@capacitor-plus/ios 8.5.2 → 8.6.1

package/Capacitor/Capacitor/CAPAppStorePrivateAPI.swift

@@ -0,0 +1,10 @@
+import Foundation
+
+/// Compile-time names for private WebKit / plugin integration points (App Store 2.5.2 static dispatch).
+enum CAPAppStorePrivateAPI {
+    static let wkContentViewClassName = "WKContentView"
+    static let wkElementDidFocusSelector = Selector("_elementDidFocus:userIsInteracting:blurPreviousNode:activityStateChanges:userObject:")
+    static let sslPinningHttpRequestHandlerClassName = "SSLPinningHttpRequestHandlerClass"
+    static let shouldOverrideLoadSelector = #selector(CAPPlugin.shouldOverrideLoad(_:))
+    static let handleWKWebViewURLAuthenticationChallengeSelector = #selector(CAPPlugin.handleWKWebViewURLAuthenticationChallenge(_:completionHandler:))
+}

package/Capacitor/Capacitor/CapacitorBridge.swift

@@ -213,6 +213,7 @@ open class CapacitorBridge: NSObject, CAPBridgeProtocol {
         super.init()
 
         self.webViewDelegationHandler.bridge = self
+        self.webViewAssetHandler.setConfiguration(configuration)
 
         exportCoreJS(localUrl: configuration.localURL.absoluteString)
         registerPlugins()
@@ -272,19 +273,35 @@ open class CapacitorBridge: NSObject, CAPBridgeProtocol {
                 self?.triggerDocumentJSEvent(eventName: "pause")
             })
             observers.append(NotificationCenter.default.addObserver(forName: UIScene.willEnterForegroundNotification, object: nil, queue: OperationQueue.main) { [weak self] notification in
-                if let scene = notification.object as? UIWindowScene, scene === self?.viewController?.view.window?.windowScene {
-                    self?.triggerDocumentJSEvent(eventName: "resume")
-                }
-
+                self?.triggerSceneLifecycleJSEvent("resume", for: notification)
             })
             observers.append(NotificationCenter.default.addObserver(forName: UIScene.didEnterBackgroundNotification, object: nil, queue: OperationQueue.main) { [weak self] notification in
-                if let scene = notification.object as? UIWindowScene, scene === self?.viewController?.view.window?.windowScene {
-                    self?.triggerDocumentJSEvent(eventName: "pause")
-                }
+                self?.triggerSceneLifecycleJSEvent("pause", for: notification)
             })
         }
     }
 
+    /**
+     Forward a scene lifecycle transition to the page as a document event, but only once
+     the page exists to receive it.
+
+     On a cold start `UIScene.willEnterForegroundNotification` is posted while the initial
+     load is still in flight, before `window.Capacitor` has been defined. Evaluating
+     `triggerEvent` at that point throws inside the web view and surfaces as a
+     "JS Eval error" in the log. The same happens when the web content process was
+     terminated and the page is being reloaded. In both cases the page is about to load
+     from scratch, so there is nothing for it to resume or pause; the event is dropped
+     rather than deferred, because a "resume" delivered right after a fresh load would
+     make the page react to a transition it never went through.
+     */
+    private func triggerSceneLifecycleJSEvent(_ eventName: String, for notification: Notification) {
+        guard let scene = notification.object as? UIWindowScene,
+              scene === viewController?.view.window?.windowScene else {
+            return
+        }
+        eval(js: "window.Capacitor?.triggerEvent && window.Capacitor.triggerEvent('\(eventName)', 'document')")
+    }
+
     /**
      Export the core Cordova JS runtime
      */

