`will-navigate` event not fired when in sandbox mode #8841

sebastianseilund · 2017-03-06T00:58:11Z

Thanks for Electron! Amazing project :)

Electron version: 1.6.2
Operating system: macOS Sierra (10.12.3)

It happens when BrowserWindow is opened with sandbox: true. It might be on purpose, but I couldn't find any Electron/Chromium documentation that explains why. So I'm suspecting it's a bug. I can submit a PR with a failing test to this repo if you agree that it's a bug.

Expected behavior

webContents' will-navigate event should fire when user reloads page fx.

Actual behavior

It does not fire.

How to reproduce

package.json:

{
  "name": "electron-sandbox-will-navigate-bug",
  "version": "0.0.0",
  "main": "main.js",
  "dependencies": {
    "electron": "^1.6.2"
  }
}

main.js:

const {app, BrowserWindow} = require('electron')
const path = require('path')

app.on('ready', function() {
  const win = new BrowserWindow({
    webPreferences: {
      sandbox: true
    }
  })

  const {webContents} = win
  webContents.on('will-navigate', () => {
    console.log('will-navigate')
  })
  webContents.on('did-navigate', () => {
    console.log('did-navigate')
  })

  win.loadURL('file://' + path.join(__dirname, 'index.html'))
})

index.html:

<!doctype html>
<html>
  <body>
    <button onclick="window.location.reload()">Reload</button>
  </body>
</html>

Perform these steps:

Run npm install
Run ./node_modules/.bin/electron .
Click the Reload button in the browser window
Observe the Terminal output

Expected output:

did-navigate
will-navigate
did-navigate

Actual output:

did-navigate
did-navigate

(will-navigate is not fired).

If you outcomment the line sandbox:true in main.js, then it works as expected.

lachenmayer · 2017-03-14T17:51:35Z

Hi there, I'm experiencing a similar issue: when the user presses cmd-R to reload, I expect the will-navigate event to fire. It currently does not.

This happens even when the sandbox: true flag is removed in the repro case above.

jviotti · 2017-03-24T16:34:46Z

This happens in OS X only for me, without sandbox.


        fix(GUI): disallow reloading the app in macOS using Cmd+R

Users can currently force the browser window to reload by using Cmd+R in macOS. The `will-navigate` even handler in this same file is supposed to protect us from this case, however its not fired at all just in macOS for some reason. As a solution, we attach dummy keyboard shortcut handlers for Cmd+R, Ctrl+R, and F5, to override the normal browser window behaviour. The reason behind disallowing reloads is that a reload during a critical operation such as writing, validation, elevating, unmounting, drive scanning, etc will cause undefined behaviour, resulting in non sense errors that we can't solve coming to TrackJS. See: electron/electron#8841 Fixes: #1210 Signed-off-by: Juan Cruz Viotti <jviotti@openmailbox.org>

lurch · 2017-03-25T17:14:55Z

https://github.com/resin-io/etcher/pull/1219/files implements a workaround for this.

sebastianseilund · 2017-03-25T18:53:54Z

https://github.com/resin-io/etcher/pull/1219/files implements a workaround for this.

Thanks for your input. I just want to point out that this is not a workaround for this specific issue. The issue here is that will-navigate is not fired. Not that I want to block the user from navigating.

lurch · 2017-03-26T01:51:04Z

Lol, whoops ;-) My apologies for misunderstanding.


        fix(GUI): disallow reloading the app in macOS using Cmd+R

Users can currently force the browser window to reload by using Cmd+R in macOS. The `will-navigate` event handler in this same file is supposed to protect us from this case, however it's not fired at all just in macOS for some reason. As a solution, we attach dummy keyboard shortcut handlers for Cmd+R, Ctrl+R, and F5, to override the normal browser window behaviour. The reason behind disallowing reloads is that a reload during a critical operation such as writing, validation, elevating, unmounting, drive scanning, etc will cause undefined behaviour, resulting in nonsense errors that we can't solve coming to TrackJS. See: electron/electron#8841 Fixes: #1210 Signed-off-by: Juan Cruz Viotti <jviotti@openmailbox.org>


        fix(GUI): disallow reloading the app in macOS using Cmd+R (#1219)

