feat(paywalls): isolate web_view content with a fixed CSP (PWENG-98)#3652
Draft
alexrepty wants to merge 1 commit into
Draft
feat(paywalls): isolate web_view content with a fixed CSP (PWENG-98)#3652alexrepty wants to merge 1 commit into
alexrepty wants to merge 1 commit into
Conversation
2 tasks
Contributor
Author
|
Warning This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
This stack of pull requests is managed by Graphite. Learn more about stacking. |
This was referenced Jun 25, 2026
This was referenced Jun 25, 2026
alexrepty
force-pushed
the
alexrepty/paywalls-web-view-csp
branch
from
66c0ccb to
a3e9e1a
Compare
alexrepty
force-pushed
the
alexrepty/paywalls-web-view-rendering
branch
from
61039df to
38f5302
Compare
This was referenced Jun 26, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## alexrepty/paywalls-web-view-rendering #3652 +/- ##
======================================================================
Coverage 80.48% 80.48%
======================================================================
Files 404 404
Lines 16728 16728
Branches 2389 2389
======================================================================
Hits 13464 13464
Misses 2322 2322
Partials 942 942 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
alexrepty
force-pushed
the
alexrepty/paywalls-web-view-rendering
branch
from
38f5302 to
6c73e7c
Compare
alexrepty
force-pushed
the
alexrepty/paywalls-web-view-csp
branch
from
a3e9e1a to
0dffacc
Compare
alexrepty
force-pushed
the
alexrepty/paywalls-web-view-rendering
branch
from
6c73e7c to
71e76e1
Compare
alexrepty
force-pushed
the
alexrepty/paywalls-web-view-csp
branch
from
0dffacc to
353f584
Compare
alexrepty
changed the title
alexrepty
force-pushed
the
alexrepty/paywalls-web-view-csp
branch
from
353f584 to
df0ae01
Compare
alexrepty
force-pushed
the
alexrepty/paywalls-web-view-rendering
branch
2 times, most recently
from
88cb259 to
fd0371b
Compare
alexrepty
force-pushed
the
alexrepty/paywalls-web-view-csp
branch
from
df0ae01 to
22be911
Compare
alexrepty
force-pushed
the
alexrepty/paywalls-web-view-csp
branch
from
22be911 to
9cff885
Compare
alexrepty
force-pushed
the
alexrepty/paywalls-web-view-rendering
branch
from
fd0371b to
bc0f4e0
Compare
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 9cff885. Configure here.
| meta.setAttribute('http-equiv', 'Content-Security-Policy'); | ||
| meta.setAttribute('content', "${policy.escapeForMetaContent()}"); | ||
| var head = document.head || document.getElementsByTagName('head')[0] || document.documentElement; | ||
| if (head.firstChild) { head.insertBefore(meta, head.firstChild); } else { head.appendChild(meta); } |
Contributor
There was a problem hiding this comment.
CSP meta placed outside head
High Severity
When document.head is not yet available, the injection script falls back to document.documentElement and inserts the CSP meta as a direct child of html. CSP meta tags are only applied when they live inside head, so this placement is ignored and isolation does not take effect. Setting window.__revenueCatCspInstalled on that failed attempt can also block later injections on the same navigation.
Reviewed by Cursor Bugbot for commit 9cff885. Configure here.
alexrepty
force-pushed
the
alexrepty/paywalls-web-view-csp
branch
from
9cff885 to
9349754
Compare
📸 Snapshot Test3 modified, 590 unchanged
🛸 Powered by Emerge Tools |
AlvaroBrey
force-pushed
the
alexrepty/paywalls-web-view-csp
branch
from
9349754 to
428d1c2
Compare
AlvaroBrey
force-pushed
the
alexrepty/paywalls-web-view-rendering
branch
from
bc0f4e0 to
2634d3b
Compare
When a `web_view` declares a `protocol_version`, the renderer injects a fixed Content-Security-Policy meta tag at document start to isolate the content from external sources: only same-origin images/scripts/fonts are allowed, `data:` references for images/fonts are blocked, and XHR/fetch/WebSocket are disallowed (`connect-src 'none'`). Geolocation is disabled. The bundle must be fully self-contained. Recommended labels: pr:other, pr:RevenueCatUI, feat:Paywalls_V2
AlvaroBrey
force-pushed
the
alexrepty/paywalls-web-view-csp
branch
from
428d1c2 to
ef64abf
Compare
AlvaroBrey
force-pushed
the
alexrepty/paywalls-web-view-rendering
branch
from
2634d3b to
4fb9844
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Checklist
purchases-iosand hybridsMotivation
A hosted web bundle rendered inside the paywall must be isolated from external sources. For v1 the bundle is required to be fully self-contained, so the SDK enforces this rather than relying on the bundle to behave.
Part of PWENG-98.
Description
web_viewdeclares aprotocol_version, injects a fixed Content-Security-Policy<meta>at document start: same-origin scripts/images/fonts only, nodata:for images/fonts, and no XHR/fetch/WebSocket (connect-src 'none'). Geolocation is disabled.WebViewContentSecurityPolicyisinternalto:ui:revenuecatui(its only consumer is the renderer).WebViewContentSecurityPolicyTestandStyleFactoryTests.iOS parity: mirrors
purchases-ios(web-view-bridge-wiring).Stack (merge bottom-up): schema → rendering → CSP → value types → message model → variables provider → JS bridge → wiring.
Note
Medium Risk
Security-sensitive WebView behavior changes for protocol_version paywalls; mis-timed CSP injection or overly strict connect-src could break self-contained bundles that rely on same-origin fetches.
Overview
Paywalls V2
web_viewcomponents that declareprotocol_versionare now treated as v1 isolated bundles: the SDK enforces a fixed Content-Security-Policy instead of trusting the hosted page alone.protocol_versionflows from the paywall schema intoWebViewComponentStyleviaStyleFactory. Legacy configs without it keepprotocolVersion == nulland no CSP (unchanged behavior).The renderer turns on isolation when
protocolVersion != null: geolocation is disabled on theWebView, andonPageStartedinjects an idempotent script that inserts a<meta http-equiv="Content-Security-Policy">at the front of<head>before page scripts run. Policy string lives inWebViewContentSecurityPolicy(same-origindefault-src, scripts/styles with inline allowances for self-contained bundles,img-src/font-srcwithdata:,connect-src 'self'only).Unit tests cover policy shape, meta injection/escaping, and
protocolVersionmapping inStyleFactoryTests.Reviewed by Cursor Bugbot for commit ef64abf. Bugbot is set up for automated code reviews on this repo. Configure here.