Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 869eb5505b526c284d74ba427c400061315fb2c2
https://github.com/WebKit/WebKit/commit/869eb5505b526c284d74ba427c400061315fb2c2
Author: Ben Nham <[email protected]>
Date: 2026-06-25 (Thu, 25 Jun 2026)
Changed paths:
M Source/WebCore/bindings/js/DOMWrapperWorld.h
M Source/WebCore/page/WebKitNamespace.idl
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/UserContentController.mm
Log Message:
-----------
Only expose evaluateScript in non-normal worlds
https://bugs.webkit.org/show_bug.cgi?id=317774
rdar://180545219
Reviewed by Per Arne Vollan.
`window.webkit.evaluateScript` is exposed to the normal world if the user
registers a message
handler or WKJSBuffer in the normal world. This isn't intended; regular
webpages can just call
`eval` instead. `evaluateScript` just gives the ability to customize the source
URL of the script
for Web Inspector, which isn't something intended to be exposed to regular
webpages.
Test: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/UserContentController.mm
* Source/WebCore/bindings/js/DOMWrapperWorld.h:
(WebCore::DOMWrapperWorld::isNonNormal const):
* Source/WebCore/page/WebKitNamespace.idl:
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/UserContentController.mm:
(TEST(WKUserContentController, MessageHandlerInjectsWebKitNamespace)):
(TEST(WKUserContentController, JSBufferInjectsWebKitNamespace)):
Canonical link: https://commits.webkit.org/315837@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
