WebView URL filtering #3442

t-arn · 2025-05-13T11:45:37Z

This PR aims to implement URL filtering for WebView on Windows and Android.
Possible use cases are:

preventing users from navigating off the site intended to be handled by your application's WebView
preventing users from navigating to known malicious web sites

PR Checklist:

All new features have been tested
All new features have been documented
I have read the CONTRIBUTING.md file
I will abide by the code of conduct

* implented on_navigation_started for android * extended the webview example

* applied black

freakboy3742

Thanks for the PR; I've flagged a few issues inline, and the test suite is obviously failing on most platforms (although it looks like the reason for the failure is something that won't be an issue once you've addressed one of the comments inline).

freakboy3742 · 2025-05-13T12:25:44Z

android/src/toga_android/widgets/webview.py

+    @Override(jboolean, [A_WebView, WebResourceRequest])
+    def shouldOverrideUrlLoading(self, webview, webresourcerequest):
+        if self.webview_impl.interface.on_navigation_starting:
+            event = TogaNavigationEvent(webresourcerequest)


I'm a little confused about what is going on here. TogaNavigationEvent is a Python class, wrapping a request and a cancel attribute. It's never assigned to anything, or passed as an argument to anything - then it's cleared. Why is it required at all?

Yes, the TogaNavigationEvent was a left-over of some old code - I removed it.

freakboy3742 · 2025-05-13T12:26:44Z

android/src/toga_android/widgets/webview.py

@@ -86,3 +117,7 @@ def evaluate_javascript(self, javascript, on_result=None):

        self.native.evaluateJavascript(javascript, ReceiveString(result))
        return result
+
+    def set_on_navigation_starting(self, handler):


At this point, I'm pretty sure we've removed all the "set_on_..." methods; unless there's a specific use case (and it doesn't look like there is), this can be removed.

I removed it.

freakboy3742 · 2025-05-13T12:27:13Z

core/src/toga/widgets/webview.py

@@ -33,6 +33,7 @@ def __init__(
        url: str | None = None,
        content: str | None = None,
        user_agent: str | None = None,
+        on_navigation_starting=None,


This needs a type declaration (if only for documentation purposes)

OK, added type declaration

freakboy3742 · 2025-05-13T12:29:23Z

examples/webview/pyproject.toml

@@ -53,6 +53,10 @@ build_gradle_dependencies = [
    "com.google.android.material:material:1.12.0",
 ]

+build_gradle_extra_content="""
+chaquopy.defaultConfig.staticProxy("toga_android.widgets.webview")
+"""


Hrm... Requiring users to manually inject an "extra content" block to make a feature work is a problematic requirement. I understand why it's needed - but we possibly need to solve the bigger problem of allowing toga to declare a list of "classes that need a static proxy".

I agree. But this probably means that this PR cannot be merged any time soon, right?

It depends how essential the change is.

If a WebView will continue to work on Android, but this feature won't work without the extra content declaration, we can probably merge it. We will need to add a set of platform notes in the docs, and we'll need to prioritise finding a better fix - but I don't think it needs to be a complete blocker.

However, if Webview (or the whole Android backend) won't work at all if this addition isn't in place, then we'll need to solve that problem first.

freakboy3742 · 2025-05-13T12:30:20Z

examples/webview/webview/app.py

+            allow = False
+            message = f"Navigation not allowed to: {url}"
+            dialog = toga.InfoDialog("on_navigation_starting()", message)
+            asyncio.create_task(self.dialog(dialog))


It might be easier to make on_navigation_starting an async callback, and then await the response.

