Skip to content

Add webkitgtk6 option#4570

Open
Sammy-T wants to merge 50 commits into
wailsapp:masterfrom
Sammy-T:feature/webkitgtk6
Open

Add webkitgtk6 option#4570
Sammy-T wants to merge 50 commits into
wailsapp:masterfrom
Sammy-T:feature/webkitgtk6

Conversation

@Sammy-T

@Sammy-T Sammy-T commented Sep 9, 2025

Copy link
Copy Markdown

Description

This adds an option to run or build an app on Linux using webkitgtk-6.0.

Depends on:

  • gtk4

Fixes #3193

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update

Important

Features which have been removed/deprecated from webkit or gtk4 have been marked with todos.
If they can be reimplemented, using this library option could potentially match the functionality of the current implementation.

How Has This Been Tested?

  • Windows
  • macOS
  • Linux

Ubuntu 22.04

The performance is usually noticeable on an app with scrolled content or a complex layout.

Running/Building the app with this PR's changes requires:

  • Setting the app's Linux program name option
  • Adding -tags webkit_6 to the Wails dev or build command

Warnings:

Message Reason?
New application windows must be added after the GApplication::startup signal has been emitted. It should already be added after the startup signal so I think this warning is more about how it's set up.

Test Configuration

# Wails
Version         | v2.10.2
Package Manager | apt


# System
WARNING: failed to read int from file: open /sys/devices/system/cpu/cpu0/online: no such file or directory
┌──────────────────────────────────────────────────────────┐
| OS           | Ubuntu                                    |
| Version      | 22.04                                     |
| ID           | ubuntu                                    |
| Branding     |                                           |
| Go Version   | go1.24.5                                  |
| Platform     | linux                                     |
| Architecture | amd64                                     |
| CPU          | Intel(R) Core(TM) i5-6300HQ CPU @ 2.30GHz |
| Memory       | 16GB                                      |
└──────────────────────────────────────────────────────────┘

# Dependencies
┌──────────────────────────────────────────────────────────────────────────┐
| Dependency | Package Name          | Status    | Version                 |
| *docker    | docker.io             | Installed |                         |
| gcc        | build-essential       | Installed | 11.4.0                  |
| libgtk-3   | libgtk-3-dev          | Installed | 3.24.33-1ubuntu2.2      |
| libwebkit  | libwebkit2gtk-4.0-dev | Installed | 2.48.5-0ubuntu0.22.04.1 |
| npm        | npm                   | Installed | 11.5.2                  |
| *nsis      | nsis                  | Available | 3.08-2                  |
| pkg-config | pkg-config            | Installed | 0.29.2-1ubuntu3         |
|                                                                          |
└──────────────────────── * - Optional Dependency ─────────────────────────┘

# Diagnosis
Optional package(s) installation details:
  - nsis: sudo apt install nsis

Requires webkitgtk-6 and gtk4.

Checklist:

  • I have updated website/src/pages/changelog.mdx with details of this PR
  • My code follows the general coding style of this project
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes

Summary by CodeRabbit

  • New Features

    • Full WebKit6 Linux frontend: modern webview, GTK4-based window lifecycle and controls, menus, clipboard, keyboard accelerators, screen detection, file dialogs, inspector/DevTools, and asset serving.
    • WebKit6-backed request/response handling and clipboard APIs for the asset server and webview integration.
  • Chores

    • Platform split and build-tag gating to select legacy WebKit or new WebKit6 paths at build time.

Review Change Stack

@coderabbitai

coderabbitai Bot commented Sep 9, 2025

Copy link
Copy Markdown
Contributor

Caution

Review failed

An error occurred during the review process. Please try again later.

Walkthrough

This PR splits the Linux frontend into legacy GTK3/WebKit2 (gated linux && !webkit_6) and a new GTK4/WebKit6 path (gated linux && webkit_6), adding full GTK4/WebKit6 implementations for windowing, frontend, menus, clipboard, screen enumeration, keys, and assetserver webview plumbing.

