From 63ab22f86633c88206b6a86ddde7ef5b23c190b4 Mon Sep 17 00:00:00 2001 From: abose Date: Sat, 24 Oct 2026 13:07:31 +0530 Subject: [PATCH] fix(windows): keep sandboxed iframes in-process so the markdown viewer loads WebView2 moves iframes sandboxed without allow-same-origin out of process when IsolateSandboxedIframes is on. wry 0.24 registers the phtauri filter without request source kinds, so the markdown viewer's scripts and styles bypass the protocol handler and the viewer never loads. Microsoft turns the feature off by server config today, but it is on for fresh profiles and can be re-enabled remotely at any time. Disable it for every window through WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS, appended to wry's defaults. Windows only; other platforms are unchanged. --- src-tauri/src/main.rs | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/src-tauri/src/main.rs b/src-tauri/src/main.rs index b18277f2..b8e75e61 100644 --- a/src-tauri/src/main.rs +++ b/src-tauri/src/main.rs @@ -866,6 +866,26 @@ fn main() { // fix that https://github.com/tauri-apps/fix-path-env-rs let _ = fix_path_env::fix(); + // WebView2 moves iframes sandboxed without allow-same-origin (the markdown viewer) out of process when + // IsolateSandboxedIframes is on. wry 0.24 registers the phtauri filter without request source kinds, so + // those frames' scripts/styles bypass the protocol handler and the viewer never loads. Microsoft currently + // turns the feature off by server config, but it is on for fresh profiles and can be re-enabled any time. + // An env var (appended to wry's own args) applies the same args to every window, as WebView2 requires. + // Note: while it is set, WebView2 skips its registry-based loader overrides for this app. + #[cfg(target_os = "windows")] + { + const WEBVIEW2_ARGS_ENV: &str = "WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS"; + // Only IsolateSandboxedIframes is new. The first three are wry's own defaults (Edge's text-selection + // "mini menu" for pages/PDFs and SmartScreen; see wry#535, tauri#1345). WebView2 merges repeated + // --disable-features lists, but they are repeated so they stay off even if a runtime ever stops merging. + let isolation_off = "--disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection,IsolateSandboxedIframes"; + let browser_args = match env::var(WEBVIEW2_ARGS_ENV) { + Ok(existing) if !existing.trim().is_empty() => format!("{} {}", existing, isolation_off), + _ => isolation_off.to_string(), + }; + env::set_var(WEBVIEW2_ARGS_ENV, browser_args); + } + tauri::Builder::default() .manage(Storage { map: Mutex::new(HashMap::new()),