#53669: fix: only relax the drag target check across WebContents
Description of Change
webview_cross_drag.patch (libchromiumcontent#267, 2017) lets drags cross <webview> boundaries by making WebContentsViewDragSecurityInfo::IsValidDragTarget return true unconditionally. That function is the browser-side half of crbug.com/59081: when a drag was started by the same top-level WebContentsView, it refuses drop targets whose SiteInstanceGroup differs from the source, so a page cannot use a drag to move data into or out of a cross-site iframe without the renderer-side DragController check being the only line of defense. The patch switched that off for every Electron app, not just for guests.
Guests hit the check because inner WebContents drag through their outermost view (WebContentsViewChildFrame::StartDragging forwards to the embedder's view), so did_initiate_ is set even though source and target are different WebContents. The patch now records the source widget in OnDragInitiated, resolves both widgets to their WebContentsImpl, and allows the drop only when they belong to different WebContents and at least one of them IsGuest() (guest to guest, guest to embedder, embedder to guest); everything else falls through to the upstream SiteInstanceGroup comparison. If the source widget has gone away mid-drag the weak pointer is null and the upstream check applies.
Verified on Linux that it builds and spec/webview-spec.ts is unchanged, and on macOS 26.5 (arm64, in a VM, real pointer drags driven over VNC) against a build of this branch with current main as the control, each drag from a link in the source onto a drop target that logs dataTransfer:
| Drag | main | this PR |
|---|---|---|
<webview> to a second <webview> in the same window |
drop lands | drop lands |
page to a cross-site <iframe> in the same page (localhost page, 127.0.0.1 frame) |
drop lands | refused: the frame never sees dragenter, dragend reports none |
page to a same-site <iframe> |
drop lands | drop lands |
Windows has not been exercised by hand; the code path is shared with macOS (WebContentsViewDragSecurityInfo backs both web_contents_view_mac.mm and web_contents_view_aura.cc).
Checklist
- PR description included and stakeholders cc'd
-
npm testpasses - I have reviewed and verified the changes
Release Notes
Notes: Fixed an issue where the browser-side check that blocks drag and drop between cross-site frames of the same page was disabled.
Backports
Semver Impact
Semantic Versioning helps users understand the impact of updates:
- Major (X.y.z): Breaking changes that may require code modifications
- Minor (x.Y.z): New features that maintain backward compatibility
- Patch (x.y.Z): Bug fixes that don't change the API
- None: Changes that don't affect using facing parts of Electron