Users can currently force the browser window to reload by using Cmd+R in macOS. The `will-navigate` event handler in this same file is supposed to protect us from this case, however it's not fired at all just in macOS for some reason. As a solution, we attach dummy keyboard shortcut handlers for Cmd+R, Ctrl+R, and F5, to override the normal browser window behaviour. The reason behind disallowing reloads is that a reload during a critical operation such as writing, validation, elevating, unmounting, drive scanning, etc will cause undefined behaviour, resulting in nonsense errors that we can't solve coming to TrackJS. See: electron/electron#8841 Fixes: #1210 Signed-off-by: Juan Cruz Viotti <jviotti@openmailbox.org>

lneir · 2017-05-24T19:44:08Z

what is the status on a fix here?

petemud · 2018-02-08T21:29:37Z

Actually will-navigate isn't working under linux (ubuntu 16.04) too

codebytere · 2018-09-24T04:42:34Z

We are no longer implementing bugfixes for versions of Electron <= 1.7.x, so i'm going to close this issue but if it is still persisting in more recent versions of Electron we can certainly reopen it!

GhostlyDark · 2018-09-24T13:21:03Z

@codebytere This bug still exists in v3.0.0, so please reopen the issue.

codebytere · 2018-09-24T15:03:39Z

Great! will do, thanks for the fast response


        Add target="_blank" to links that don't have it

This is now more of a problem in the Electron app because of electron/electron#8841 but is still annoying in the webapp if you're taken away from your chat client. Exception is the SSO link, as commented (issue filed at vector-im/riot-web#8247). Fixes vector-im/riot-web#8226

geakstr · 2019-02-15T17:36:42Z

Still exists in 4.* Is there any workaround to make it works?

geakstr · 2019-02-15T18:26:28Z

As well as in v5 beta

markleutloff · 2019-02-22T14:03:30Z

I can reproduce this too, will-navigate is never fired, which makes aborting navigations for security reasons a hassle. Also nothing in the docs state that sandboxing will prevent the firing of this event.


        fix(nicolive): ログアウト防止が動作するように

sandbox: true 指定すると will-navigate イベントが発火しない問題がある rel. electron/electron#8841

mike-seekwell · 2019-05-13T21:37:46Z

you can "fix" this by doing the following:

electron.globalShortcut.register('CommandOrControl+R', () => {
    console.log('CommandOrControl+R is pressed')
})

but note that it disables CMD+R across all applications the user has open (e.g. they won't be able to reload a page in Chrome using CMD+R)

mattbroussard · 2019-07-08T23:34:54Z

We still observe this on 5.0.5. Any updates?

The workaround of disabling the cmd-R shortcut is not applicable for us, as we are trying to prevent link navigations (i.e. not just page reloads) for security and user experience purposes.

markleutloff · 2019-08-07T14:03:19Z

This is still a problem at:

Electron v6.0.0
Electron v6.0.1
Electron v7.0.0-beta.1

Any news on this?

ridesky · 2019-08-09T06:49:15Z

same issue in 5.0.6

codebytere · 2019-08-09T14:46:04Z

No news, but i did some brief digging and it seems the sandbox codepath never invokes OpenURLForTab which is what causes this. Still working on the why and the fix.

sofianguy · 2019-08-09T23:17:27Z

Thank you for taking the time to report this issue and helping to make Electron better.

The version of Electron you reported this on has been superseded by newer releases.

If you're still experiencing this issue in Electron v4.2.x or later, please add a comment specifying the version you're testing with and any other new information that a maintainer trying to reproduce the issue should know.

I'm setting the blocked/need-info label for the above reasons. This issue will be closed 7 days from now if there is no response.

