@capacitor-plus/ios 8.5.3 → 8.6.2

package/Capacitor/Capacitor/CapacitorBridge.swift

@@ -213,6 +213,7 @@ open class CapacitorBridge: NSObject, CAPBridgeProtocol {
         super.init()
 
         self.webViewDelegationHandler.bridge = self
+        self.webViewAssetHandler.setConfiguration(configuration)
 
         exportCoreJS(localUrl: configuration.localURL.absoluteString)
         registerPlugins()
@@ -272,19 +273,35 @@ open class CapacitorBridge: NSObject, CAPBridgeProtocol {
                 self?.triggerDocumentJSEvent(eventName: "pause")
             })
             observers.append(NotificationCenter.default.addObserver(forName: UIScene.willEnterForegroundNotification, object: nil, queue: OperationQueue.main) { [weak self] notification in
-                if let scene = notification.object as? UIWindowScene, scene === self?.viewController?.view.window?.windowScene {
-                    self?.triggerDocumentJSEvent(eventName: "resume")
-                }
-
+                self?.triggerSceneLifecycleJSEvent("resume", for: notification)
             })
             observers.append(NotificationCenter.default.addObserver(forName: UIScene.didEnterBackgroundNotification, object: nil, queue: OperationQueue.main) { [weak self] notification in
-                if let scene = notification.object as? UIWindowScene, scene === self?.viewController?.view.window?.windowScene {
-                    self?.triggerDocumentJSEvent(eventName: "pause")
-                }
+                self?.triggerSceneLifecycleJSEvent("pause", for: notification)
             })
         }
     }
 
+    /**
+     Forward a scene lifecycle transition to the page as a document event, but only once
+     the page exists to receive it.
+
+     On a cold start `UIScene.willEnterForegroundNotification` is posted while the initial
+     load is still in flight, before `window.Capacitor` has been defined. Evaluating
+     `triggerEvent` at that point throws inside the web view and surfaces as a
+     "JS Eval error" in the log. The same happens when the web content process was
+     terminated and the page is being reloaded. In both cases the page is about to load
+     from scratch, so there is nothing for it to resume or pause; the event is dropped
+     rather than deferred, because a "resume" delivered right after a fresh load would
+     make the page react to a transition it never went through.
+     */
+    private func triggerSceneLifecycleJSEvent(_ eventName: String, for notification: Notification) {
+        guard let scene = notification.object as? UIWindowScene,
+              scene === viewController?.view.window?.windowScene else {
+            return
+        }
+        eval(js: "window.Capacitor?.triggerEvent && window.Capacitor.triggerEvent('\(eventName)', 'document')")
+    }
+
     /**
      Export the core Cordova JS runtime
      */

package/Capacitor/Capacitor/WebViewAssetHandler.swift

@@ -6,6 +6,7 @@ import UniformTypeIdentifiers
 open class WebViewAssetHandler: NSObject, WKURLSchemeHandler {
     private var router: Router
     private var serverUrl: URL?
+    private var configuration: InstanceConfiguration?
 
     public init(router: Router) {
         self.router = router
@@ -20,6 +21,10 @@ open class WebViewAssetHandler: NSObject, WKURLSchemeHandler {
         self.serverUrl = serverUrl
     }
 
+    open func setConfiguration(_ configuration: InstanceConfiguration?) {
+        self.configuration = configuration
+    }
+
     private func isUsingLiveReload(_ localUrl: URL) -> Bool {
         return self.serverUrl != nil && self.serverUrl?.scheme != localUrl.scheme
     }
@@ -31,7 +36,13 @@ open class WebViewAssetHandler: NSObject, WKURLSchemeHandler {
         let localUrl = URL.init(string: url.absoluteString)!
 
         if url.path.starts(with: CapacitorBridge.httpInterceptorStartIdentifier) {
-            handleCapacitorHttpRequest(urlSchemeTask, localUrl, false)
+            // Only serve the proxy when CapacitorHttp is on. A scheme task can't tell a document from
+            // a subresource, so keeping documents out relies on the check in decidePolicyFor.
+            if configuration?.getPluginConfig("CapacitorHttp").getBoolean("enabled", false) == true {
+                handleCapacitorHttpRequest(urlSchemeTask, localUrl, false)
+            } else {
+                urlSchemeTask.didFailWithError(URLError(.unsupportedURL))
+            }
             return
         }
 
@@ -152,12 +163,13 @@ open class WebViewAssetHandler: NSObject, WKURLSchemeHandler {
                     let existingHeaders = response.allHeaderFields
                     var newHeaders: [AnyHashable: Any] = [:]
 
