Codex/upstream pr audit 20260827 - #13
Merged
Merged
Conversation
Port the dependency updates from upstream PR pichillilorenzo#2869 (6ac9d7f) without the redundant coroutine definition or /FS flag.
Reimplement upstream PR pichillilorenzo#2876 without hand-editing generated files. Add persistent storage kind 13 and a Windows-only fallback for future native permission values.
Port upstream PR pichillilorenzo#2768 and add regression coverage for all three internal WebView host HWNDs.
Reimplement upstream PR pichillilorenzo#2874 without exposing public Pictures or Movies directories. Add capture-directory failure handling and regression coverage.
Take only the proven syntax fix from upstream PR pichillilorenzo#2871. Avoid its unverified content-world, popup, and message-handler routing changes.
…ormance to 10.15+ Xcode 26 rejects the @available(macOS 10.15, *) witness on a type that conforms to ASWebAuthenticationPresentationContextProviding (available from 10.14) unconditionally: error: protocol 'ASWebAuthenticationPresentationContextProviding' requires 'presentationAnchor(for:)' to be available in macOS 10.14 and newer Move the conformance into a @available(macOS 10.15, *) extension so the witness is available everywhere the conformance is, matching the availability of ASWebAuthenticationSession itself. Verified with swiftc -typecheck at -target x86_64-apple-macos10.14/10.15 on Xcode 26.4.
- add disableVerticalScroll and disableHorizontalScroll flags to InAppWebViewSettings to track user preferences - implement SetScrollDelta logic in in_app_webview.cc to drop wheel/trackpad deltas for disabled axes - serialize and deserialize new scroll settings through FlValue to keep them in sync with Flutter
`PRINT_JS_SOURCE()` ends with `window.print = function() {...}` without a
trailing semicolon. Since these plugin sources are concatenated in front of
user-provided source in
`WKUserContentController.generateCodeForScriptEvaluation` (joined with `\n`
only), and a line break does not trigger ASI when the next token can continue
the expression, any evaluated source that starts with `(` gets parsed as a
call on the assigned function:
window.print = function() {...}(function () { ... })();
This immediately invokes the print handler (showing the native print UI) and
then throws `TypeError: ... is not a function`, so `evaluateJavascript`
resolves to `null` instead of the script's value.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Adapt upstream PR pichillilorenzo#2860 to restore only after keyboardDidHide. A generation guard prevents a stale hide notification from overwriting a rapid keyboard re-show.
Adapt upstream PR pichillilorenzo#2776 by bypassing content-world bootstrap for popup WebViews on iOS 14-17. Keep callAsyncJavaScript unchanged because its native content-world overload remains unsafe.
Reimplement upstream PR pichillilorenzo#2767 for the current Sources layout and protect the getter, initial setter, and runtime setter on affected macOS 11.x WebKit runtimes.
- Replace `new Long(String)` with `Long.parseLong(String)` in MyCookieManager.
- Replace `new Handler()` with `new Handler(Looper.getMainLooper())` in InAppWebView.
- Route previously-ungated `CookieManager.removeSessionCookie()` calls through a new `clearSessionCookies()` helper that uses `removeSessionCookies(null)` on API 21+ and falls back to the deprecated call only on pre-LOLLIPOP.
- Annotate methods that retain pre-LOLLIPOP `CookieSyncManager` / `CookieManager.removeAllCookie` / `removeSessionCookie` fallbacks with `@SuppressWarnings("deprecation")` to silence javac warnings without changing behavior on minSdk 19/20.
Refs pichillilorenzo#2641
…x Play Store warning
…e WebView background
…gement - Introduced `PreferredColorScheme` enum with values LIGHT, DARK, and AUTO. - Added `preferredColorScheme` property to `InAppWebViewSettings` for Windows platform. - Implemented logic to set and retrieve the preferred color scheme using WebView2's ICoreWebView2Profile API. - Updated CHANGELOG and documentation to reflect the new feature.
…ng `disposeChannel()` in debug mode
A malicious file picker (a third-party app handling the implicit file chooser intent) can return a file:// URI pointing into the host app's own private data directory. The host can read that file (the picker itself cannot), so its contents are handed to the web page. This follows the Android platform guidance in WebChromeClient.FileChooserParams to check the returned URIs in parseResult before invoking filePathCallback. - Only file:// URIs are rejected; legitimate content:// picks and the app's own FileProvider camera captures are unaffected. - Primary anchor is the app's dataDir, with /data/ as defense-in-depth. - getCanonicalPath() collapses ../ traversal. - Covers single-file (parseResult), multi-file (ClipData), and legacy single-URI paths. Refs CVE-2020-6563
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
15 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Connection with issue(s)
Resolve issue #???
Connected to #???
Testing and Review Notes
Screenshots or Videos
To Do