Skip to content

Commit 408fe58

Browse files
Navdeep-ssNavdeep-ss
authored
Refactor allowlist configuration for WebView2 profile
1 parent 6e7afcc commit 408fe58

File tree

1 file changed

+75
-86
lines changed

1 file changed

+75
-86
lines changed

‎specs/SensitivityLabel.md‎

Lines changed: 75 additions & 86 deletions
Original file line numberDiff line numberDiff line change
@@ -40,59 +40,37 @@ label functionality on trusted domains.
4040
```cpp
4141
void ConfigureAllowlist()
4242
{
43-
// Get the WebView2 profile
4443
wil::com_ptr<ICoreWebView2Profile> profile;
4544
CHECK_FAILURE(m_webView->get_Profile(&profile));
4645

4746
auto profile9 = profile.try_query<ICoreWebView2Profile9>();
4847
if (profile9) {
49-
// Create allow list with trusted URLs
50-
std::vector<std::wstring> allowlist = {
48+
LPCWSTR allowlist[] = {
5149
L"https://intranet.company.com/*",
5250
L"https://*.company.com/*",
5351
L"https://trusted-partner.com/*"
5452
};
5553

56-
// Convert to LPCWSTR array for COM interface
57-
std::vector<LPCWSTR> items;
58-
for (const auto& url : allowlist) {
59-
items.push_back(url.c_str());
60-
}
61-
62-
// Get environment to create string collection
63-
wil::com_ptr<ICoreWebView2Environment> environment;
64-
CHECK_FAILURE(m_webView->get_Environment(&environment));
65-
66-
auto environment16 = environment.try_query<ICoreWebView2Environment16>();
67-
if (environment16) {
68-
wil::com_ptr<ICoreWebView2StringCollection> stringCollection;
69-
CHECK_FAILURE(environment16->CreateStringCollection(
70-
static_cast<UINT32>(items.size()),
71-
items.data(),
72-
&stringCollection));
73-
74-
// Apply the allow list
75-
CHECK_FAILURE(profile9->put_PageInteractionRestrictionManagerAllowlist(
76-
stringCollection.get()));
77-
}
54+
CHECK_FAILURE(profile9->SetPageInteractionRestrictionManagerAllowlist(
55+
static_cast<UINT32>(std::size(allowlist)),
56+
allowlist));
7857
}
7958
}
59+
60+
8061
```
81-
### .NET/WinRT
82-
```c#
83-
// Configure allowlist for trusted company URLs
62+
### .NET/WinRT Sample
63+
```csharp
64+
var profile = webView2.CoreWebView2.Profile;
65+
8466
var allowlist = new List<string>
8567
{
8668
"https://intranet.company.com/*",
87-
"https://*.company.com/*", // Wildcard for all company subdomains
88-
"https://trusted-partner.com/*",
89-
"https://secure.vendor.net/*"
69+
"https://*.company.com/*",
70+
"https://trusted-partner.com/*"
9071
};
9172

