News for hackers. Stuff that matters.
Re:See what JavaScript commands get injected through an in-a... by hn_throwaway_99 on Thursday August 18, 2022 @11:20PM (#32517308)
I highly doubt this will happen. There are a ton of apps that use things like Cordova or Capacitor (usually for cross-platform purposes).

What I could see them doing is making apps declare URLs that they need access to. Basically, you get full functionality on declared URLs, but if you are just using WebView for a "generic" in-app browser you lose the ability to inspect random pages.

Re:See what JavaScript commands get injected through an in-a... by kitsunesoba on Thursday August 18, 2022 @11:36PM (#32517377)
> What I could see them doing is making apps declare URLs that they need access to. Basically, you get full functionality on declared URLs, but if you are just using WebView for a "generic" in-app browser you lose the ability to inspect random pages.

This is exactly what I'm expecting, because that's how they've handled other similar restrictions. Becoming a full on web browser with the iOS 14 web browser entitlement will probably be the only way to not be bound to a list of URLs, and they don't hand that entitlement out willy nilly.

Re:See what JavaScript commands get injected through an in-a... by manmal on Saturday August 20, 2022 @01:48AM (#32529489)
The mechanism you are describing is already implemented and advertised: https://webkit.org/blog/10882/app-bound-domains/

Apple „just“ need to enforce it.

Re:See what JavaScript commands get injected through an in-a... by rawling on Friday August 19, 2022 @11:14AM (#32522017)
Couldn't you just proxy everything through a host you own?