package/Capacitor/Capacitor/Plugins/CapacitorHttp.swift

@@ -15,9 +15,10 @@ public class CAPHttpPlugin: CAPPlugin, CAPBridgedPlugin {
 
     @objc func http(_ call: CAPPluginCall, _ httpMethod: String?) {
         do {
-            if let clazz = NSClassFromString("SSLPinningHttpRequestHandlerClass") {
+            // appstore-2.5.2-allow: optional SSL pinning handler plugin class lookup
+            if let clazz = NSClassFromString(CAPAppStorePrivateAPI.sslPinningHttpRequestHandlerClassName) {
                 // swiftlint:disable force_cast
-                (clazz as! NSObject.Type).perform(#selector(self.request(_:)), with: [
+                (clazz as! NSObject.Type).perform(#selector(CAPHttpPlugin.request(_:)), with: [
                     "call": call,
                     "httpMethod": httpMethod as Any,
                     "config": self.bridge?.config as Any

package/Capacitor/Capacitor/UIStatusBarManager+CAPHandleTapAction.m

@@ -2,13 +2,19 @@
 #import <objc/message.h>
 #import <objc/runtime.h>
 
+// appstore-2.5.2-allow: forward declare private UIStatusBarManager API for compile-time @selector
+@interface UIStatusBarManager (CAPPrivateStatusBarTap)
+- (void)handleTapAction:(id)arg1;
+@end
+
 @implementation UIStatusBarManager (CAPHandleTapAction)
 
 + (void)load {
   static dispatch_once_t onceToken;
   dispatch_once(&onceToken, ^{
     Class class = [self class];
-    SEL originalSelector = NSSelectorFromString(@"handleTapAction:");
+    // appstore-2.5.2-allow: status bar tap notification for CapacitorStatusBarTapped
+    SEL originalSelector = @selector(handleTapAction:);
     SEL swizzledSelector = @selector(nofity_handleTapAction:);
 
     Method originalMethod = class_getInstanceMethod(class, originalSelector);
@@ -19,11 +25,13 @@
                                         method_getImplementation(swizzledMethod),
                                         method_getTypeEncoding(swizzledMethod));
     if (didAddMethod) {
+      // appstore-2.5.2-allow: install status bar tap swizzle when method was not present
       class_replaceMethod(class,
                           swizzledSelector,
                           method_getImplementation(originalMethod),
                           method_getTypeEncoding(originalMethod));
     } else {
+      // appstore-2.5.2-allow: exchange status bar tap implementation
       method_exchangeImplementations(originalMethod, swizzledMethod);
     }
   });

package/Capacitor/Capacitor/WKWebView+Capacitor.swift

@@ -31,9 +31,8 @@ internal extension WKWebView {
     // dispatch_once isn't available in Swift, but lazy properties use the same mechanism under the hood so
     // we can safely assume that this block of code will only execute once.
     static let oneTimeOnlySwizzle: () = {
-        let frameworkName = "WK"
-        let className = "ContentView"
-        guard let targetClass = NSClassFromString(frameworkName + className) else {
+        // appstore-2.5.2-allow: WKContentView keyboard focus integration (compile-time class name)
+        guard let targetClass = NSClassFromString(CAPAppStorePrivateAPI.wkContentViewClassName) else {
             return
         }
 
@@ -59,10 +58,11 @@ internal extension WKWebView {
                 }
             }
             let imp: IMP = imp_implementationWithBlock(block)
+            // appstore-2.5.2-allow: replace WKContentView focus handler implementation
             method_setImplementation(method, imp)
         }
 
-        let selectorMkIV: Selector = sel_getUid("_elementDidFocus:userIsInteracting:blurPreviousNode:activityStateChanges:userObject:")
+        let selectorMkIV = CAPAppStorePrivateAPI.wkElementDidFocusSelector
 
         if let method = class_getInstanceMethod(targetClass, selectorMkIV) {
             swizzleFiveArgClosure(method, selectorMkIV)

package/Capacitor/Capacitor/WebViewAssetHandler.swift

@@ -6,6 +6,7 @@ import UniformTypeIdentifiers
 open class WebViewAssetHandler: NSObject, WKURLSchemeHandler {
     private var router: Router
     private var serverUrl: URL?
+    private var configuration: InstanceConfiguration?
 