The example app now has both, a synchronous and an async handler

freakboy3742 · 2025-05-13T12:32:40Z

android/src/toga_android/widgets/webview.py

+            event = TogaNavigationEvent(webresourcerequest)
+            allow = self.webview_impl.interface.on_navigation_starting(
+                webresourcerequest.getUrl().toString()
+            )


I haven't checked, but this could be a problem if on_navigation_starting is an async callback, because the returned value will be a future.

freakboy3742 · 2025-05-13T12:33:49Z

examples/webview/webview/app.py

@@ -92,6 +106,9 @@ def startup(self):
            on_webview_load=self.on_webview_load,
            style=Pack(flex=1),
        )
+        # activate web navigation filtering on supported platforms
+        if getattr(self.webview._impl, "SUPPORTS_ON_NAVIGATION_STARTING", True):


Good instinct, but it's fine for the example to raise a warning if a feature isn't available.

winforms/src/toga_winforms/widgets/webview.py

freakboy3742 · 2025-05-13T12:35:01Z

winforms/src/toga_winforms/widgets/webview.py

+    def winforms_navigation_starting(self, sender, event):
+        # print(f"winforms_navigation_starting: {event.Uri}")
+        if self.interface.on_navigation_starting:
+            allow = self.interface.on_navigation_starting(event.Uri)


As with the Android version, this needs to handle a Future being returned.

I'm not quite sure, how to do this. Is there a similar case in the code base where I could get some inspiration?

t-arn · 2025-05-13T13:16:11Z

@freakboy3742 I wonder if it is possible to make the on_navigation_starting handler async when it is being called by a native event. Aren't those native events always synchronous?

freakboy3742 · 2025-05-13T13:19:36Z

@freakboy3742 I wonder if it is possible to make the on_navigation_starting handler async when it is being called by a native event. Aren't those native events always synchronous?

Yes, native event handlers are always synchronous - but Toga events must be able to be defined asynchronously. That's why they return a future; we need to make sure that if a future is returned, we wait for that future.

* added type declaration for handler * added WeakrefCallable wrapper

…_navigation_starting handlers

t-arn · 2025-06-11T17:21:34Z

@freakboy3742 I implemented support for synchronous and asynchronous on_navigation_starting handlers for Windows. The code still contains a lot of print statements for easier debugging. If you approve of this approach, I'll implement something similar for Android and clean up the code.

freakboy3742

I'm not sure I understand the approach you've taken here.

Firstly, I'm not sure why the cached "allowed" and "not allowed" URL lists is required. It seems to undermine the ability to make per-request based decisions on whether a navigation is required, which is the point of having a callback.

Secondly, the general approach of "if async, cancel the request, and force a URL load if the async result succeeds" makes sense, but the way it gets to the actual resolution seems... convoluted.

wrapped_handler takes a function or co-routine, and guarantees that it will be invoked on the event loop. It already has a an existing cleanup method that can be used to attach "on completion" logic. There's no need to have a whole standalone "attach completion callback to result" handler - it can be baked into the cleanup method when the handler is installed.

t-arn · 2025-06-12T19:00:25Z

@freakboy3742 The "allowed" and "not allowed" lists are meant to cache the user's decision whether to allow the URL or not. I think, the user will not want to be asked for the same URL again and again.

As for setting the callback method: I didn't realize that wrapped_handler already has the "on completion" functionality. I'll rewrite the code and use the cleanup method.

t-arn · 2025-06-12T22:18:10Z

We could make it configurable whether the user's decisions should be saved, for example by setting WebView.save_user_url_permissions=True before setting the on_navigation_starting handler. What do you think? Should the default be True or False?

freakboy3742 · 2025-06-12T22:29:40Z

We could make it configurable whether the user's decisions should be saved, for example by setting WebView.save_user_url_permissions=True before setting the on_navigation_starting handler. What do you think? Should the default be True or False?

I see no practical use for that API. A method that returns False for https://foobar.com will always return False for that URL. There's no need to cache it.

If the intention is to allow user interaction on specific URLs, and cache answers - that's a decision the developer can make if that feature makes sense to have in an app. If nothing else, any caching scheme like that would need to have stored user preferences, a user-clearable cache, and more - so having it baked into Toga seems like massive overreach.

…handler

t-arn · 2025-06-13T14:31:14Z

@freakboy3742 I refactored and simplified the Winforms code by using the cleanup method of wrapped_handler

freakboy3742

This looks a lot better. There's obviously still a lot of debug to clean up, and I've flagged one way to clean up the cleanup handler even more - but the bones of this are lot closer to something I can see being merged.

