Skip to content

[WebDriver BiDi] enable and disable scripting via BiDi #11441

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sadym-chromium wants to merge 11 commits into
base: main
Choose a base branch
from
+40 −20
Open

[WebDriver BiDi] enable and disable scripting via BiDi #11441

Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
08b9d18
add a way to force run script when "scripting is disabled"
sadym-chromium Jul 8, 2025
5ab5058
fix boolean
sadym-chromium Jul 8, 2025
da9aacb
Rely on "WebDriver BiDi scripting is enabled" hook
sadym-chromium Jul 23, 2025
d000f00
Allow for `HostEnqueueFinalizationRegistryCleanupJob` and `HostEnqueu…
sadym-chromium Aug 21, 2025
6303818
Revert "Allow for `HostEnqueueFinalizationRegistryCleanupJob` and `Ho…
sadym-chromium Aug 22, 2025
ede50a4
add note about `bypassDisabledScripting`
sadym-chromium Oct 15, 2025
f12e345
move the check "if scripting is disabled" from "get the current value…
sadym-chromium Oct 17, 2025
06fd207
remove the step "Check if we can run script" from "8.1.6.6.2 HostEnqu…
sadym-chromium Oct 17, 2025
30f2432
remove "check if we can run script" from "8.1.6.6.4 HostEnqueuePromis…
sadym-chromium Oct 17, 2025
a358cad
extend "scripting is enabled" to all platform objects
sadym-chromium Oct 21, 2025
8e25e3f
editorial
sadym-chromium Oct 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 40 additions & 20 deletions source
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4700,6 +4700,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
<li><dfn data-x-href="https://w3c.github.io/webdriver-bidi/#webdriver-bidi-user-prompt-opened">WebDriver BiDi user prompt opened</dfn></li>
<li><dfn data-x-href="https://w3c.github.io/webdriver-bidi/#webdriver-bidi-file-dialog-opened">WebDriver BiDi file dialog opened</dfn></li>
<li><dfn data-x-href="https://w3c.github.io/webdriver-bidi/#webdriver-bidi-emulated-language">WebDriver BiDi emulated language</dfn></li>
<li><dfn data-x-href="https://w3c.github.io/webdriver-bidi/#webdriver-bidi-scripting-is-enabled">WebDriver BiDi scripting is enabled</dfn></li>
</ul>
</dd>

Expand Down Expand Up @@ -115982,6 +115983,9 @@ document.querySelector("button").addEventListener("click", bound);
<span data-x="concept-document-window">associated <code>Document</code></span>'s <span>active
sandboxing flag set</span> does not have its <span>sandboxed scripts browsing context flag</span>
set.</li>

<li id="WebDriverBiDiScriptingIsEnabled">The result of <span>WebDriver BiDi scripting is
enabled</span> with <var>settings</var> is true.</li>
</ul>
</div>

Expand All @@ -115995,17 +115999,28 @@ document.querySelector("button").addEventListener("click", bound);
<hr>

<div algorithm>
<p><dfn data-x="concept-n-script">Scripting is enabled</dfn> for a node <var>node</var> if
<var>node</var>'s <span>node document</span>'s <span data-x="concept-document-bc">browsing
context</span> is non-null, and <span data-x="concept-environment-script">scripting is
enabled</span> for <var>node</var>'s <span>relevant settings object</span>.</p>
<p><dfn data-x="concept-n-noscript">Scripting is disabled</dfn> for a
<span>platform object</span> <var>object</var> if any of the following are true:</p>

<ul>
<li><p><span data-x="concept-environment-noscript">Scripting is disabled</span> for
<var>object</var>'s <span>relevant settings object</span>.</p></li>

<li><p>The <var>object</var> implements <code>Node</code>, and <var>object</var>'s
<span>node document</span>'s <span data-x="concept-document-bc">browsing context</span> is
null.</p></li>

<li><p>The <var>object</var> implements <code>Window</code> and <var>object</var>'s <span
data-x="concept-document-window">associated <code>Document</code></span>'s <span
data-x="concept-document-bc">browsing context</span> is null.</p></li>
</ul>
</div>

<p><dfn data-x="concept-n-noscript">Scripting is disabled</dfn> for a node when scripting is not
<span data-x="concept-n-script">enabled</span>, i.e., when its <span>node document</span>'s <span
data-x="concept-document-bc">browsing context</span> is null or when <span
data-x="concept-environment-noscript">scripting is disabled</span> for its <span>relevant settings
object</span>.</p>
<div algorithm>
<p><dfn data-x="concept-n-script">Scripting is enabled</dfn> for a <span>platform object</span>
<var>object</var>, when <var>object</var>'s scripting is not <span
data-x="concept-n-noscript">disabled</span>.</p>
</div>