     public init(router: Router) {
         self.router = router
@@ -20,6 +21,10 @@ open class WebViewAssetHandler: NSObject, WKURLSchemeHandler {
         self.serverUrl = serverUrl
     }
 
+    open func setConfiguration(_ configuration: InstanceConfiguration?) {
+        self.configuration = configuration
+    }
+
     private func isUsingLiveReload(_ localUrl: URL) -> Bool {
         return self.serverUrl != nil && self.serverUrl?.scheme != localUrl.scheme
     }
@@ -31,7 +36,13 @@ open class WebViewAssetHandler: NSObject, WKURLSchemeHandler {
         let localUrl = URL.init(string: url.absoluteString)!
 
         if url.path.starts(with: CapacitorBridge.httpInterceptorStartIdentifier) {
-            handleCapacitorHttpRequest(urlSchemeTask, localUrl, false)
+            // Only serve the proxy when CapacitorHttp is on. A scheme task can't tell a document from
+            // a subresource, so keeping documents out relies on the check in decidePolicyFor.
+            if configuration?.getPluginConfig("CapacitorHttp").getBoolean("enabled", false) == true {
+                handleCapacitorHttpRequest(urlSchemeTask, localUrl, false)
+            } else {
+                urlSchemeTask.didFailWithError(URLError(.unsupportedURL))
+            }
             return
         }
 
@@ -152,12 +163,13 @@ open class WebViewAssetHandler: NSObject, WKURLSchemeHandler {
                     let existingHeaders = response.allHeaderFields
                     var newHeaders: [AnyHashable: Any] = [:]
 
+                    // Nothing should render this. If anything does, sandbox keeps it inert.
+                    newHeaders["Content-Security-Policy"] = "sandbox; frame-ancestors 'none'"
+
                     // if using live reload, then set CORS headers
                     if self.isUsingLiveReload(url) {
-                        newHeaders = [
-                            "Access-Control-Allow-Origin": self.serverUrl?.absoluteString ?? "",
-                            "Access-Control-Allow-Methods": "GET, HEAD, OPTIONS, TRACE"
-                        ]
+                        newHeaders["Access-Control-Allow-Origin"] = self.serverUrl?.absoluteString ?? ""
+                        newHeaders["Access-Control-Allow-Methods"] = "GET, HEAD, OPTIONS, TRACE"
                     }
 
                     if let mergedHeaders = existingHeaders.merging(newHeaders, uniquingKeysWith: { (_, newHeaders) in newHeaders }) as? [String: String] {

package/Capacitor/Capacitor/WebViewDelegationHandler.swift

@@ -64,6 +64,35 @@ open class WebViewDelegationHandler: NSObject, WKNavigationDelegate, WKUIDelegat
         decisionHandler(.grant)
     }
 
+    private static func effectivePort(for url: URL) -> Int? {
+        if let port = url.port {
+            return port
+        }
+        switch url.scheme?.lowercased() {
+        case "https":
+            return 443
+        case "http":
+            return 80
+        default:
+            return nil
+        }
+    }
+
+    private static func matchesOrigin(_ url: URL, _ origin: URL) -> Bool {
+        guard url.scheme == origin.scheme, url.host == origin.host else {
+            return false
+        }
+        return effectivePort(for: url) == effectivePort(for: origin)
+    }
+
+    /// Test seam: avoids subclassing `WKNavigationAction` in unit tests.
+    static func shouldBlockHttpInterceptorNavigation(for url: URL, serverURL: URL, localURL: URL) -> Bool {
+        guard url.path.starts(with: CapacitorBridge.httpInterceptorStartIdentifier) else {
+            return false
+        }
+        return matchesOrigin(url, serverURL) || matchesOrigin(url, localURL)
+    }
+
     open func webView(_ webView: WKWebView, decidePolicyFor navigationAction: WKNavigationAction, decisionHandler: @escaping (WKNavigationActionPolicy) -> Void) {
         // post a notification for any listeners
         NotificationCenter.default.post(name: .capacitorDecidePolicyForNavigationAction, object: navigationAction)
@@ -74,10 +103,21 @@ open class WebViewDelegationHandler: NSObject, WKNavigationDelegate, WKUIDelegat
             return
         }
 
