inappwebview_script_guard 0.1.1 copy "inappwebview_script_guard: ^0.1.1" to clipboard
inappwebview_script_guard: ^0.1.1 copied to clipboard

Published 44 days ago
SDKFlutter
PlatformAndroidiOSmacOSwebWindows
→

Metadata

Detect silently-failed JavaScript injection in flutter_inappwebview: canary-verified script loading plus commit-time AST linting of embedded JS.

More...

0.1.1 - 2026-08-01 #

Docs-only release — no API or behavior changes.

Changed #

  • missing verdict guidance corrected. The docs sent every missing to "investigate the JS"; that is a dead end for the second cause class, a navigation wipe — the page navigated between the script running and the read-back (redirect, or a WebView session-restore committing its real document after an early onLoadStop), so the flag was written into a world the read-back never sees. Easy to hit with inject-at-onLoadStop when no second LoadStop follows. New README section documents both cause classes, their opposite corrective actions, and a bounded re-inject-once recovery recipe (generation guard incl. teardown, script-signals guard, missing-only, one attempt, contentWorld threaded through both calls). All missing-verdict doc surfaces aligned: verdict table, "The problem" failure classes, Quick-start switch comment, "When something fails", barrel-library summary, JsScript verdict list, and CanaryVerdict.missing / MissingResult dartdoc (the navigation cause is no longer labelled "script-side").

0.1.0 - 2026-07-29 #

Initial release.

Added #

  • JsScript — wrapper for literal JavaScript with a content-addressed load canary. withCanary preserves the script's bridge return value and writes a per-version flag iff the source ran to completion (the write is deliberately NOT in a finally — a bridge-swallowed throw must read back as missing, not loaded). Constructor-validated name, source (rejects whitespace/semicolon-only payloads), and configurable canaryPrefix; canaryFlagName is the single source of truth for the flag both sides use.
  • verifyCanary / injectAndVerifyCanary — read-back helpers returning the sealed CanaryResult hierarchy: loaded / missing (script-side) / injectThrew (bridge-side, exception + stack preserved, includes eval timeouts) / stale (cached older version) / malformed (flag clobbered). Configurable evalTimeout (default 10 s) bounds every bridge await; contentWorld threads to both inject and read-back.
  • package:inappwebview_script_guard/invariants.dart — commit-time AST linting (checkSource): the four rejected constructs (non-raw multi-line, multi-line interpolation, adjacent literals, literal + concatenation) plus the CHECK_JS_INVARIANTS_SKIP_FILE directive parser.
  • Executables — dart run inappwebview_script_guard:check_js_invariants (with --root <dir> for a configurable scripts root) and dart run inappwebview_script_guard:extract_js (raw-literal extraction for node --check).
  • example/hooks/ — copy-in pre-commit / check_js.sh / pre-push scripts implementing the proof-of-work gate (deliberately examples, not package API).

← Metadata

0
likes
150
points
13
downloads

Documentation

API reference

Publisher

unverified uploader

Weekly Downloads

Metadata

Detect silently-failed JavaScript injection in flutter_inappwebview: canary-verified script loading plus commit-time AST linting of embedded JS.

Repository (GitHub)
View/report issues

Topics

#webview #javascript #injection #observability

License

MIT (license)

Dependencies

analyzer, crypto, flutter, flutter_inappwebview

More

Packages that depend on inappwebview_script_guard

Back