feat: add <webview>.getWebContents() filtering

electron · Jan 7, 2019 · b56a1f7 · b56a1f7
1 parent 5862784
commit b56a1f7
Show file tree

Hide file tree

Showing 6 changed files with 56 additions and 3 deletions.
diff --git a/docs/api/app.md b/docs/api/app.md
@@ -469,6 +469,18 @@ Emitted when `remote.getCurrentWebContents()` is called in the renderer process
 Calling `event.preventDefault()` will prevent the object from being returned.
 Custom value can be returned by setting `event.returnValue`.
 
+### Event: 'remote-get-guest-web-contents'
+
+Returns:
+
+* `event` Event
+* `webContents` [WebContents](web-contents.md)
+* `guestWebContents` [WebContents](web-contents.md)
+
+Emitted when `<webview>.getWebContents()` is called in the renderer process of `webContents`.
+Calling `event.preventDefault()` will prevent the object from being returned.
+Custom value can be returned by setting `event.returnValue`.
+
 ## Methods
 
 The `app` object has the following methods:

diff --git a/docs/api/web-contents.md b/docs/api/web-contents.md
@@ -725,6 +725,17 @@ Emitted when `remote.getCurrentWebContents()` is called in the renderer process.
 Calling `event.preventDefault()` will prevent the object from being returned.
 Custom value can be returned by setting `event.returnValue`.
 
+#### Event: 'remote-get-guest-web-contents'
+
+Returns:
+
+* `event` Event
+* `guestWebContents` [WebContents](web-contents.md)
+
+Emitted when `<webview>.getWebContents()` is called in the renderer process.
+Calling `event.preventDefault()` will prevent the object from being returned.
+Custom value can be returned by setting `event.returnValue`.
+
 ### Instance Methods
 
 #### `contents.loadURL(url[, options])`

diff --git a/lib/browser/api/web-contents.js b/lib/browser/api/web-contents.js
@@ -383,7 +383,8 @@ WebContents.prototype._init = function () {
     'remote-get-global',
     'remote-get-builtin',
     'remote-get-current-window',
-    'remote-get-current-web-contents'
+    'remote-get-current-web-contents',
+    'remote-get-guest-web-contents'
   ]
 
   for (const eventName of forwardedEvents) {

diff --git a/lib/browser/rpc-server.js b/lib/browser/rpc-server.js
@@ -446,7 +446,19 @@ handleRemoteCommand('ELECTRON_BROWSER_CONTEXT_RELEASE', (event, contextId) => {
 
 handleRemoteCommand('ELECTRON_BROWSER_GUEST_WEB_CONTENTS', function (event, contextId, guestInstanceId) {
   const guest = guestViewManager.getGuestForWebContents(guestInstanceId, event.sender)
-  return valueToMeta(event.sender, contextId, guest)
+
+  const customEvent = eventBinding.createWithSender(event.sender)
+  event.sender.emit('remote-get-guest-web-contents', customEvent, guest)
+
+  if (customEvent.defaultPrevented) {
+    if (typeof customEvent.returnValue === 'undefined') {
+      throw new Error('Blocked <webview>.getWebContents()')
+    }
+  } else {
+    customEvent.returnValue = guest
+  }
+
+  return valueToMeta(event.sender, contextId, customEvent.returnValue)
 })
 
 // Implements window.close()

diff --git a/spec/static/main.js b/spec/static/main.js
@@ -251,7 +251,8 @@ for (const eventName of [
 for (const eventName of [
   'desktop-capturer-get-sources',
   'remote-get-current-window',
-  'remote-get-current-web-contents'
+  'remote-get-current-web-contents',
+  'remote-get-guest-web-contents'
 ]) {
   ipcMain.on(`handle-next-${eventName}`, function (event, returnValue) {
     event.sender.once(eventName, (event) => {

diff --git a/spec/webview-spec.js b/spec/webview-spec.js
@@ -1195,6 +1195,22 @@ describe('<webview> tag', function () {
       assert(webviewContents)
       expect(webviewContents.getURL()).to.equal(src)
     })
+
+    it('can return custom value', async () => {
+      const src = 'about:blank'
+      await loadWebView(webview, { src })
+
+      ipcRenderer.send('handle-next-remote-get-guest-web-contents', 'Hello World!')
+      expect(webview.getWebContents()).to.be.equal('Hello World!')
+    })
+
+    it('throws when no returnValue set', async () => {
+      const src = 'about:blank'
+      await loadWebView(webview, { src })
+
+      ipcRenderer.send('handle-next-remote-get-guest-web-contents')
+      expect(() => webview.getWebContents()).to.throw('Blocked <webview>.getWebContents()')
+    })
   })
 
   // FIXME(deepak1556): Ch69 follow up.