawEcG{0PCw;VOT)u9y(kv4# zxng|qFk!~wu8~ib(bxjfHX~WBX`4@|)1xQltXB-9Y_4Y9E41M)%d_e28}pbO-_P&~ zW%j=`4hau8@v5sAp3DzvKQY(YR9w%Ey5&_EocS^7&V%IB&r|ddCLICOhVI``{Bzh1 zftVPa?H=3|JrC^hy8RpxnQXqEh7+(Ttw@73J(2DlJM%*+z?z=2Q?(B2A-(Xwy0da7 zeJ6~u(=HhOp7&$4+KQnnFCpn2!sp(v8`?kv^j_0v|JE*zS@z9e#kpT6a_5L?qoYX< z8)|POS?G$fgSzo84+^Oy@+jkMR5SjZLaR*O?~}h6J$@H14y~-o+^@d#cz<`t=WZ<@ zGyJ$JkFR5PyIf4*Ua491=`h6W9;36j7_P%Vf4*~fq67swm8*!@aas1h$xv}NMaLv8 z^7+o*dOaOZjTIKONWK0UC;o@GK`}e}fH*6zxmV`)?>zj={G=F*x-Z$zBh}3U_h0Al z|1sZ<;rT%4#fv??YC-@?VAPc2rMkQoK++G4F*??CE`Kpqgx5GbMc|AGMe=hu4)~$e zEeChZpfQ^S+UEDY?nO?`V$M@|fl;-KKjrFwO!~WSX4}}<42H%Xsm{o&ceQ9QjQuHF zoBc7CW_Dv`dPNj^_o5~IbVj-Nw83kMBM}z5S(w`A{K0J5{?P7+xdKfKp+EF%YgU9^`efAe15-bO$YdIn1lG#5b0(7ZUaD+ ztNPBzr$E0AozymrxXZTj-%TGML}!Ep$N}wH$4HaR`rD=`$wdGho?0%j8*=G5xBkb_ zP~g-{I~9Zlp953GhWoNQ_wJ$k9}g|>oTD!rSU$ePYnK7Og|XPm%6PQAv{x1I)3dF5 zo*h2?^6R1~bSl|3P(-My_40MCdn1PC;r%kiq`jA-f(UfxDex`6^p(K7l>Mj{ridww zkrrVZ`Al#(Dsl-XcxquZQ#2Q}wNfF!N6+WMkQI;l!Bbi~hY)ZHq*?YaNh2FE!G9M0_6ohXD19E8Kl7(iOzMJ#Hmb4CU6^F+2m#5hY+8Y@C^ zI5uySO&Y%l`cw7t`CL%({H8jyDe-;TM6~n!7mH0N>gUlS;VbUwh+5XqRQ?+j-$mc7 zK31sAjSKXY0ul6pLZiqKW=4~{#TA+4baDHQ^z4zq^g#)X#drS||0FHi*2nY2^r#tM zj2_5<&kk46+Oy^M%W90`r1%x1%1t2libGfWphF@^X-)MZ>DCZDEmtuMbdAixbFN(Pa8f0RDPq;%TF@#!F#z;vS z1m-JRszIE~ELm^98%TeUoy_+WQ`JTm zs=kTtMMZO;QW#S5)&c1S!{S0SsmrZiLxkVDCHU@HiK`oNXLN#Qyids7@M5gF)y4;t zApPT&rB`mtd~jlD$so?6o8!VktBf>>)|beJxoa;OuR%QJz^tAfuu#||UqYYLFQiT4 z^TU{;Z@8M_OasWcuRSiEKtOKIRn&FaqczgT55Lls<`#wiEGAA5>&#vBPK?+EjeDep zr03wim0akBK{H~3cdzAbTtB0;Z&idSz3uXQk@U^B_*|h?NVIYi7uWrv&O24ji=?m@ zL2r8@QyXcRyc-IT%~sYx~8=R-;fc4;Qh zEKqpmy9Adr8R8VfGzn--vF~@5DHKBSa}F zuRuIyUv7}IrpPHi%2Yv00m0>ScNVi)WaGQp;S_u&HnHfTlfBu{+EHA@p#F~2tP&#f zZh7m|>yMrMN@AidiHuM5l~1rno;}+~rg&Fbk9r z8eM3z8nWrS+g6LQ{WDTfAD=J4#h;{iSuXrx6Ps z6XiNMA9JaWpY=eldEQ`4&cvaRU#+juMwr|9R8)jue&lOF#nm*7z!AQ>#7F#DJ2c%?4LXOVP1G-!qvzd}AATUa}g&EOm5>c?O%+~+K5n$sIQChfp!9h9vAtz#pvrD@H6Ex)T}ul zI1NBf&)5ICmyQQhA!!AK$|l**#pKlWQk}nv$0B3Tczhg33k-*939D=^)5JbRJ}xkuW{Kw}3`tn%^Bn7>Nq?j5_ zrd^_&L1qlR3ob~AN(R{u0Sueo0N=7V9IUCHjV`%s6IQ4*x2=^+y(o`UX=wy{4<1*Y z!H}w+ke6OLrTX~2%4l8)zAro5TKR4a>;0?P!