92-
// Set the allowlist on the profile
93-
webView2Control.CoreWebView2.Profile.PageInteractionRestrictionManagerAllowlist =
94-
allowlist;
95-
73+
profile.PageInteractionRestrictionManagerAllowlist = allowlist;
9674
```
9775

9876

@@ -224,64 +202,75 @@ void RegisterForSensitivityLabelChange()
224202
### C++
225203

226204
```
227-
[uuid(764ffcc6-b341-5307-8ca4-58face289427), object, pointer_default(unique)]
228-
interface ICoreWebView2Environment16 : IUnknown {
229-
/// Create an ICoreWebView2StringCollection from an array of strings.
230-
/// This provides a convenient way to create string collections for use
231-
/// with WebView2 APIs that require ICoreWebView2StringCollection objects.
232-
HRESULT CreateStringCollection(
233-
[in] UINT32 count,
234-
[in] LPCWSTR* items,
235-
[out, retval] ICoreWebView2StringCollection** value);
236-
}
237-
```
238-
239-
```
240-
[uuid(7b0ade48-e6a9-5038-b7f7-496ad426d907), object, pointer_default(unique)]
205+
/// This is the ICoreWebView2Profile interface for PageInteractionRestrictionManager allowlist management.
206+
[uuid(a15dadcf-8924-54c2-9624-1b765abdb796), object, pointer_default(unique)]
241207
interface ICoreWebView2Profile9 : IUnknown {
242-
/// Gets the `PageInteractionRestrictionManagerAllowlist` property.
243-
[propget] HRESULT PageInteractionRestrictionManagerAllowlist(
244-
[out, retval] ICoreWebView2StringCollection** value);
245-
246-
/// Controls which URLs are allowed to access the PageInteractionRestrictionManager API.
247-
///
248-
/// This property manages an allowlist of URLs that determines which web pages
249-
/// can use the PageInteractionRestrictionManager API. Only URLs that match
250-
/// entries in this allowlist (either exact matches or wildcard patterns) will
251-
/// have access to the PageInteractionRestrictionManager functionality.
252-
///
253-
/// The allowlist accepts both exact URL strings and wildcard patterns.
254-
/// For wildcard patterns, `*` matches zero or more characters.
255-
///
256-
/// URL matching occurs after the URI has been normalized, any URI fragment
257-
/// has been removed, and non-ASCII hostnames have been converted to punycode.
258-
///
259-
/// | URL Filter | Page URL | Access Granted | Notes |
260-
/// | ---- | ---- | ---- | ---- |
261-
/// | `https://example.com` | `https://example.com/page` | No | Exact match required |
262-
/// | `https://example.com` | `https://example.com` | No | The URI is normalized before filter matching so the actual URI used for comparison is https://example.com/ |
263-
/// | `https://example.com/*` | `https://example.com/page` | Yes | Wildcard matches any path |
264-
/// | `*://example.com/*` | `https://example.com/page` | Yes | Wildcard matches any scheme |
265-
/// | `*` | `https://any-site.com` | Yes | Wildcard matches all URLs |
266-
/// Sets the `PageInteractionRestrictionManagerAllowlist` property.
267-
[propput] HRESULT PageInteractionRestrictionManagerAllowlist(
268-
[in] ICoreWebView2StringCollection* value);
208+
/// Gets the allowlist of URLs that are allowed to access the PageInteractionRestrictionManager API.
209+
///
210+
/// This method retrieves the current allowlist configured for this profile.
211+
/// The returned allowlist contains URL patterns that determine which web pages
212+
/// can access the PageInteractionRestrictionManager functionality.
213+
///
214+
/// The caller must free the returned string array with `CoTaskMemFree`.
215+
HRESULT GetPageInteractionRestrictionManagerAllowlist(
216+
[out] UINT32* allowlistCount,
217+
[out] LPWSTR** allowlist
218+
);
219+
220+
/// Sets the allowlist of URLs that are allowed to access the PageInteractionRestrictionManager API.
221+
///
222+
/// This method configures an allowlist of URLs that determines which web pages
223+
/// can use the PageInteractionRestrictionManager API. Only URLs that match
224+
/// entries in this allowlist (either exact matches or wildcard patterns) will
225+
/// have access to the PageInteractionRestrictionManager functionality.
226+
///
227+
/// URL Matching Logic:
228+
/// The allowlist accepts both exact URL strings and wildcard patterns.
229+
/// For wildcard patterns, `*` matches zero or more characters.
230+
///
231+
/// | URL Filter | Page URL | Access Granted | Notes |
232+
/// | ---- | ---- | ---- | ---- |
233+
/// | `https://example.com` | `https://example.com/page` | No | Exact match required |
234+
/// | `https://example.com` | `https://example.com` | No | The URI is normalized before filter matching so the actual URI used for comparison is https://example.com/ |
235+
/// | `https://example.com/*` | `https://example.com/page` | Yes | Wildcard matches any path |
236+
/// | `*://example.com/*` | `https://example.com/page` | Yes | Wildcard matches any scheme |
237+
/// | `*` | `https://any-site.com` | Yes | Wildcard matches all URLs |
238+
///
239+
/// Setting the allowlist to an empty array will disable access to the
240+
/// PageInteractionRestrictionManager API for all pages.
241+
///
242+
/// Changes take effect immediately for all WebView2 instances using this profile.
243+
/// The allowlist is persisted across sessions.
244+
HRESULT SetPageInteractionRestrictionManagerAllowlist(
245+
[in] UINT32 allowlistCount,
246+
[in] LPCWSTR* allowlist
247+
);
269248
}
270249
```
271250
### .NET/WinRT
272-
```c#
251+
```idl
273252
namespace Microsoft.Web.WebView2.Core
274253
{
275-
public partial class CoreWebView2Profile
254+
runtimeclass CoreWebView2Profile
276255
{
277-
/// <summary>
278-
/// Gets or sets the PageInteractionRestrictionManager allowlist.
279-
/// </summary>
280-
/// <value>A collection of URL patterns that are exempt from page
281-
/// interaction restrictions. Pass an empty collection to clear the
282-
/// allowlist.</value>
283-
public IReadOnlyList<string> PageInteractionRestrictionManagerAllowlist
284-
{ get; set; }
256+
/// Controls which URLs are allowed to access the PageInteractionRestrictionManager API.
257+
///
258+
/// This property manages an allowlist of URLs that determines which web pages
259+
/// can use the PageInteractionRestrictionManager API. Only URLs that match
260+
/// entries in this allowlist (either exact matches or wildcard patterns) will
261+
/// have access to the PageInteractionRestrictionManager functionality.
262+
///
263+
/// The allowlist accepts both exact URL strings and wildcard patterns.
264+
/// For wildcard patterns, `*` matches zero or more characters.
265+
///
266+
/// | URL Filter | Page URL | Access Granted | Notes |
267+
/// | ---- | ---- | ---- | ---- |
268+
/// | `https://example.com` | `https://example.com/page` | No | Exact match required |
269+
/// | `https://example.com` | `https://example.com` | No | The URI is normalized before filter matching so the actual URI used for comparison is https://example.com/ |
270+
/// | `https://example.com/*` | `https://example.com/page` | Yes | Wildcard matches any path |
271+
/// | `*://example.com/*` | `https://example.com/page` | Yes | Wildcard matches any scheme |
272+
/// | `*` | `https://any-site.com` | Yes | Wildcard matches all URLs |
273+
IVectorView<String> PageInteractionRestrictionManagerAllowlist { get; set; };
285274
}
286275
}
287276
```

0 commit comments

Comments
 (0)