[SOLVED] Selective treatment of resources

[sjehuda]

Good day, to one and all!

I am involved with a Python project called Blasta - An XMPP PubSub based annotation system.

blasta720p.mp4

Screenshots https://git.xmpp-it.net/sch/Blasta/src/branch/main/screenshot

The system is an annotation (also referred to as bibliography and bookmarks) management system.

I do not desire to open resources from within pywebview.

Which means that using the module webbrowser is more viable over pywebview, unless it is possible to regulate access.

import webbrowser
webbrowser.open('http://localhost:8000')

python blasta.py
python -m webbrowser -t 'http://localhost:8000'

Is it possible to block or treat differently to resources outside of specified hostnames?

[sjehuda]

I have found a solution which involves ECMAScript (i.e. JavaScript).

Python

import webview
import subprocess
import sys

class HtmlView:
    def __init__(self, url_instance):
        self.url_instance = url_instance

    def regulator(self, uri):
        # Check if the URL is not from url_instance
        if not uri.startswith(self.url_instance):
            try:
                # Open the link using xdg-open
                subprocess.run(['xdg-open', uri], check=True)
            except subprocess.CalledProcessError as e:
                print(f"Failed to open URL: {uri}. Error: {e}")
        else:
            # If it is from url_instance, just load it in the webview
            #webview.load_url(uri)
            #webview.evaluate(f"window.location.href = '{uri}';")
            webview.windows[0].load_url(uri)

    def setup(self):
        # Create a webview window
        window = webview.create_window('Blasta', self.url_instance)
        # Bind the link click event to the regulator function
        window.expose(self.regulator)

        # Start the webview application
        webview.start()

if __name__ == '__main__':
    if len(sys.argv) != 2:
        print('Usage: {} <URL_OF_A_BLASTA_INSTANCE>'.format(sys.argv[0]))
        sys.exit(1)

    url_instance = sys.argv[1]
    html_view = HtmlView(url_instance)
    html_view.setup()

ECMAScript

document.addEventListener('DOMContentLoaded', () => {
        
    // This function will be called when an anchor is clicked
    function regulator(event) {
        event.preventDefault(); // Prevent the default link behavior
        const url = this.href; // Get the URL from the clicked link
        
        // Call the exposed Python function
        window.pywebview.api.regulator(url)
            .catch(error => {
                console.error("Error calling regulator:", error);
            });
    }

    // Attach event listeners to all anchor elements
    document.querySelectorAll('a').forEach(element => {
        element.addEventListener('click', regulator);
    });
});

Is there a stronger solution which does not involve ECMAScript?

[r0x0r]

What is xdg open? What resources do you have in mind?

[sjehuda]

By resources I mean URIs (e.g. gemini:// xmpp:, irc:// etc.).

xdg-open is a software which handles filetypes and schemes for opening with default software.

[r0x0r]

I see.
Currently there is no support for intercepting requests, but it could be done. I have done some preliminary work on requests and responses in the headers branch, but it is nowhere to a working solution yet.
Feel free to contribute.

[sjehuda]

Thank you for your help at #1460 (comment)

This is the final code which defines the activity of pywebview to a single "origin".

Python

import webview
import subprocess
import sys

class HtmlView:
    def __init__(self, url_instance):
        self.url_instance = url_instance

    def regulator(self, uri):
        # Check if the URL is not from url_instance
        if not uri.startswith(self.url_instance):
            try:
                # Open the link using xdg-open
                subprocess.run(['xdg-open', uri], check=True)
            except subprocess.CalledProcessError as e:
                print(f"Failed to open URL: {uri}. Error: {e}")
        else:
            # If it is from url_instance, just load it in the webview
            #webview.load_url(uri)
            #webview.evaluate(f"window.location.href = '{uri}';")
            webview.windows[0].load_url(uri)

    def setup(self):
        # Create a webview window
        window = webview.create_window('Blasta', self.url_instance)
        # Bind the link click event to the regulator function
        window.expose(self.regulator)

        # Start the webview application
        webview.start()

if __name__ == '__main__':
    if len(sys.argv) != 2:
        print('Usage: {} <URL_OF_A_BLASTA_INSTANCE>'.format(sys.argv[0]))
        sys.exit(1)

    url_instance = sys.argv[1]
    html_view = HtmlView(url_instance)
    html_view.setup()

ECMAScript

document.addEventListener('DOMContentLoaded', () => {
    window.addEventListener('pywebviewready', () => {
        // Attach event listeners to all anchor elements
        document.querySelectorAll('a').forEach(element => {
            element.addEventListener('click', regulator);
        });
    });
});


// This function will be called when an anchor is clicked
function regulator(event) {
    event.preventDefault(); // Prevent the default link behavior
    const url = this.href; // Get the URL from the clicked link
    
    // Call the exposed Python function
    window.pywebview.api.regulator(url)
        .catch(error => {
            console.error("Error calling regulator:", error);
        });
}

Shall we add this as an example to the documentation?