Thanks in advance! Your help is appreciated.

asherkin · 2019-08-09T23:26:04Z

There are 6+ months of comments confirming it is still present in versions post-4.2, please do not close this issue again.

aegarbutt · 2019-08-30T20:06:41Z

I did some more in-depth digging to understand when OpenURLFromTab was called. It appears it was only called when a new process was created. I've created a pull request that fixes the tactical issue.

aegarbutt · 2019-08-30T20:08:09Z

Perhaps this should rely on ShouldTransferNavigation instead?

kevinsawicki added component/sandbox fixme/bug labels Mar 17, 2017

jviotti mentioned this issue Mar 24, 2017

fix(GUI): disallow reloading the app in macOS using Cmd+R #1219

Merged

justinmichaelvieira mentioned this issue May 5, 2017

MacOS - navigation links not working? #90

Closed

lneir mentioned this issue May 24, 2017

fix opening A tag #105

Merged

sofianguy added platform/macOS version/1.6.x labels Feb 2, 2018

sofianguy added bug 🐞 and removed fixme/bug 🐞 labels Apr 4, 2018

GhostlyDark mentioned this issue Aug 5, 2018

[Docs] security.md - Disable navigation example not working + typo #13943

Closed

codebytere closed this Sep 24, 2018

codebytere reopened this Sep 24, 2018

codebytere added 3-0-x and removed version/1.6.x labels Sep 24, 2018

This was referenced Jan 23, 2019

Links opening in desktop app frame vector-im/riot-web#8226

Closed

SSO in desktop app depends on Electron bug vector-im/riot-web#8247

Open

dbkr mentioned this issue Jan 24, 2019

Add target="_blank" to links that don't have it #2496

Merged

berlysia mentioned this issue Apr 24, 2019

変更: 番組作成・編集画面の制限を強化 #282

Merged

berlysia added a commit to berlysia/n-air-app that referenced this issue Apr 24, 2019

fix(nicolive): ログアウト防止が動作するように

5a9180d

sandbox: true 指定すると will-navigate イベントが発火しない問題がある rel. electron/electron#8841

MarshallOfSound mentioned this issue Aug 4, 2019

"Prevent Navigation" Example Code Doesn't Work #19615

Closed

codebytere self-assigned this Aug 9, 2019

sofianguy added the blocked/need-info ❌ label Aug 9, 2019

MarshallOfSound added 4-2-x 5-0-x 6-0-x platform/all and removed 3-0-x blocked/need-info ❌ platform/macOS labels Aug 9, 2019

aegarbutt mentioned this issue Aug 30, 2019

fix: emit `will-navigate` event when sandbox is enabled #20050

Closed

5 of 5 tasks complete

electron/electron

Join GitHub today

`will-navigate` event not fired when in sandbox mode #8841

`will-navigate` event not fired when in sandbox mode #8841

Comments

sebastianseilund commented Mar 6, 2017 • edited

Expected behavior

Actual behavior

How to reproduce

This comment has been minimized.

lachenmayer commented Mar 14, 2017 • edited

This comment has been minimized.

jviotti commented Mar 24, 2017

This comment has been minimized.

lurch commented Mar 25, 2017

This comment has been minimized.

sebastianseilund commented Mar 25, 2017

This comment has been minimized.

lurch commented Mar 26, 2017

This comment has been minimized.

lneir commented May 24, 2017

This comment has been minimized.

petemud commented Feb 8, 2018

This comment has been minimized.

codebytere commented Sep 24, 2018

This comment has been minimized.

GhostlyDark commented Sep 24, 2018

This comment has been minimized.

codebytere commented Sep 24, 2018

This comment has been minimized.

geakstr commented Feb 15, 2019

This comment has been minimized.

geakstr commented Feb 15, 2019

This comment has been minimized.

markleutloff commented Feb 22, 2019

This comment has been minimized.

mike-seekwell commented May 13, 2019 • edited

This comment has been minimized.

mattbroussard commented Jul 8, 2019 • edited

This comment has been minimized.

markleutloff commented Aug 7, 2019

This comment has been minimized.

ridesky commented Aug 9, 2019 • edited

This comment has been minimized.

codebytere commented Aug 9, 2019

This comment has been minimized.

sofianguy commented Aug 9, 2019

This comment has been minimized.

asherkin commented Aug 9, 2019

This comment has been minimized.

aegarbutt commented Aug 30, 2019

This comment has been minimized.

aegarbutt commented Aug 30, 2019

sebastianseilund commented Mar 6, 2017 •

edited

lachenmayer commented Mar 14, 2017 •

edited

mike-seekwell commented May 13, 2019 •

edited

mattbroussard commented Jul 8, 2019 •

edited

ridesky commented Aug 9, 2019 •

edited