+        // The proxy returns a remote body at the app origin, so block it before plugins can allow it.
+        if Self.shouldBlockHttpInterceptorNavigation(
+            for: navURL,
+            serverURL: bridge.config.serverURL,
+            localURL: bridge.config.localURL
+        ) {
+            decisionHandler(.cancel)
+            return
+        }
+
         // first, give plugins the chance to handle the decision
         for pluginObject in bridge.plugins {
             let plugin = pluginObject.value
-            let selector = NSSelectorFromString("shouldOverrideLoad:")
+            let selector = CAPAppStorePrivateAPI.shouldOverrideLoadSelector
+            // appstore-2.5.2-allow: optional plugin navigation override hook
             if plugin.responds(to: selector) {
                 let shouldOverrideLoad = plugin.shouldOverrideLoad(navigationAction)
                 if shouldOverrideLoad != nil {
@@ -169,7 +209,8 @@ open class WebViewDelegationHandler: NSObject, WKNavigationDelegate, WKUIDelegat
 
         for pluginObject in bridge.plugins {
             let plugin = pluginObject.value
-            let selector = NSSelectorFromString("handleWKWebViewURLAuthenticationChallenge:completionHandler:")
+            let selector = CAPAppStorePrivateAPI.handleWKWebViewURLAuthenticationChallengeSelector
+            // appstore-2.5.2-allow: optional plugin TLS authentication hook
             if plugin.responds(to: selector) {
                 if plugin.handleWKWebViewURLAuthenticationChallenge(challenge, completionHandler: completionHandler) {
                     return

package/Capacitor/Capacitor/assets/native-bridge.js

@@ -417,12 +417,6 @@ var nativeBridge = (function (exports) {
                 }
             };
             const platform = getPlatformId(win);
-            if (platform == 'android' && typeof win.CapacitorSystemBarsAndroidInterface !== 'undefined') {
-                // add DOM ready listener for System Bars
-                document.addEventListener('DOMContentLoaded', function () {
-                    win.CapacitorSystemBarsAndroidInterface.onDOMReady();
-                });
-            }
             if (platform == 'android' || platform == 'ios') {
                 // patch document.cookie on Android/iOS
                 win.CapacitorCookiesDescriptor =

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capacitor-plus/ios",
-  "version": "8.5.2",
+  "version": "8.6.1",
   "description": "Capacitor+: Enhanced Capacitor with automated upstream sync - Cross-platform apps with JavaScript and the web",
   "homepage": "https://capgo.app/docs/plugins/capacitor-plus/",
   "author": "Capgo Team <support@capgo.app> (https://capgo.app)",
@@ -20,13 +20,13 @@
     "scripts/pods_helpers.rb"
   ],
   "scripts": {
-    "verify": "npm run xc:build:Capacitor && npm run xc:build:CapacitorCordova",
+    "verify": "node ../scripts/check-ios-dynamic-dispatch.mjs && npm run xc:build:Capacitor && npm run xc:build:CapacitorCordova",
     "xc:build:Capacitor": "cd Capacitor && xcodebuild clean test -workspace Capacitor.xcworkspace -scheme Capacitor -destination 'platform=iOS Simulator,name=iPhone 17,OS=latest' && cd ..",
     "xc:build:CapacitorCordova": "cd CapacitorCordova && xcodebuild && cd .."
   },
   "peerDependencies": {
-    "@capacitor-plus/core": "^8.5.0",
-    "@capacitor/core": "^8.5.0"
+    "@capacitor-plus/core": "^8.6.0",
+    "@capacitor/core": "^8.6.0"
   },
   "publishConfig": {
     "access": "public"