search

eclipse-platform / eclipse.platform.swt

Eclipse SWT
https://www.eclipse.org/swt/
Eclipse Public License 2.0
118 stars 137 forks source link

Disabling the Inspection of Web Content in Apps, swt WebKit inspectable property required #757

Open dstainhauser opened 1 year ago

dstainhauser commented 1 year ago

On macOS the Safari Developer Menu allows now to inspect the web content of an RCP App that is using the org.eclipse.swt.browser.WebKit.

This might be a nice feature for developing, but it is also a security/privacy risk.

There is a property to disable this in the WKWebKit class

WKWebViewConfiguration *webConfiguration = [WKWebViewConfiguration new]; WKWebView *webView = [[WKWebView alloc] initWithFrame:CGRectZero configuration:webConfiguration]; webView.inspectable = YES;

Unfortunately, this property is not accessible in the java WebKit wrapper.

Actually, the default on macOS would be that this feature is disabled, but when the libraries are build with debug information, the default changes to true. This seems to be the case with the swt libraries provided by eclipse distribution.

I would appreciate having this property accessible in the WebKit class.

Here is a detailed article about this subject: https://webkit.org/blog/13936/enabling-the-inspection-of-web-content-in-apps/

Thanks

Phillipus commented 1 year ago

On macOS the Safari Developer Menu allows now to inspect the web content of an RCP App that is using the org.eclipse.swt.browser.WebKit.

~How does one use this to inspect the the web content in a browser component in an RCP app?~

Edit - never mind, I found it in the Safari menu.

but it is also a security/privacy risk.

Can you give an example of a possible risk/exploit?