# [11.0.0](https://github.com/react-native-community/react-native-webview/compare/v10.10.2...v11.0.0) (2020-11-24)
### Features
* **android:** Introduce setSupportMultipleWindows to mitigate CVE-2020-6506 ([#1747](https://github.com/react-native-community/react-native-webview/issues/1747) by [@mrcoinbase](https://github.com/mrcoinbase) and [@kelset](https://github.com/kelset) -- THANK YOU!) ([194c6a2](194c6a2335))
### BREAKING CHANGES
* **android:** This release introduces the `setSupportMultipleWindows` prop for Android. This sets the underlying Android WebView setting `setSupportMultipleWindows`. This prop defaults to `true` (previously `false`), and serves to mitigate the security advisory [CVE-2020-6506](https://github.com/react-native-webview/react-native-webview/security/advisories/GHSA-36j3-xxf7-4pqg).
The primary way this new behavior changes existing React Native WebView implementations on Android is that links that open in new tabs/windows (such as `<a target="_blank">`) will now prompt to open in the system browser, rather than re-using the current WebView.
If this behavior is not desirable, you can set this new prop to `false`, but be aware that this exposes your app to the security vulnerability listed above. Make sure you have read and understand the whole advisory and relevant links.
iOS & Windows are unaffected.
```jsx
<WebView
// ...
setSupportMultipleWindows={true} // default: true
/>
```
Thanks to @mrcoinbase, @kelset, and @Titozzz for their work on this.
BREAKING CHANGE:
This release introduces the `setSupportMultipleWindows` prop for Android. This sets the underlying Android WebView setting `setSupportMultipleWindows`. This prop defaults to `true` (previously `false`), and serves to mitigate the security advisory [CVE-2020-6506](https://github.com/react-native-webview/react-native-webview/security/advisories/GHSA-36j3-xxf7-4pqg).
The primary way this new behavior changes existing React Native WebView implementations on Android is that links that open in new tabs/windows (such as `<a target="_blank">`) will now prompt to open in the system browser, rather than re-using the current WebView.
If this behavior is not desirable, you can set this new prop to `false`, but be aware that this exposes your app to the security vulnerability listed above. Make sure you have read and understand the whole advisory and relevant links.
iOS & Windows are unaffected.
```jsx
<WebView
// ...
setSupportMultipleWindows={true} // default: true
/>
```
Thanks to @mrcoinbase, @kelset, and @Titozzz for their work on this.
* Manage to build webview using Visual Studio
* WebView in content of UserControl
* Destructor not needed
* Example app tested
* Add messagingEnabled prop
* WebViewBridge
* Message posting
* Store bridge as instance variable
* Use bridge if messagingEnabled
* Free event delegate
* PostMessage api uses string message
* script.notify() usage removed
* Debug log removed
* Bridge reference added
* Base for web allowed object implemented c++/winrt
* Bribge works
* "Microsoft.Windows.CppWinRT" version="2.0.200729.8"
* Update bridge implementation
* version changes
* Reference fix
* WebView prj builds
* yarn lock update
* Platfrom version update
* NuGet package reference updated
* Messaging test added into example app
* Typo fix
* try_as() to as() calls
* WebView.PostMessage() not supported anymore, use injectJavaScript
* Fix WebView.postMessage to work using injectJavascript
* Eval postMessage fix
* postMessage via injectJavascript
* Example fixed to handle postMessage call
* Update SSL error handling for Android WebView
Update SSL error handling to call onReceivedError() only on top-level navigations. This prevents iframes and other subresources from causing user-visible SSL error messages. The desired behavior is only to have top-level navigations show user-visible error messages. All other requests should be cancelled automatically with no user-visible error message.
* Update RNCWebViewManager.java
Clarify comments and add warning on blocked subresource
Co-authored-by: Thibault Malbranche <thibault.malbranche@epitech.eu>
* Update RNCWebView.h
Limit methods relating to pull to refresh to only iOS
* Update RNCWebView.m
Block methods relating to pull to refresh when the target is macOS as macOS does not have the UIRefreshControl
Co-authored-by: Eloy Durán <eloy.de.enige@gmail.com>
This solves a class of issues when the WebView loses "context"
that a subsequent page load is the same as what was attempted
to be loaded previously. This solves a bug where a HTTP redirect
in combination with history manipulations causes a user to be
stuck and prevented from going back. Since WebView requests are
allowed to happen normally, debugging the WebView and tracking
redirects and page load initiators is more accurate and easier.
This will also bypass bridge latency and provide a faster navigation.
To do this, we must lock in the shouldOverrideUrlLoading callback
and send an event to JS. Currently, this callback is ran on
the main UI thread, of which we have no control over. This is
problematic as using the bridge in most ways seems to require
the main UI thread, which will cause a deadlock. However, using
BatchedBridge for Java->JS and a synchronous method for JS->Java
doesn't cause any problems. Additionally, it's been designed so
that if WebView suddenly runs the callback on a different thread
allowing for concurrency, it will continue to work.
ContentInsetAdjustmentBehavior was originally added as a string union type. The change to support MacOS replaced it with an enum, which was a bit of a breaking change, especially as the enum was not exported from the main library. Exporting the enum would probably also help, but since this was the only enum and the rest of react-native-webview uses string unions instead, it seems best to revert it to a string union.
Co-authored-by: Jamon Holmgren <jamonholmgren@gmail.com>
* Add pull to refresh support for iOS
* Add pull to refresh control removal from WebView
* Add the type and reference description about pull to refresh
* Set bounces to true when enabling pull to refresh, add references
* Add the back to props anchor to pullToRefreshEnabled
* Add isTopFrame to shouldStartLoadForRequest on iOS
onLoadingStart is not raised for inner frames, but onShouldStartLoadWithRequest still is. This keeps that behavior but adds isTopFrame to onShouldStartLoadWithRequest so that apps can perform their own filtering if desired.
* Update docs
Co-authored-by: Jamon Holmgren <jamonholmgren@gmail.com>
This allows overriding iPadOS 13's desktop-class browsing to load mobile content instead of desktop content.
Co-authored-by: Jamon Holmgren <jamonholmgren@gmail.com>
Co-authored-by: Jason Kelly <jason.kelly@isobar.com>
Co-authored-by: Jamon Holmgren <jamonholmgren@gmail.com>
Co-authored-by: Jason Safaiyeh <safaiyeh@protonmail.com>
* fix(iOS): Consider UIImagePickerController or similar controllers that are no longer beingPresented when acquiring the TopViewController; this prevents the crash of throwing an alert on a ViewController which is no longer in the window hierarchy
* fix(iOS): correcting import to src from lib
* fix(iOS): reverting import modification
Co-authored-by: Thibault Malbranche <thibault.malbranche@epitech.eu>
semantic-release-bot
Lorenzo Sciandra
Harsh Chokshi
Chiara Mooney
Tero Paananen
Alesandro Ortiz
Christopher Pfohl
Brandon Lax
Matteo Pagani
Radek Czemerys
Jamon Holmgren
Kesha Antonov
Dominic Lee
iou90
Mathieu Bruguier
Daniel Vicory
Jason Safaiyeh
Caleb Clarke
cristianoccazinsp
Leonardo Russo
oliviacaraiman
Sergei Butko
Bryan Stearns
Jason Kelly
Kai Guo
jxm2004
Dragoș Străinu