Changes

Cohort / File(s) Summary
Build tag updates (exclude webkit_6)
v2/internal/frontend/desktop/linux/clipboard.go, v2/internal/frontend/desktop/linux/frontend.go, v2/internal/frontend/desktop/linux/gtk.go, v2/internal/frontend/desktop/linux/invoke.go, v2/internal/frontend/desktop/linux/keys.go, v2/internal/frontend/desktop/linux/menu.go, v2/internal/frontend/desktop/linux/screen.go, v2/internal/frontend/desktop/linux/webkit2.go, v2/internal/frontend/desktop/linux/window.c, v2/internal/frontend/desktop/linux/window.go, v2/internal/frontend/desktop/linux/window.h, v2/pkg/assetserver/webview/request_linux.go, v2/pkg/assetserver/webview/responsewriter_linux.go, v2/pkg/assetserver/webview/webkit2_36+.go, v2/pkg/assetserver/webview/webkit2_legacy.go
Replace broad linux build tags with linux && !webkit_6 and adjust cgo directives to gate legacy GTK3/WebKit2 files when WebKit6 is enabled.
GTK4 / WebKit6 C layer (new)
v2/internal/frontend/desktop/linux/window_webkit6.c, v2/internal/frontend/desktop/linux/window_webkit6.h
New C implementation and header for GTK4/WebKit6 windowing, messaging bridge, drag/resize, dialogs, file choosers, inspector, monitor utilities, and main-thread helpers; gated by linux && webkit_6.
GTK4 / WebKit6 Go window layer (new)
v2/internal/frontend/desktop/linux/window_webkit6.go
New Go Window type and public window lifecycle/geometry/UI methods that interoperate with the C layer via CGO.
GTK4 / WebKit6 frontend core (new)
v2/internal/frontend/desktop/linux/frontend_webkit6.go
New Frontend implementation, main loop and message processors, CGO-exported bridge functions (processMessage, processBindingMessage), assetserver integration, and window/IPC plumbing.
GTK4 / WebKit6 menu support (new + callbacks)
v2/internal/frontend/desktop/linux/menu_webkit6.go, v2/internal/frontend/desktop/linux/gtk_webkit6.go
New GTK4/WebKit6 menu construction, C-exported callbacks for menu item/check/radio events, action-to-item mappings, and async click dispatch.
GTK4 / WebKit6 clipboard (new)
v2/internal/frontend/desktop/linux/clipboard_webkit6.go
C wrappers and Frontend methods for clipboard get/set using GTK4/WebKit6 executed on the main thread.
GTK4 / WebKit6 screen/display (new)
v2/internal/frontend/desktop/linux/screen_webkit6.go
New GetAllScreens implementation using GTK4 display APIs returning frontend.Screen slice.
GTK4 / WebKit6 keys/accelerators (new)
v2/internal/frontend/desktop/linux/keys_webkit6.go
Accelerator parsing with named key → GTK keyval map and modifier parsing for GTK4/WebKit6.
WebKit6 assetserver & webview plumbing (new)
v2/pkg/assetserver/webview/webkit6.go, v2/pkg/assetserver/webview/request_linux_webkit6.go, v2/pkg/assetserver/webview/responsewriter_linux_webkit6.go
New WebKit6 request/response bridge using CGO (GTK4/WebKitGTK-6.0), request wrapper, streaming response writer using Unix pipe + GInputStream, GError conversion, and exported Webkit2 min-version constant.
Validation helper (new)
v2/internal/frontend/desktop/linux/webkit6.go
WebKit2 version validation for WebKitGTK-6.0 builds; shows modal and exits if requirement not met.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  actor WebView as C/WebKit
  participant CGO as cgo bridge
  participant Frontend as Go:frontend_webkit6
  participant Dispatcher as frontend.Dispatcher
  participant Window as Go/C Window

  WebView->>CGO: processMessage / processBindingMessage(C string)
  CGO->>Frontend: exported function call
  Frontend->>Frontend: validate origin / unmarshal
  Frontend->>Dispatcher: dispatch binding or event
  Dispatcher->>Window: perform action (show/size/exec)
  Window->>CGO: ExecuteOnMainThread / C helpers for UI ops
  note right of Frontend `#DDEBF7`: async goroutine dispatch for callbacks and menu clicks
Loading

Estimated code review effort

🎯 5 (Critical) | ⏱️ ~120 minutes

Possibly related issues

  • #5459 — Modifies the same Linux frontend build tags and introduces WebKitGTK6 (GTK4) files; changes here implement the webkit_6-gated path referenced by that issue.

