Files
iOS/Sources/App/Frontend/WebView/WebViewController+WebViewSetup.swift
Bruno Pantaleão Gonçalves c8f35e4cff Prevent execution of WKUserScript from beyond main frame and allowed hosts (#4469)
<!-- Thank you for submitting a Pull Request and helping to improve Home
Assistant. Please complete the following sections to help the processing
and review of your changes. Please do not delete anything from this
template. -->

## Summary
<!-- Provide a brief summary of the changes you have made and most
importantly what they aim to achieve -->

## Screenshots
<!-- If this is a user-facing change not in the frontend, please include
screenshots in light and dark mode. -->

## Link to pull request in Documentation repository
<!-- Pull requests that add, change or remove functionality must have a
corresponding pull request in the Companion App Documentation repository
(https://github.com/home-assistant/companion.home-assistant). Please add
the number of this pull request after the "#" -->
Documentation: home-assistant/companion.home-assistant#

## Any other notes
<!-- If there is any other information of note, like if this Pull
Request is part of a bigger change, please include it here. -->
2026-04-02 13:52:29 +02:00

64 lines
3.0 KiB
Swift

import Shared
import UIKit
@preconcurrency import WebKit
// MARK: - Web View Configuration & Setup
extension WebViewController {
func setupUserContentController() -> WKUserContentController {
let userContentController = WKUserContentController()
let safeScriptMessageHandler = SafeScriptMessageHandler(server: server, delegate: webViewScriptMessageHandler)
userContentController.add(safeScriptMessageHandler, name: "getExternalAuth")
userContentController.add(safeScriptMessageHandler, name: "revokeExternalAuth")
userContentController.add(safeScriptMessageHandler, name: "externalBus")
userContentController.add(safeScriptMessageHandler, name: "updateThemeColors")
userContentController.add(safeScriptMessageHandler, name: "logError")
return userContentController
}
func setupWebViewConstraints(statusBarView: UIView) {
webView.translatesAutoresizingMaskIntoConstraints = false
webView.leftAnchor.constraint(equalTo: view.leftAnchor).isActive = true
webView.rightAnchor.constraint(equalTo: view.rightAnchor).isActive = true
webView.bottomAnchor.constraint(equalTo: view.bottomAnchor).isActive = true
webView.autoresizingMask = [.flexibleWidth, .flexibleHeight]
// Create the top constraint based on edge-to-edge setting
// On iOS (not Catalyst), edge-to-edge mode pins the webview to the top of the view
// On Catalyst, we always show the status bar buttons, so we pin to statusBarView
// Also use edge-to-edge behavior when fullScreen is enabled (status bar hidden)
let edgeToEdge = (Current.settingsStore.edgeToEdge || Current.settingsStore.fullScreen) && !Current.isCatalyst
if edgeToEdge {
webViewTopConstraint = webView.topAnchor.constraint(equalTo: view.topAnchor)
statusBarView.isHidden = true
} else {
webViewTopConstraint = webView.topAnchor.constraint(equalTo: statusBarView.bottomAnchor)
statusBarView.isHidden = false
}
webViewTopConstraint?.isActive = true
}
func setupURLObserver() {
urlObserver = webView.observe(\.url) { [weak self] webView, _ in
guard let self else { return }
guard let currentURL = webView.url?.absoluteString.replacingOccurrences(of: "?external_auth=1", with: ""),
let cleanURL = URL(string: currentURL), let scheme = cleanURL.scheme else {
return
}
guard ["http", "https"].contains(scheme) else {
Current.Log.warning("Was going to provide invalid URL to NSUserActivity! \(currentURL)")
return
}
userActivity?.webpageURL = cleanURL
userActivity?.userInfo = [
RestorableStateKey.lastURL.rawValue: cleanURL,
RestorableStateKey.server.rawValue: server.identifier.rawValue,
]
userActivity?.becomeCurrent()
}
}
}