Skip to content

Web widget custom uri scheme added #18

Merged
developersharif merged 5 commits intomainfrom
web-widget
Apr 4, 2026
Merged

Web widget custom uri scheme added #18
developersharif merged 5 commits intomainfrom
web-widget

Conversation

@developersharif
Copy link
Copy Markdown
Owner

No description provided.

@developersharif developersharif merged commit 7c70a4d into main Apr 4, 2026
6 checks passed
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request significantly enhances the WebView widget by introducing native frontend serving capabilities and a transparent fetch proxy to bypass CORS. Key additions include serveFromDisk for serving files via custom URI schemes or virtual hosts, serveVite for seamless development and production workflows, and enableFetchProxy which routes JavaScript fetch calls through PHP. The C++ helper binary was updated to support these features across all platforms and now includes a UI delegate for macOS to handle JavaScript dialogs. Review feedback identified a potential buffer truncation issue in the C++ path construction and logic errors in the PHP streamRequest fallback regarding redirect handling and status code reporting.

Comment on lines +635 to +651
$resBody = (string)@file_get_contents($url, false, stream_context_create(['http' => $opts]));
$status = 200;
$resHeaders = [];

// $http_response_header is set by file_get_contents in the local scope
$responseHeaders = $http_response_header ?? [];
if ($responseHeaders) {
if (preg_match('/HTTP\/[\d.]+\s+(\d+)/', $responseHeaders[0], $m)) {
$status = (int)$m[1];
}
foreach (array_slice($responseHeaders, 1) as $h) {
if (str_contains($h, ':')) {
[$k, $v] = explode(':', $h, 2);
$resHeaders[trim($k)] = trim($v);
}
}
}
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The streamRequest method has two significant issues: it defaults to status 200 even if the request fails (e.g., network error), and it only parses the status code from the first header. If a redirect occurs, it will return the redirect status (like 301) instead of the final response status. Additionally, it mixes headers from all responses in the redirect chain.

        $res = @file_get_contents($url, false, stream_context_create(['http' => $opts]));
        $resBody = $res === false ? '' : $res;
        $status = $res === false ? 500 : 200;
        $resHeaders = [];

        // $http_response_header is set by file_get_contents in the local scope
        $responseHeaders = $http_response_header ?? [];
        foreach ($responseHeaders as $h) {
            if (preg_match('/HTTP\/[\d.]+\s+(\d+)/', $h, $m)) {
                $status = (int)$m[1];
            } elseif (str_contains($h, ':')) {
                [$k, $v] = explode(':', $h, 2);
                $resHeaders[trim($k)] = trim($v);
            }
        }

* g_serve_dir always ends with '/' (ensured by serve_dir handler).
* WebKit always provides path starting with '/'. Skip its leading slash
* to avoid double-slash in the concatenated path. */
char filepath[4096 + 256];
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The filepath buffer size might be insufficient. Since g_serve_dir can be up to 4096 bytes and the requested path can also be long, truncation could occur. This would cause realpath to fail or return an incorrect path, potentially breaking asset loading for deep directory structures.

    char filepath[8192];

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant