3 ms·
I hope Apple doesn't disable JS injection in WKWebViews in response to this. JS injection is the (only?) way to call native Swift methods from JS ie. bridging.
by asadlionpk 4y ago
I hope Apple doesn't disable JS injection in WKWebViews in response to this. JS injection is the (only?) way to call native Swift methods from JS ie. bridging.
I am not sure what the solution here is. Maybe only allow injection to sites you control (via apple association file).
- nofunsir 4y agoI hope they do.
- throwaway290 4y agoWait, websites can call native Swift methods from JS?
- Linkd 4y agoCertainly. See https://developer.apple.com/documentation/webkit/wkscriptmessagehandler https://developer.apple.com/documentation/webkit/wkscriptmes...
- _rend 4y agoOnly intentionally, via setup from a hosting app. If an app uses a WKWebView to display web content, it can use WKUserContentController[1] to inject scripts and additional content into the page dynamically, and can inject functions into JS[2] which will trigger native callback handlers when called. If your app uses the JavaScriptCore[3] framework to run JS in a VM in-process directly, you have even more options for interfacing between JS and native code. Note that this has to be explicitly hooked up by the app (i.e., none of this applies within, say, Safari). [1]: https://developer.apple.com/documentation/webkit/wkusercontentcontroller https://developer.apple.com/documentation/webkit/wkuserconte... [2]: https://developer.apple.com/documentation/webkit/wkusercontentcontroller/1537172-add https://developer.apple.com/documentation/webkit/wkuserconte... [3]: https://developer.apple.com/documentation/javascriptcore https://developer.apple.com/documentation/javascriptcore
- Spivak 4y agoShort answer: yes With the appropriate libraries you can use JS to call Swift and Obj C code. Long answer: no All it really means is that the JS and Swift/Obj C can pass data between each other and the library is set up to parse that data and call the appropriate code. It's just an automatic RPC.
- jedberg 4y agoApple can just disallow in app browsers in the store policy. Require apps to call out to the default external browser.
- asadlionpk 4y agoThe line is a bit blurry there. from a webview-based apps to just in-app browsers that opens when you tap a link in an app.
- jedberg 4y agoSure but since the App Store is human review, they can tell the difference between a web view and an external website. Or just require the app to only call web views on their own domain or a whitelist of domains they submit with the app.
- AtNightWeCode 4y agoShould only be allowed on domains one owns. Could be solved by DNS records or certificates.
- asadlionpk 4y agoYup, apple association file is Apple's method of proving ownership to a domain.
- tehlike 4y agoCheck app bound domains.
- Aulig 4y agoSame here. So many apps legitimately depend on these features, which makes me worried about an overreaction from Apple here. A domain verification would be a huge hassle for me, since I provide an app builder that allows my non-technical customers to build an app (which includes a webview). Asking them to do domain verification would be tricky.