+                    // Nothing should render this. If anything does, sandbox keeps it inert.
+                    newHeaders["Content-Security-Policy"] = "sandbox; frame-ancestors 'none'"
+
                     // if using live reload, then set CORS headers
                     if self.isUsingLiveReload(url) {
-                        newHeaders = [
-                            "Access-Control-Allow-Origin": self.serverUrl?.absoluteString ?? "",
-                            "Access-Control-Allow-Methods": "GET, HEAD, OPTIONS, TRACE"
-                        ]
+                        newHeaders["Access-Control-Allow-Origin"] = self.serverUrl?.absoluteString ?? ""
+                        newHeaders["Access-Control-Allow-Methods"] = "GET, HEAD, OPTIONS, TRACE"
                     }
 
                     if let mergedHeaders = existingHeaders.merging(newHeaders, uniquingKeysWith: { (_, newHeaders) in newHeaders }) as? [String: String] {

package/Capacitor/Capacitor/WebViewDelegationHandler.swift

@@ -64,6 +64,35 @@ open class WebViewDelegationHandler: NSObject, WKNavigationDelegate, WKUIDelegat
         decisionHandler(.grant)
     }
 
+    private static func effectivePort(for url: URL) -> Int? {
+        if let port = url.port {
+            return port
+        }
+        switch url.scheme?.lowercased() {
+        case "https":
+            return 443
+        case "http":
+            return 80
+        default:
+            return nil
+        }
+    }
+
+    private static func matchesOrigin(_ url: URL, _ origin: URL) -> Bool {
+        guard url.scheme == origin.scheme, url.host == origin.host else {
+            return false
+        }
+        return effectivePort(for: url) == effectivePort(for: origin)
+    }
+
+    /// Test seam: avoids subclassing `WKNavigationAction` in unit tests.
+    static func shouldBlockHttpInterceptorNavigation(for url: URL, serverURL: URL, localURL: URL) -> Bool {
+        guard url.path.starts(with: CapacitorBridge.httpInterceptorStartIdentifier) else {
+            return false
+        }
+        return matchesOrigin(url, serverURL) || matchesOrigin(url, localURL)
+    }
+
     open func webView(_ webView: WKWebView, decidePolicyFor navigationAction: WKNavigationAction, decisionHandler: @escaping (WKNavigationActionPolicy) -> Void) {
         // post a notification for any listeners
         NotificationCenter.default.post(name: .capacitorDecidePolicyForNavigationAction, object: navigationAction)
@@ -74,6 +103,16 @@ open class WebViewDelegationHandler: NSObject, WKNavigationDelegate, WKUIDelegat
             return
         }
 
+        // The proxy returns a remote body at the app origin, so block it before plugins can allow it.
+        if Self.shouldBlockHttpInterceptorNavigation(
+            for: navURL,
+            serverURL: bridge.config.serverURL,
+            localURL: bridge.config.localURL
+        ) {
+            decisionHandler(.cancel)
+            return
+        }
+
         // first, give plugins the chance to handle the decision
         for pluginObject in bridge.plugins {
             let plugin = pluginObject.value

package/Capacitor/Capacitor/assets/native-bridge.js

@@ -417,12 +417,6 @@ var nativeBridge = (function (exports) {
                 }
             };
             const platform = getPlatformId(win);
-            if (platform == 'android' && typeof win.CapacitorSystemBarsAndroidInterface !== 'undefined') {
-                // add DOM ready listener for System Bars
-                document.addEventListener('DOMContentLoaded', function () {
-                    win.CapacitorSystemBarsAndroidInterface.onDOMReady();
-                });
-            }
             if (platform == 'android' || platform == 'ios') {
                 // patch document.cookie on Android/iOS
                 win.CapacitorCookiesDescriptor =

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capacitor-plus/ios",
-  "version": "8.5.3",
+  "version": "8.6.2",
   "description": "Capacitor+: Enhanced Capacitor with automated upstream sync - Cross-platform apps with JavaScript and the web",
   "homepage": "https://capgo.app/docs/plugins/capacitor-plus/",
   "author": "Capgo Team <support@capgo.app> (https://capgo.app)",
@@ -25,8 +25,8 @@
     "xc:build:CapacitorCordova": "cd CapacitorCordova && xcodebuild && cd .."
   },
   "peerDependencies": {
-    "@capacitor-plus/core": "^8.5.0",
-    "@capacitor/core": "^8.5.0"
+    "@capacitor-plus/core": "^8.6.0",
+    "@capacitor/core": "^8.6.0"
   },
   "publishConfig": {
     "access": "public"