[Webkit-unassigned] [Bug 204557] New: WKScriptMessageHandler is unable to evaluate JavaScript in the context of the calling frame

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=204557

            Bug ID: 204557
           Summary: WKScriptMessageHandler is unable to evaluate
                    JavaScript in the context of the calling frame
           Product: WebKit
           Version: Safari 13
          Hardware: All
                OS: All
            Status: NEW
          Severity: Blocker
          Priority: P2
         Component: WebKit2
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: kc at omnigroup.com

I'm trying to get password autofill working again in OmniWeb after porting to WKWebView. Because WKWebView doesn't have any direct API to support this, I've registered a WKUserScript which catches events on password fields and calls back to the app to look up the site's password in the keychain. This works fine for the main frame and for any child frames which share the security origin of the main frame, since I can register some callback functions on window.top. But CORS makes this impossible when the child frame has a different security origin (such as with appstoreconnect.apple.com with its embedded iframe at idmsa.apple.com).

It would be great if WKScriptMessageHandler had some way to get results back to the frame which called it--for example, if it could pass the WKFrameInfo from its received WKScriptMessage to a variant of WKWebView's -evaluateJavaScript:completionHandler: to evaluate a script in the context of that originating frame.

There may be other ways to solve the specific use case of implementing password autofill—but, generally speaking, it seems like a very big limitation that WKScriptMessageHandler is unable to call back to the JavaScript context which called it to return results to the invoking context.

(Thanks in advance for considering this!)

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20191124/482201fe/attachment.htm>