Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Cancelling a script-initiated navigation in NavigationStarting commits chrome-error://chromewebdata/ instead of leaving the page intact

Aperta
  • Qualcosa non va?
#5,785 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
36/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
powershell
Ambito
desktop, security

Direzione di ricerca

The report names WebView2's NavigationStarting cancellation, Playwright's main-frame framenavigated observation, and a local page with meta-refresh, timer navigation, and location.replace cases. Start by reproducing those cases on the stated Windows 11 WebView2 runtime and compare the result with the documented Cancel behavior. Done means cancellation leaves the current page intact, reports OPERATION_CANCELED, and does not leave the refused URL in history.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Windows 11 · WebView2 runtime as shipped with the OS · observed 2026-10-18 (through tauri 2.12 / wry).

A host cancels top-level navigations to origins outside an allow-list (ICoreWebView2NavigationStartingEventArgs::put_Cancel(TRUE)).

  • A link the person clicks (user gesture): the page stays — as documented.
  • Script-initiated navigation without a user gesture — <meta http-equiv=refresh>, setTimeout(() => location.href = …),
    location.replace(…): the main frame commits chrome-error://chromewebdata/ (seen as a main-frame framenavigated
    in Playwright). The target server is never reached (no requestfailed, no response seen). The page's state is gone.
  • Same result whether or not the host also answers the document request in WebResourceRequested (403 or 204), and
    whether or not Cancel is set while the request is answered 204 — four variants measured.
  • GoBack() afterwards: for location.href it reloads the previous entry (in-memory state lost); for location.replace
    and meta refresh the history holds the cancelled target URL as an entry, so going back navigates to the very URL the
    host refused.

Expected (docs for Cancel: "the navigation is not longer present and the content of the current page is intact"):
NavigationCompleted with WebErrorStatus = OPERATION_CANCELED, no error page, current page intact.

Why it matters: a host that shows untrusted content and locks a window to its origins can be pushed onto an error page —
losing what the person typed — just by the page trying to leave, and the history keeps the refused URL.

Repro: a local page with three buttons (meta refresh · timer location.href · location.replace) to an origin outside
the allow-list; the host cancels in NavigationStarting; record main-frame navigations and whether the target server was reached (never).

Lingua principale
PowerShell
Stelle
526
Fork
68
Merge medio
15g 5h
PR unite (30g)
1

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di MicrosoftEdge/WebView2Feedback

Tutte le issue di MicrosoftEdge/WebView2Feedback

Issue simili

Altre issue su Desktop Dev

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.