Mailing-List: contact issues-help@cordova.apache.org; run by ezmlm
Precedence: bulk
Date: Mon, 13 Mar 2017 21:48:41 +0000 (UTC)
From: =?utf-8?Q?Sondre_Bjell=C3=A5s_=28JIRA=29?= <jira@apache.org>
To: issues@cordova.apache.org
Message-ID: <JIRA.13050573.1489414900000.7281.1489441721803@Atlassian.JIRA>
In-Reply-To: <JIRA.13050573.1489414900000@Atlassian.JIRA>
References: <JIRA.13050573.1489414900000@Atlassian.JIRA> <JIRA.13050573.1489414900736@jira-lw-us.apache.org>
Subject: [jira] [Comment Edited] (CB-12566) WKWebViewEngine does not use CSP
 meta-tag, fails to load about:blank
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
archived-at: Mon, 13 Mar 2017 21:48:48 -0000


    [ https://issues.apache.org/jira/browse/CB-12566?page=3Dcom.atlassian.j=
ira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=3D159230=
18#comment-15923018 ]=20

Sondre Bjell=C3=A5s edited comment on CB-12566 at 3/13/17 9:47 PM:
--------------------------------------------------------------

Create a repo project here, I will have to verify tomorrow at the office wh=
ere I have the Mac and everything. I'll leave a comment here tomorrow if th=
is repo is enough to reproduce the error, or if there are additional change=
s I need to do to replicate the problem: https://github.com/sondreb/cordova=
-wkwebview-bug


was (Author: sondreb):
Create a repo project here, I will have to verify tomorrow at the office wh=
ere I have the Mac and everything. I'll leave a comment here tomorrow if th=
is repo is enough to reproduce the error, or if there are additional change=
s I need to do to replicate the problem: [https://github.com/sondreb/cordov=
a-wkwebview-bug](https://github.com/sondreb/cordova-wkwebview-bug)

> WKWebViewEngine does not use CSP meta-tag, fails to load about:blank
> --------------------------------------------------------------------
>
>                 Key: CB-12566
>                 URL: https://issues.apache.org/jira/browse/CB-12566
>             Project: Apache Cordova
>          Issue Type: Bug
>          Components: Plugin WKWebViewEngine
>            Reporter: Sondre Bjell=C3=A5s
>            Assignee: Shazron Abdullah
>
> When adding the WKWebView plugin to a Cordova project, the CSP meta-tag i=
n externally hosted HTML file is probably not used/parsed, or there is anot=
her way to configure CSP for the plugin?
> Have a working app using the default web view engine on iOS, when it is r=
eplaced with the WKWebView, the app will log thousands of messages to the c=
onsole. The error also results in Cordova runtime and plugins not being loa=
ded and not working in the app.
> The plugin is added with the following elements in config.xml:
> <feature name=3D"CDVWKWebViewEngine">
> =09<param name=3D"ios-package" value=3D"CDVWKWebViewEngine" />
> </feature>
> <preference name=3D"CordovaWebViewEngine" value=3D"CDVWKWebViewEngine" />
> <plugin name=3D"cordova-plugin-wkwebview-engine" spec=3D"~1.1.2" />
> To see this behavior, simply run the project in the simulator, and then d=
ebug using Safari and connect to simulator.
> Output in Web Inspect in Safari:
> [blocked] The page at about:blank was not allowed to display insecure con=
tent from gap://ready.
> This is the current content of the CSP, have attempted many different var=
iations with no success:
> <meta http-equiv=3D"Content-Security-Policy" content=3D"frame-src * gap:/=
/ready; default-src 'self' gap://ready file://* *; connect-src * blob: data=
:; style-src * 'unsafe-inline'; script-src * 'unsafe-eval' 'unsafe-inline';=
 img-src data: *">
> (CSP header taken from this issue: https://github.com/driftyco/ionic/issu=
es/6928)
> The errors is not logged when the index.html within the app is loaded, bu=
t appears when externally linked HTML is loaded. Redirect is done using Jav=
aScript code that changes window.location.href.


--
This message was sent by Atlassian JIRA
(v6.3.15#6346)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For additional commands, e-mail: issues-help@cordova.apache.org