From 1375ae21d9ea4e416c0981d905ec66f737ee3c4a Mon Sep 17 00:00:00 2001 From: Brandon-T Date: Sat, 1 Feb 2020 01:28:34 -0500 Subject: [PATCH] Ref #2297: Disable JSContext for any type that is privileged. User must explicitly initiate action. (#2299) --- .../Browser/BrowserViewController.swift | 20 ++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/Client/Frontend/Browser/BrowserViewController.swift b/Client/Frontend/Browser/BrowserViewController.swift index 7a7ed563633..48497af289d 100644 --- a/Client/Frontend/Browser/BrowserViewController.swift +++ b/Client/Frontend/Browser/BrowserViewController.swift @@ -1113,13 +1113,19 @@ class BrowserViewController: UIViewController { return } - if let webView = tab.webView, let code = url.bookmarkletCodeComponent { - resetSpoofedUserAgentIfRequired(webView, newURL: url) - webView.evaluateJavaScript(code, completionHandler: { _, error in - if let error = error { - log.error(error) - } - }) + //Another Fix for: https://github.com/brave/brave-ios/pull/2296 + //Disable any sort of privileged execution contexts + //IE: The user must explicitly type OR must explicitly tap a bookmark they have saved. + //Block all other contexts such as redirects, downloads, embed, linked, etc.. + if visitType == .typed || visitType == .bookmark { + if let webView = tab.webView, let code = url.bookmarkletCodeComponent { + resetSpoofedUserAgentIfRequired(webView, newURL: url) + webView.evaluateJavaScript(code, completionHandler: { _, error in + if let error = error { + log.error(error) + } + }) + } } } else { topToolbar.currentURL = url