Javascript not disabled in internal browser (WKWebView)

ViennaRSS / vienna-rss

Vienna is a free and open-source RSS/Atom newsreader for macOS.

https://www.vienna-rss.com

Apache License 2.0

1.85k stars 227 forks source link

Javascript not disabled in internal browser (WKWebView) #1484

Closed phiw13 closed 3 years ago

phiw13 commented 3 years ago

To Reproduce

Vienna Preferences > Advanced: Uncheck “Enable Javascript in internal browser”.

Read an article in a feed that contains YT video or Bandcamp embeds.

Expected result: the YT vid is displayed as a black box with an error message; the Bandcamp embed is not displayed at all.
Actual result: the YT vid can be played/viewed; the Bandcamp embed is displayed, songs can be played, etc

macOS 11.latest, Vienna 3.8b1 + WKWebView Sample feed: https://www.freejazzblog.org/feeds/posts/default – Regularly (often) includes Bandcamp embeds, and some times YT or Vimeo embeds (e.g 28 and 29/08 articles).

notes: With the “old browser”, the problem does not happen, afaict. The same applies in the actual web browser view, not only article view.

barijaona commented 3 years ago

Yes, it's a current limitation as we are in early phase of development.

Be warned however: I'm not sure we will be able to implement a convincing "no-JavaScript" mode.

In fact, WKWebView forces us to emulate many functionalities through JavaScript.

TAKeanice commented 3 years ago

Does the "JavaScript enabled" configuration for WKWebView disable our injected JS as well? Currently in the constructor of CustomWKWebView we have that configuration hardcoded as "true"

phiw13 commented 3 years ago

If JS enabled is required for the application-injected JS to work, then of course it does not make much sense to have that pref anymore.

(reason for filing: mainly tracking prevention; some feeds manage to insert some tracking cr*p, and I am not sure Vienna could opt-in to Safari’s ITP, which does a more than reasonable job)

Eitot commented 3 years ago

The documentation indicates that there is a distinction between JavaScript code that originates in the website and “user scripts” injected through WKUserContentController. Also note that this API is deprecated since macOS 11, the replacement API has clearer language:

If you change the value to false, the web view doesn’t execute JavaScript code referenced by the web content. That includes JavaScript code found in inline Githubissues.
Githubissues is a development platform for aggregating issues.