Do not allow configuring tabs with javascript no matter what (#26932)

brave · Dec 12, 2024 · 73b6be9 · 73b6be9
1 parent 12d7911
commit 73b6be9
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/ios/brave-ios/Sources/Brave/Frontend/Browser/TabManager.swift b/ios/brave-ios/Sources/Brave/Frontend/Browser/TabManager.swift
@@ -622,7 +622,10 @@ class TabManager: NSObject {
         && Preferences.Privacy.persistentPrivateBrowsing.value)
 
     // WebKit can sometimes return a URL that isn't valid at all!
-    if let requestURL = request?.url, NSURL(idnString: requestURL.absoluteString) == nil {
+    // Do not allow configuring a tab with a Bookmarklet or Javascript URL
+    if let requestURL = request?.url,
+      NSURL(idnString: requestURL.absoluteString) == nil || requestURL.isBookmarklet
+    {
       request?.url = TabManager.aboutBlankBlockedURL
     }