>Z-xT1X78yVEt@)#O9W@$I*j`C-2H=7}KLejb#o#$&WoBTc}Ab9}}r4 zdTbGV^~0q&Np(EN1bls9ohwkAs{E?;M$e^}Wtx#~T_T$o1vnU*j4>+sI!b_WfELX2 zD{}9L!=VTGnSI8)+>Hq;)f4Dj2;xG}R_snVXCwA3O4gEa zMy~;QS=k3Aa}8EXaz`Rf42Qt5tD{e&ylh@lzt?Q?>WKVUT`G@n2h;PFh&r+_>C%}a ziJm3*6d_RpFX`mZvPdxj+aW#Hgv`x(fFHa0ldmXNFGS!671Xr$?R>@LK+WvV&k`G* z4H$H4>hiSEx7k0Ay8hRZ@G~8R-ozsRnA-~y&>jC771@tB$|4Wj1bnXrfpY~Fss_of zW*^^l7lG~igk&ld!I~1bCv-&wEj**JzrqRDZI+^_x@hEtp*5x`>k~WD}s=<{2Rgy&QTE_AXITJZx(XA87^ZEz^<`oa75HE@||lA6^W)d8VnV2=AyIa;R6yb*9kOJUsmvMZni{Xxrs?7vN?Xnp0m$p-7v6 zeWu+Y(2Wr#4oz#_)!dX_xKPkg=GyR4B2^J&kFy$@+4-ZA>$xUL`Ot9h{kN6esgwbK zduF_x^fUZzqx@MZ3OnyO`@%P`p(;XUij=L%5WDKy^7(9B=ovmRb->XRm$3Dy9{G|k z^DHq%*7c#c&?5^EcWrYI{2w#c-YFBLqr1ZNplyN>en$&VHGifQFJrg#ac*#byKJu` z3wO$(VJsh}gy=}#{b=$$jZ=XgF)tgn3GfQR>NMlEN^07W(9qo2h_5EXEQh7MH2}khLJoydlRWSxU`-ykOcG!s`!Ln zd^U6G-PgVk;*4FXv6PTrzkweyk)AvU=~#4@56W3Oe`xUrL<0ROb66CrdYzymCj6k4 z*9Si20<0Y>P|W-DTjA8|;j4;JOP2>m4}V5`G&u;(YnwM-iZdK3P_V}Gs;DYk@YP*z z*DwZ#XyosR2`D zBJ#*Fy5YjLl*fNy&9C|)M$a6=MQ%Rg?=Ot2?c(_Yb#7OF&~o)%^X=F7!v=yMEcx8) z_e_W}TKbs8cjZ#fSp@H36QJarncd&hFl-Mk6$itZ?^aKpuQJ9ko8lUVND|@Celmw= zr9{U$o zKaEdM->t{jMSCtrDab$35klrm2?h=~Yt9Qm?~B8~u-AsXsRBAwI&jdOPpMpI{gjzr{%|fKigw#O-Bx)y=wU<@ z!=R0o2Kvigqe&#aZ-ox>qLbPw*KxS*eJ`&SZesU!8)lCRinXi3s5SfjtEL(N4IKp% z{i3k}ndRSmtd;@n2t|}54}5(-W+~nWD0Tf)E&uOLb=|dT-#|b8rKrO0r-|$2mW%5U zd*5=1{QAcesks9Z90K%`G%lH%;CE zx#?`f(5q|JVra4>;kHz9P%jI)^_X`h8~OWJteBGDNBg@lw6`IW$YXm%H8hjoDQK8Y zWj$DKJ8?T`#tO?T6>^@93`qg(KanyIuORhOnd-Vpe}okw!g6gVqZc92=kWyta_HtjmPR^L8t(U(ZS>iy zqG1)4v*&z>AiI=5u@-&p>G8L5h0k>g1$17zBqt{;gFg=xi zZYoIMV8iXEH|DYi(e41sK#dAB_4Zle*6Cjid!>(_grUdGPo!pkY?ZqJp$rVy1Q))A zBEEAXX4Pai2L=sa&^=tOq#zti34#%S)X>NJNA{3J>69~9_G$IKOS(<+DOj7l$m>h!2plv3(h7-CgY{9gN&2jq)L zsSRXWOi=ZUos2n85cr|Mc)TLdUdXds4p{tcl)Ax(+gRmpW@>3BITMSIu$o&*43Bl# zS~aY`DdOtb5{o=i{afT^XiLQtYp?0m*H&1?M|oS~7(aWbLrk{xjOARNsg4MJJ?6)| znZWX9~%I(e+I0`UwC;CTh4b-o!