<h5>Secure contexts</h5>

Expand Down Expand Up @@ -117223,8 +117238,15 @@ document.querySelector("button").addEventListener("click", bound);
<p>To <dfn data-x="creating a classic script">create a classic script</dfn>, given a
<span>string</span> <var>source</var>, an <span>environment settings object</span>
<var>settings</var>, a <span>URL</span> <var>baseURL</var>, a <span>script fetch options</span>
<var>options</var>, an optional boolean <var>mutedErrors</var> (default false), and an optional
<span>URL</span>-or-null <var>sourceURLForWindowScripts</var> (default null):</p>
<var>options</var>, an optional boolean <var>mutedErrors</var> (default false), an optional
<span>URL</span>-or-null <var>sourceURLForWindowScripts</var> (default null) and an optional
boolean <var>bypassDisabledScripting</var> (default false):</p>

<p class="note">The <var>bypassDisabledScripting</var> parameter is intended to be used for
running scripts even if <span data-x="concept-environment-noscript">scripting is disabled</span>.
This is required for some automation scenarios, e.g. for WebDriver BiDi command <a
href="https://w3c.github.io/webdriver-bidi/#commands-scriptevaluate">"script.evaluate"</a>.
</p>

<ol>
<li>
Expand All @@ -117238,7 +117260,8 @@ document.querySelector("button").addEventListener("click", bound);
</li>

<li><p>If <span data-x="concept-environment-noscript">scripting is disabled</span> for
<var>settings</var>, then set <var>source</var> to the empty string.</p></li>
<var>settings</var> and <var>bypassDisabledScripting</var> is false, then set
<var>source</var> to the empty string.</p></li>

<li><p>Let <var>script</var> be a new <span>classic script</span> that this algorithm will
subsequently initialize.</p></li>
Expand Down Expand Up @@ -119806,9 +119829,6 @@ dictionary <dfn dictionary>PromiseRejectionEventInit</dfn> : <span>EventInit</sp
<var>finalizationRegistry</var>.[[CleanupCallback]].[[Callback]].[[Realm]]'s <span
data-x="concept-realm-settings-object">environment settings object</span>.</p></li>

<li><p><span>Check if we can run script</span> with <var>entry</var>. If this returns "do not
run", then return.</p></li>

<li>
<p><span>Prepare to run script</span> with <var>entry</var>.</p>

Expand Down Expand Up @@ -119890,9 +119910,6 @@ dictionary <dfn dictionary>PromiseRejectionEventInit</dfn> : <span>EventInit</sp
<p><span>Queue a microtask</span> to perform the following steps:</p>

<ol>
<li><p>If <var>job settings</var> is not null, then <span>check if we can run script</span>
with <var>job settings</var>. If this returns "do not run" then return.</p></li>

<li>
<p>If <var>job settings</var> is not null, then <span>prepare to run script</span> with
<var>job settings</var>.</p>
Expand Down Expand Up @@ -122256,6 +122273,9 @@ import "https://example.com/foo/../module2.mjs";</code></pre>
<code>Event</code> object <var>event</var> is as follows:</p>

<ol>
<li><p>If <span data-x="concept-n-noscript">scripting is disabled</span> for
<var>eventTarget</var>, then return.</p></li>

<li><p>Let <var>callback</var> be the result of <span>getting the current value of the event
handler</span> given <var>eventTarget</var> and <var>name</var>.</p></li>

Expand Down Expand Up @@ -122450,8 +122470,8 @@ typedef <span>OnBeforeUnloadEventHandlerNonNull</span>? <dfn typedef>OnBeforeUnl
<var>element</var> be null, and <var>document</var> be <var>eventTarget</var>'s <span
data-x="concept-document-window">associated <code>Document</code></span>.</p></li>

<li><p>If <span data-x="concept-n-noscript">scripting is disabled</span> for
<var>document</var>, then return null.</p></li>
<li><p>If <var>document</var>'s <span>active sandboxing flag set</span> has its
Copy link
Contributor Author

@sadym-chromium sadym-chromium Oct 21, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The "sandboxed scripts browsing context flag" check used to be a part of the "Scripting is enabled". Now as the "Scripting is enabled" is removed, we still don't want to allow for sandboxed scripts to have access to the event handlers, so check "sandboxed scripts browsing context flag" here.

Copy link
Member

@foolip foolip Oct 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suspect that the sandbox flag check isn't needed for the same reason it could be removed from FinalizationRegistry and microtasks above. For <iframe sandbox> without the "allow-scripts" flag, no scripts can run in the first place.

It's possible I don't understand sandboxing, but we should probably do the same thing in all three of these cases.

Copy link
Member

@zcorpan zcorpan Nov 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Other documents can still peek into the sandboxed iframe, if allow-same-origin is used. https://software.hixie.ch/utilities/js/live-dom-viewer/saved/14324

But this is also relevant for BC-less documents, e.g. a template element's template contents. Right?

<span>sandboxed scripts browsing context flag</span> set, return null.</p></li>

<li><p>Let <var>body</var> be the uncompiled script body in <var>eventHandler</var>'s <span
data-x="event handler value">value</span>.</p></li>
Expand Down