"edge://about" URI is working in WebView2

[VijayanRamachandran]

In a sample WPF application, i hosted a single instance of WebView2 as below and passed "source" url as "edge://about"

Expectation:
"edge://about" should be blocked as explained in the below release notes ( as Blocked "edge://URI scheme" in WebView )
https://docs.microsoft.com/en-us/microsoft-edge/webview2/releasenotes#09579

Current Behavior:
It is displaying the "edge://about" page as shown in below screenshot.

Version Information
Nuget - Microsoft.Web.WebView2 => 1.0.674-prerelease
Fixed Version: Microsoft.WebView2.FixedVersionRuntime.87.0.664.8.x64

AB#30158338

[davidborka]

The same applies to the following URLs "chrome://about". Please block this one also.

[pagoe-msft]

@VijayanRamachandran @davidborka

Thanks! I've filed a bug and we'll fix this.

[davidborka]

I would like to mention here if you trying to reach the following URI (edge:\\, chrome:\\) then the whole application is crashing.
See the following exception.:

Application: WpfTIUXPreviewApp.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.Runtime.InteropServices.COMException
at Microsoft.Web.WebView2.Core.Raw.ICoreWebView2Controller.set_Bounds(Microsoft.Web.WebView2.Core.Raw.tagRECT)
at Microsoft.Web.WebView2.Core.CoreWebView2Controller.set_Bounds(System.Drawing.Rectangle)
at Microsoft.Web.WebView2.Wpf.WebView2.OnWindowPositionChanged(System.Windows.Rect)
at System.Windows.Interop.HwndHost.UpdateWindowPos()
at System.Windows.ContextLayoutManager.fireLayoutUpdateEvent()
at System.Windows.ContextLayoutManager.UpdateLayout()
at System.Windows.ContextLayoutManager.UpdateLayoutCallback(System.Object)
at System.Windows.Media.MediaContext.FireInvokeOnRenderCallbacks()
at System.Windows.Media.MediaContext.RenderMessageHandlerCore(System.Object)
at System.Windows.Media.MediaContext.RenderMessageHandler(System.Object)
at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
at System.Windows.Threading.DispatcherOperation.InvokeImpl()
at MS.Internal.CulturePreservingExecutionContext.CallbackWrapper(System.Object)
at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
at MS.Internal.CulturePreservingExecutionContext.Run(MS.Internal.CulturePreservingExecutionContext, System.Threading.ContextCallback, System.Object)
at System.Windows.Threading.DispatcherOperation.Invoke()
at System.Windows.Threading.Dispatcher.ProcessQueue()
at System.Windows.Threading.Dispatcher.WndProcHook(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
at MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
at MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
at System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
at MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
at MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
at System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
at System.Windows.Application.RunDispatcher(System.Object)
at System.Windows.Application.RunInternal(System.Windows.Window)
at WpfTIUXPreviewApp.App.Main()

[champnic]

"edge://about" and a bunch of other "edge://" urls are still reachable - we only blocked a subset that wouldn't make sense in a WebView2 context (like browser Settings, History, etc.). We've updated the release notes to indicate that not all are blocked, and are planning documentation to have more detail on which are blocked and which are still accessible.

If you want to block your users from accessing these urls yourself, you can use the NavigationStarting event and cancel the navigation.

@davidborka We're tracking the "edge://" crash separately and are going to look at it in the next sprint hopefully.

Thanks!

[champnic]

@davidborka The "edge://" should now be fixed in the latest Microsoft Edge Canary (90.0.815.0+) builds. Please let me know if you are still running into it and we can take another look.