-Bo;!dG9+NP1XZ&Xw4}v6)e)Z$b zz~Myv8n!15l1KTv7FuI9vJ9rIDBlj|c-RAo-UcCVvKNjj2Z$mjxA>?tN|^HN%fL!K z@q6$Fp%1xD4~T-|gvaqB_5tM(h5nDm@L|FDd(O_fIrpXc@jn$GmB{3iS2wHo{&ZJ^ zWuh-9mC2yGDUp7G)Tcu{CyvFOy?`NI%OGc}4wHG%O8-cn0Vq9Oh9qEhpKH3;;zN5>h9@&12p!b@@(#9D$mddtY0pE@c+$#j4yQ zIa-wq)BLj73s1lPd<%omg2s&&-#Upr&7TOfH>onVd4bg$=U#qNxmCVW57b=IpV}Q> z_p@Bw+nu+RI!~ujppkeyR(WQ(1i&-z!IPn9=~*-WG?O%j?yHabK)}Rz(HZ=3Hd3@ZWSRY6!4V6SJiql~YU)PQz=gwba#T%T!_sR?mPJ3#V z!JD5P>Fma);uh0HsI!@D--2!?@cSsxcUI9dZ3oIvWE&e~gKjP*Bq<#k=-drF&MO6G z)5HH}jJar}6;s~Bw0()eK8^%J)W94_LKx$Wf>f4FsI$-&Gm5B7{hODw>{$clv_;>b{8 zZbZj2=&4B*$k!u(81naAhqg9uSM{hQV)^yBk)60)vdUE}=j+MSS4zDjtjfQWLdF4%xC~|Z`8ghHPrkv2s1~hgILlY};~_7tCN%HahFCi3CRdtgY32xsNQB%6 z!;cpSu^o7&G}wCf?@&14yWyaOE^cW1oY>u;Z8wiMQmK~5-45OQYIxm@V>L^u9P}Sd zX^hu9(=^H_C$nbi@drp#g_~<@WaQuOF z3(s#k01+B2`T;Y*QNwEhgBZ{I-O6HbfEwtFkPyo3R{HgJTFw zLeQJRAa|2EHJ=Uy(jVIri@|`L&i@t0teqf6qQ@QIgY^6a5ARLf+NQ_s zPhWbG!K$pj_BKq8B{^AoaC1gNLwM}?CBOGDDgy+~RY2TbOips+f1$ltU;n^$Mqq<=H9;8*fi27 zblUPaNnc+jEcQ_>rzwf+CIEpdE}bIpw*VPkt>iE+wLed-aZpZa25edbXkgh8huiw4 z^$Fc!i%F4~@}&o)_iL5_1en$NucK4PF!y7d2d(DXJ_Unv$uRV^@teyQEV(geeDG5t z{3BjAu~cj7U|zcbwn>2q;@)`SLhH0?K3c0tB>OJ0Flo%v6AXPYBc&j&@46Mc=&gHC zFqk0#y@L0(L>5mV)C=8Y&)9;Xn-p|6&WM71xcjxHdgs~? zA}xiy*DrNaQnII=e7yCFhu6=(G3sh&WWrweK>(CnK*L}o0c%#xNC%@oQ&V_3Cwb-@ z+b)73Zg@NSo7CjCAAKcj=Iv7(*pLb_AZ{c2sR!SSU|jXX_q+r>q!du<^ri4Czuu;3 z6a3}o_CIETY#LdXIJ0|R|K`QIsuKE*?k}Y1GtKee)(P!=8&=9p+@Zu9KG2`-Al zHEIfkB9B7<+8vW84qZ1x0rBkgz8OH8w;KBM#MUyPhMo%kJ0|T2l=(A7KocsJxup=_jPJg>^kw14R@(v)E~$%h zvsDv^yUjP0&xy7E+BE^_>cIAU`E{(ilU1X5>JF>U!7YKm;QqNYhi<`l7sH+=oH;ag;^RhFU~6v0 zsBMRk%2h{#_4`5lt4Boi`K58n<${Rn_?^gtR9@*q2v|GJCFX?UR;9P6C|lap%GLez zm?{s{8(*2u+_2;px>eqJ+~Piuw*O0Iv0FbcAB&_*%hb0E0dU&ckXyfY`8>eZUF%JR zPb_){(`)jSQq5RbMgl>FJ3?gTqi{$6F$4l4lL8{Jt@?Cy2w6z1F$JE^*l+!+ZNaX@k)B)k&(T5`Nm2RnmK;H(W^5Kn7ue$vagm?kp z+NI^@Lm$>#_wn@FUgj}F{xdOZ+_}3J_pRCkPU)hpX|v|8f>090ZT<9J!vI2|C`evK~YmemnBU_#7rlhHF^(QVa&^40=f^kL`)E}=T8sP&QMhgS8M z_X;s-erZ4bu};d!5$DXD+ zd!