wailsapp/wails v2.17.1

Wails v2.17.1

on GitHub

Installation

go install github.com/wailsapp/wails/v2/cmd/wails@v2.17.1

Changes

Security

• Linux: child frames (iframes) embedded in the application window can no longer post to the privileged window.webkit.messageHandlers.external IPC bridge. WebKitGTK does not tell the native message handler which frame sent a message, so the bridge could be reached from cross-origin or sandboxed frames and the OriginValidator check ran against the top-level page rather than the calling frame. A guard script is now injected into every frame at document start and neutralises the bridge in non-top frames. Same-origin child frames still share their parent's origin and retain access to its bridge, so applications that embed untrusted same-origin content should not rely on this boundary. Affects Linux builds of v2.17.0 and earlier. Tracked as GHSA-r5j2-ghh9-2jqw

Other changes

• test(v2/linux): verify native frame loading and document origin boundary (0d660b4)
• fix(v2/linux): prevent child frames entering privileged IPC (99fd524)
• chore(v2): update labstack/echo to 4.16.1 and goldmark to 1.7.17 (#6343) (1bb8882)