Skip to content

[HybridWebView] Filter Android message events by source #35717

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
PureWeen merged 2 commits into from
Jun 5, 2026
Merged

[HybridWebView] Filter Android message events by source #35717

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
78c82d0
[HybridWebView] Filter Android `message` events by origin and source
jonathanpeppers Jun 2, 2026
b81b864
[HybridWebView] Drop origin equality check on Android
jonathanpeppers Jun 3, 2026
File filter

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions src/Core/src/Handlers/HybridWebView/HybridWebView.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,18 @@
}
else {
// Android WebView
// Native -> JS messages are delivered via WebView.postWebMessage. The resulting
// MessageEvent has source === null (no sending window) -- that's the invariant we
// can rely on across WebView versions. Drop any 'message' event whose source is
// a Window (e.g. a nested iframe calling window.parent.postMessage), which would
// otherwise be mistaken for a native message. NOTE: we intentionally do not check
// arg.origin here because Android WebView delivers postWebMessage events with an
// empty-string origin, not window.location.origin.
window.addEventListener('message', (arg) => {
if (arg.source !== null) {
console.warn(`HybridWebView: ignored 'message' event from unexpected sender (origin: '${arg.origin}').`);
return;
}
dispatchHybridWebViewMessage(arg.data);
});
}
Expand Down
13 changes: 12 additions & 1 deletion src/Core/src/Handlers/HybridWebView/HybridWebView.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,7 +87,18 @@ interface DotNetInvokeResult {
};
} else {
// Android WebView
window.addEventListener('message', (arg: any) => {
// Native -> JS messages are delivered via WebView.postWebMessage. The resulting
// MessageEvent has source === null (no sending window) -- that's the invariant we
// can rely on across WebView versions. Drop any 'message' event whose source is
// a Window (e.g. a nested iframe calling window.parent.postMessage), which would
// otherwise be mistaken for a native message. NOTE: we intentionally do not check
// arg.origin here because Android WebView delivers postWebMessage events with an
// empty-string origin, not window.location.origin.
window.addEventListener('message', (arg: MessageEvent) => {
if (arg.source !== null) {

@MauiBot MauiBot Jun 5, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[major] Regression Prevention — This Android-only guard is the key behavior that prevents iframe/window postMessage traffic from being raised as HybridWebViewMessageReceived, but the PR has no regression test covering that rejection path. Existing native SendRawMessage coverage would still pass if this guard were removed; please add an Android HybridWebView test that posts from a nested iframe/window and asserts the event is not dispatched while native SendRawMessage still is.
console.warn(`HybridWebView: ignored 'message' event from unexpected sender (origin: '${arg.origin}').`);
return;
}
dispatchHybridWebViewMessage(arg.data);
});
}
Expand Down
Loading