=&p=0z@9PjR}mYH2mV>del>KH&=(Uvy-^!)mTCvNL{j{=_SKFuP!I0G_T#9yTYM;g9lWF7KoS07WNk>?dmu4OmFm}z#_~HF zF^0IvCeapact6*zi`Tn(Met&N%Eh|_Mj#H~^2H_|A%s+>2i_4(v6DcJT~fU{u?f@` z;Kyt1ngP?YfR^IoUIQy809XbOnpOKv43MsC{DKg)a-%_8JMOq3<-t9~k3OacK`&&x zxh8UF-0AD>HBk^w5Opt=x#YK#A9BaST$Zrik1Bfo6sT>=kJp}_Y?;$au1ZM*nr0ak zFLz!Jsk0bZyBb&uQ1O3xfN4^mY%JM^A&~f*-`=uEqBhA zi!r--^neHkr@vT#c~&K-*6(lZ%&nkr%H>ASE^}2P>pFc|bQ|VgYF$l{G$LeQ(6-#4 zJNMbwOz1VX5x{_u9c{(IIjOForjYxo>wtIw=i>OrH!#S{7UkI)+ z8cZbJk4k6lX)D`q0dN}W5FUK`nUYn(q*%A{5;CHuw&G=_qbI#Fwgps0fC2C9SF6=FQjvNMH7<4x#g?uEsDVz@Zr%l zGy#8q4P}mP+G+eZOXU+;FS_udg zqCB<7EOtk*&Fmj<7`m6;<+x;@mw09N)umKoNMQtRg=f|4HQ9dtm1*tTSBl}NQQg29 zjHm?8zelND48aiaMN?gGFnX>o2Kv>OR?qeEN}_aJe$vbMq>9_mY_2?NkvK}d50ui^ zl-9Ww+Q}Kf%~##Rp6qy>Dg!q~Ph+-;Ls!XIOq%U4QCP)h0+*D|s~zeP56PZYBqGBT z+$Ka!&yC6@dxyC1G*UsF7pQ*o?Y!_NrKo5=OI(+8ns}E;q40h3+TbpK^69%mM;0yr z0%=zpW6!7ai^h;aKqJy0-j_L2x$wveeruqRyC%Xlt4{wo8H-KxQ+7)sGo>)u4Iz@9 z8CP>o`Zg#AY<9j-n?6potdN#beH$eQ;8&1HWo6wFJBzVV;wA&}?@lZrl@pMP;TD_n_d-Y~fmjRa9HaOuIJlC{v@5liR;s(@ak(z38$gd3Lx;~h4yn9f`+h!$mL+?w_4J)%AhnJxK$^&j zoGzM<_pw7$zQ@TGV$$DPmDHj4e*PhaIVnR6r0enk#3I;WcWuf*rdYS~eFi3^_SN7T`5sb7_AQBQpiq}eFw zfKrCqZmcVnFIbcK*_Be>e}I~Yds5X?qY5Vz5+urrhR8CVU~3PFGYw@{V7NjBDo~k6 zHXl~AfG~W^XJq4cEaZ(QYoAp^FJUSO%D;Ysm00FD;8J z$9;QP3)3p`N7GzSF@n{(b=#v|74ve;Jicw+{uP=5KI)pPByKdQ@LSBU2aA^ySE`Zj z&OqyJ-w?nidvRKQsIr;Cp+A3dmZ zj}K&~$^Y9xs)t^CXcn27k|C>82*g5B8ro6f%E>~-iU1hHO+Zpuyu>HRNgphbw|JMw z-5P)~7L`o8bCs}Pq*7Bsu)%d|_C|I=$w3d~@upv|3Q9g{^Z-ab4qrlzyay-dXQEDf zR02qy`urco1BBQFVh{Gf!+XFC9ZyFg@_1L7uq+XKAV+YdlaPqH3YShy>{;gTimZab z)uE7?uD~pMpECa|nB|wo#SAoR>0K+?#}tH;m$Isi@5&WW^mHVVSADmmTM3*Z?mnaa(vbcK# z&dsL}mX>(Mw)f&AcG<#?!qpy5&50atoZ-P4qOMO}iNl6jw8Y&_o>jz~O5Jpabe1Vd zouLkSj@>XV-0V)}lUgFulrOOd`8gA!QNs%UFs932)OU?T*{iXJPoLYT0RmS`0?Iz! zIqJCvEN9v*+}`FAHx)0p($YCO(r9#Zxzm@nMz@0MyaS{ua(fL690)PpAGOIaQZjO_ z<<0f>q+1NtVJErA9(juURljQS9m>q5b!xb#wyqcVK{%%{!V0Qcvhq^pL|3}3s)jY^ z3~u6dQ16>V4ny^hLcZ=G}0n9v-)k@Te}RRB;~xF~oAoQj+H* zYJnsK-g8wgkD`ha=QN7s1y5OVc#GgpVXjgkqfF$scLbo^-&VQy-8!ol8=xS6ir9C8 z>}LIQCRI>cRSD|YtAQ!G9Bbdxb9eq0#+oczsNAi2mguVVR^z})UY0lCrT9h-fPg$2K5lB9Xe_ZQVD*9A#=UU6;^Oa;+y>Pi~5%O^q zlziFl-Q5s>m}cgS1DJAd1swsG^n8$&otQFL4FFNadbt1Yu7;nDhHula+M3roEr`Z7 zmk)+b)Lv``_?2t7fNRaifx5wyu+zQ~$a0?CeFS7v>*`E&J&epaGYNNl^ajboF6NZ#JA()+I)(47R8jt_I&6)8>Gmev=aV6S% z5XLx0;>PcSq;-l-$i@PU{kH1mb08(p!ean(^TufX)vC55|7Qu2NzSsgl$3tyULfck z(JO`w;9MDrCT9Mh6;+EDta$;lT*!8%J2&|-YRNS5`Ts9VC(9_@wN*!O?