The one big outstanding question is the need for the staticProxy on WebView, and whether there's any way to make this opt-in if you want navigation callbacks.

freakboy3742 · 2025-06-14T09:29:12Z

core/src/toga/widgets/webview.py

+
+    def on_navigation_starting_callback(self, widget, result):
+        try:
+            url = widget._requested_url


I'm pretty sure this wouldn't be needed if this callback method was an inner method inside on_navigation_starting. That way, it could; be a closure over the url argument. See how Window.on_close is implemented - that inner cleanup method is a closure over handler.

t-arn · 2025-06-16T15:22:33Z

@freakboy3742 I defined on_navigation_starting cleanup method as an inner method, but the url parameter is always None inside cleanup. Is there something wrong with how I changed the code?

The webview._requested_url is still there and set, but not used anymore. I will remove it when the url parameter is working, but currently I don't see how to make it work without webview._requested_url

freakboy3742 · 2025-06-16T23:33:32Z

@freakboy3742 I defined on_navigation_starting cleanup method as an inner method, but the url parameter is always None inside cleanup. Is there something wrong with how I changed the code?

The webview._requested_url is still there and set, but not used anymore. I will remove it when the url parameter is working, but currently I don't see how to make it work without webview._requested_url

Ah - on closer inspection - the url argument to on_navigation_started will alway be None - because the method is a setter. It's not invoked when the navigation starts; it's invoked when the handler is installed - so url will always be None (and, in fact, there's no way to pass in anything to that argument at all).

So - I suspect what is needed here is a modification to wrapped_handler so that the cleanup method also accepts the *args and **kwargs passed to the event handler (in this case, url). AFAICT, all the existing uses of cleanup don't use any additional kwargs on their events - this would be the first usage on a handler that has arguments in addition to the widget.

t-arn added 4 commits May 13, 2025 07:34

* implented on_navigation_started for winforms

a476f73

* implented on_navigation_started for android * extended the webview example

* fixed some issues

23e2747

* added change note

4c6777d

* applied black

fixed pre-commit issue

4849755

freakboy3742 requested changes May 13, 2025

View reviewed changes

removed unnecessary set_on_navigation_starting() method

7f335d6

t-arn added 2 commits May 26, 2025 08:12

* removed unnecessary TogaNavigationEvent

a209b71

* added type declaration for handler * added WeakrefCallable wrapper

* windows implementation now supports synchronous and asynchronous on…

c6119ba

…_navigation_starting handlers

freakboy3742 requested changes Jun 12, 2025

View reviewed changes

refactored the code for Windows to use the cleanup method of wrapped_…

98ec9fd

…handler

freakboy3742 requested changes Jun 14, 2025

View reviewed changes

defined on_navigation_starting cleanup method as inner method

39af762

freakboy3742 mentioned this pull request Jun 18, 2025

External href links are death traps beeware/podium#36

Open

Uh oh!

WebView URL filtering #3442

Are you sure you want to change the base?

WebView URL filtering #3442

Uh oh!

Conversation

t-arn commented May 13, 2025

PR Checklist:

Uh oh!

freakboy3742 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

t-arn commented May 13, 2025

Uh oh!

freakboy3742 commented May 13, 2025

Uh oh!

t-arn commented Jun 11, 2025

Uh oh!

freakboy3742 left a comment

Choose a reason for hiding this comment

Uh oh!

t-arn commented Jun 12, 2025

Uh oh!

t-arn commented Jun 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

freakboy3742 commented Jun 12, 2025

Uh oh!

t-arn commented Jun 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

freakboy3742 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

t-arn commented Jun 16, 2025

Uh oh!

freakboy3742 commented Jun 16, 2025

Uh oh!

Uh oh!

t-arn commented Jun 12, 2025 •

edited

Loading

t-arn commented Jun 13, 2025 •

edited

Loading