Bug 288057

Summary: [WebDriver][BiDi] Implement the script.addPreloadScript command
Product: WebKit Reporter: Lauro Moura <lmoura>
Component: WebDriverAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: bburg, sergedeh, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=288062
https://bugs.webkit.org/show_bug.cgi?id=288065
Bug Depends on:    
Bug Blocks: 281937    

Lauro Moura
Reported 2025-02-19 21:08:15 PST
https://w3c.github.io/webdriver-bidi/#command-script-addPreloadScript One of the cornerstones used by clients to make the browser to push custom messages through the `channels`, delivered as `script.message` events.
Attachments
Radar WebKit Bug Importer
Comment 1 2025-02-26 21:09:14 PST
Serge Deh
Comment 2 2026-04-02 05:47:18 PDT
Some defensive ideas for resource limits to prevent potential denial of service issues with preload scripts: 1. **Maximum number of preload scripts per session** - Cap number of preload scripts per session? - This would prevent memory exhaustion from unbounded script accumulation - We'd need to return an appropriate BiDi error when the limit is exceeded 2. **Maximum function declaration length** - Cap size of function declaration - Prevents processing extremely large script payloads - Helps protect against memory and parsing overhead attacks 3. **Total memory limit for all preload scripts** - An aggregate limit across all preload scripts in a session - Could track both source code size and runtime overhead - Prevents cumulative memory exhaustion
EWS
Comment 3 2026-04-08 20:11:51 PDT
Committed 310815@main (17a80254d05d): <https://commits.webkit.org/310815@main> Reviewed commits have been landed. Closing PR #57773 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.