(7dxB#Kb*Gre|`Ik3)O-2LROMw(EUoWw#(13ll^E446gaot*6?^Z@3+johw`%@Q>e$0O3lZ${ z^OOT*Ct}A8fL~6UpX>CKohXUOU6+IhAHUCsREkzNdj$VZ#>k$oXrFME{4u$H?4dF$=j{I9)!HGT^d`<( zjN{APDgZVS>k;lPr4sTN9CDjTZs-o?g4(||M{VS>>|XEu)aDYsbP;cQ@0znXNB#?F`qREn0!Ak+UW6&hxz)pCY!3#hM5bNm@r#i z&6G>QjRp`tdr^Uie~4_D3li`rr+)4J=23fP&;oPOjxBwd2iKM{%!|n9K?omnU=w&Kt-L7z;_gLGlw6cyD$StHkRS`hwbA}5#cb`y zZ`UV!pCk0I@FFr(YBR|V{r^*yBFKIio}RW+-fL~moEN7`8}i`JEaFp0Di8G0d0`QJ zYz+jUeEQwXfAsyP5A7(75^css;NHbVlFA|!{pt`VU?dukho;oNRx55g&hf^Hu47Nz zzvV`3AG5KKEo}(EwK4t^oFX`G(T6TS@)$iv2ssI*xth3gSo@I4TytdG6>o~b=Rlp6 zh7o0)NPog)9v$)zc&CiVmre&cnosrH|3fg()_4P^gf^=#@}s{(iL_@qfzG1;GM>Q< zkQ79kuC#lf4KbZY8~pOV>6jO`AkGP7QO_W!hfQcpr~JJ~(+{rOe76YXm^vMH*yKs$ z0lXs@e1J$ZxERIp`c77+To9xDgbb~cl|CIZEg~I!SBx7WpQ`e-kNMYXZ0tn!xjHRt zocvh>4o!cjV!t*JNtsCd(Bzn8^Pt+mkoQ6SqR{;ngOk1OyCh|RzR{K3+AAHrcraRJ zF(xEr!oR#nvUc5Y%C~_R_hE8TgkbmfQjI?O$sW*Px-8(a5K z=uL8cZL7APfzK22fWM7)_4UJm7d2Kd8d7a8ZGZiwp~t1R%os+psTH}t0b*lg{ldhV z9mB=C*aBYn(VNHr30|iuw~dZX>u4k9l%B-oDsq;RuTm^SB6sNv>A8OnzZ^3>$XQ$E zwUyVZ78Jh|Nqfcv;n3!#Y@`Ovd#TDfQT2FN+!yt+f&-@tE?Y2wG{}8YB`X=68 tag', -> webview.src = "file://#{fixtures}/pages/referrer.html" document.body.appendChild webview + describe 'disablewebsecurity attribute', -> + it 'does not disable web security when not set', (done) -> + src = " + + + " + encoded = btoa(unescape(encodeURIComponent(src))) + listener = (e) -> + assert /Not allowed to load local resource/.test(e.message) + webview.removeEventListener 'console-message', listener + done() + webview.addEventListener 'console-message', listener + webview.src = "data:text/html;base64,#{encoded}" + document.body.appendChild webview + + it 'disables web security when set', (done) -> + src = " + + + " + encoded = btoa(unescape(encodeURIComponent(src))) + listener = (e) -> + assert.equal