Browse Source

fix: <webview> not working with Trusted Types (#27467)

Co-authored-by: Milan Burda <[email protected]>
trop[bot] 4 years ago
parent
commit
e49a88ba53

+ 3 - 1
lib/renderer/web-view/web-view-impl.ts

@@ -44,7 +44,9 @@ export class WebViewImpl {
     // Create internal iframe element.
     this.internalElement = this.createInternalElement();
     const shadowRoot = this.webviewNode.attachShadow({ mode: 'open' });
-    shadowRoot.innerHTML = '<!DOCTYPE html><style type="text/css">:host { display: flex; }</style>';
+    const style = shadowRoot.ownerDocument.createElement('style');
+    style.textContent = ':host { display: flex; }';
+    shadowRoot.appendChild(style);
     this.setupWebViewAttributes();
     this.viewInstanceId = getNextId();
     shadowRoot.appendChild(this.internalElement);

+ 11 - 3
spec-main/webview-spec.ts

@@ -63,7 +63,6 @@ describe('<webview> tag', function () {
       show: false,
       webPreferences: {
         webviewTag: true,
-        nodeIntegration: true,
         sandbox: true
       }
     });
@@ -76,7 +75,6 @@ describe('<webview> tag', function () {
       show: false,
       webPreferences: {
         webviewTag: true,
-        nodeIntegration: true,
         contextIsolation: true
       }
     });
@@ -89,7 +87,6 @@ describe('<webview> tag', function () {
       show: false,
       webPreferences: {
         webviewTag: true,
-        nodeIntegration: true,
         contextIsolation: true,
         sandbox: true
       }
@@ -98,6 +95,17 @@ describe('<webview> tag', function () {
     await emittedOnce(ipcMain, 'pong');
   });
 
+  it('works with Trusted Types', async () => {
+    const w = new BrowserWindow({
+      show: false,
+      webPreferences: {
+        webviewTag: true
+      }
+    });
+    w.loadFile(path.join(fixtures, 'pages', 'webview-trusted-types.html'));
+    await emittedOnce(ipcMain, 'pong');
+  });
+
   it('is disabled by default', async () => {
     const w = new BrowserWindow({
       show: false,

+ 8 - 0
spec/fixtures/pages/webview-trusted-types.html

@@ -0,0 +1,8 @@
+<html>
+<head>
+<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script'; trusted-types *">
+</head>
+<body>
+<webview preload="../module/isolated-ping.js" src="about:blank"/>
+</body>
+</html>