e.message, 'ok' + webview.removeEventListener 'console-message', listener + done() + webview.addEventListener 'console-message', listener + webview.setAttribute 'disablewebsecurity', '' + webview.src = "data:text/html;base64,#{encoded}" + document.body.appendChild webview + describe 'new-window event', -> it 'emits when window.open is called', (done) -> webview.addEventListener 'new-window', (e) -> From a26091e485a18014a14781dbcc9ea1302ce7f66c Mon Sep 17 00:00:00 2001 From: Cheng Zhao Date: Wed, 17 Dec 2014 20:33:47 -0800 Subject: [PATCH 4/6] Suppress EventEmitter warnings --- atom/browser/lib/guest-view-manager.coffee | 1 + 1 file changed, 1 insertion(+) diff --git a/atom/browser/lib/guest-view-manager.coffee b/atom/browser/lib/guest-view-manager.coffee index 51e7bdf91d..e8d2945151 100644 --- a/atom/browser/lib/guest-view-manager.coffee +++ b/atom/browser/lib/guest-view-manager.coffee @@ -41,6 +41,7 @@ createGuest = (embedder, params) -> destroy = -> destroyGuest id if guestInstances[id]? embedder.removeListener event, destroy for event in destroyEvents + embedder.setMaxListeners 100 # we can have lots of in one page. embedder.once event, destroy for event in destroyEvents # Init guest web view after attached. From da54ac5f5552e492b5f0bc90fa3ca063a71b9c9a Mon Sep 17 00:00:00 2001 From: Cheng Zhao Date: Wed, 17 Dec 2014 20:44:15 -0800 Subject: [PATCH 5/6] Don't leak listeners in embedder when guest is destroyed --- atom/browser/api/atom_api_web_contents.cc | 3 +++ atom/browser/lib/guest-view-manager.coffee | 4 ++-- atom/renderer/lib/web-view/web-view.coffee | 1 - 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/atom/browser/api/atom_api_web_contents.cc b/atom/browser/api/atom_api_web_contents.cc index 10f91c47bc..ed16262406 100644 --- a/atom/browser/api/atom_api_web_contents.cc +++ b/atom/browser/api/atom_api_web_contents.cc @@ -274,6 +274,9 @@ void WebContents::Destroy() { if (!destruction_callback_.is_null()) destruction_callback_.Run(); + // When force destroying the "destroyed" event is not emitted. + WebContentsDestroyed(); + Observe(nullptr); storage_.reset(); } diff --git a/atom/browser/lib/guest-view-manager.coffee b/atom/browser/lib/guest-view-manager.coffee index e8d2945151..00085ade3d 100644 --- a/atom/browser/lib/guest-view-manager.coffee +++ b/atom/browser/lib/guest-view-manager.coffee @@ -40,9 +40,9 @@ createGuest = (embedder, params) -> destroyEvents = ['destroyed', 'crashed', 'did-navigate-to-different-page'] destroy = -> destroyGuest id if guestInstances[id]? - embedder.removeListener event, destroy for event in destroyEvents - embedder.setMaxListeners 100 # we can have lots of in one page. embedder.once event, destroy for event in destroyEvents + guest.once 'destroyed', -> + embedder.removeListener event, destroy for event in destroyEvents # Init guest web view after attached. guest.once 'did-attach', -> diff --git a/atom/renderer/lib/web-view/web-view.coffee b/atom/renderer/lib/web-view/web-view.coffee index e095c0b74d..9a1f59ed5b 100644 --- a/atom/renderer/lib/web-view/web-view.coffee +++ b/atom/renderer/lib/web-view/web-view.coffee @@ -50,7 +50,6 @@ class WebViewImpl # heard back from createGuest yet. We will not reset the flag in this case so # that we don't end up allocating a second guest. if @guestInstanceId - # FIXME guestViewInternal.destroyGuest @guestInstanceId @guestInstanceId = undefined @beforeFirstNavigation = true From 423d26918791fe2c0f20db81c46909189ac7d4cc Mon Sep 17 00:00:00 2001 From: Cheng Zhao Date: Wed, 17 Dec 2014 21:34:02 -0800 Subject: [PATCH 6/6] docs: "disablewebsecurity" attribute --- docs/api/web-view-tag.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/docs/api/web-view-tag.md b/docs/api/web-view-tag.md index bde67ed960..db56743556 100644 --- a/docs/api/web-view-tag.md +++ b/docs/api/web-view-tag.md @@ -112,6 +112,14 @@ after this script has done execution. Sets the referrer URL for the guest page. +### disablewebsecurity + +```html + +``` + +If "on", the guest page will have web security disabled. + ## Methods ### ``.getUrl()