Suggested labels

Enhancement, Linux, go, size:XXL, Documentation, runtime, lgtm

Suggested reviewers

  • leaanthony
  • atterpac

Poem

🐇 I hopped through tags and C and Go,
New windows sprung where webviews grow,
Menus click and clipboards share,
Screens and pipes all handled with care,
A tiny rabbit cheers the show.

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)
Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. You can run @coderabbitai generate docstrings to improve docstring coverage.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title 'Add webkitgtk6 option' is concise and clearly describes the main change: adding WebKit GTK6 support as a build/runtime option. It accurately reflects the primary objective of the PR.
Description check ✅ Passed The PR description provides a clear summary of the change, links to issue #3193, identifies it as a new feature, specifies the dependencies (gtk4, webkitgtk-6), includes test configuration details, and documents known issues. However, several template checklist items remain unchecked (changelog, documentation, tests).
Linked Issues check ✅ Passed The PR successfully addresses the core objectives from issue #3193: it enables building with webkitgtk-6.0 via build tags, supports GTK4 integration, and provides the performance improvements mentioned. However, several features marked as TODOs in GTK4/WebKit6 remain unimplemented (window positioning, certain window controls).
Out of Scope Changes check ✅ Passed All changes are directly scoped to implementing WebKit6/GTK4 support for Linux: build tag conditional compilation, C/Go bindings, window management, menu handling, clipboard operations, screen queries, and asset server integration. No unrelated changes detected.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@Sammy-T Sammy-T mentioned this pull request Sep 9, 2025

@COD3HUNT3R COD3HUNT3R left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Sammy-T

Sammy-T commented Sep 25, 2025

Copy link
Copy Markdown
Author

@COD3HUNT3R this is intended to work similarly to when using -tags webkit2_41 which doesn't have any additional output for the doctor command to my knowledge.

@COD3HUNT3R

Copy link
Copy Markdown
Contributor

@COD3HUNT3R this is intended to work similarly to when using -tags webkit2_41 which doesn't have any additional output for the doctor command to my knowledge.

Yes, you are right but this would be helpful to find required packages for gtk4, webkit2-6.0

@Sammy-T

Sammy-T commented Sep 29, 2025

Copy link
Copy Markdown
Author

Had to revert updating from master (ca1eed6) because it broke local development on linux for me.

@Sammy-T Sammy-T marked this pull request as ready for review September 29, 2025 21:33
@Sammy-T

Sammy-T commented Sep 29, 2025

Copy link
Copy Markdown
Author

Running this on X11 Linux Mint, this appears to be working nicely.

I still don't know how/if I can get the todos (window positioning, etc.) working with webkit-6 though.

@leaanthony Are you able to test this and see how it runs for you? And do you know how to address the commented todos?

@Sammy-T

Sammy-T commented Nov 3, 2025

Copy link
Copy Markdown
Author

Yeah, I don't consider it ideal either. But my intent was to reduce the amount of duplicated files/code where there was little to no change in the Go side of the code. Do you want me to migrate the ifdefs to the separate file strategy instead?

@leaanthony

Copy link
Copy Markdown
Member

I think it might be easier to follow/debug? Might be something an LLM can do reasonably quickly.

I'm going to try and get a v2 release out today and will look at including this in the next release. I'll install a fresh linux to test today.

@Sammy-T

Sammy-T commented Nov 9, 2025

Copy link
Copy Markdown
Author

Alright. That's great. I prefer to migrate it myself. But I'll try to get it done soon.

@Sammy-T

Sammy-T commented Nov 9, 2025

Copy link
Copy Markdown
Author

The ifdefs are replaced now.

@leaanthony

Copy link
Copy Markdown
Member

Legend! 👍

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 96fe012 and bd50c5a.

📒 Files selected for processing (14)
  • v2/internal/frontend/desktop/linux/clipboard.go (1 hunks)
  • v2/internal/frontend/desktop/linux/clipboard_webkit6.go (1 hunks)
  • v2/internal/frontend/desktop/linux/frontend.go (1 hunks)
  • v2/internal/frontend/desktop/linux/frontend_webkit6.go (1 hunks)
  • v2/internal/frontend/desktop/linux/keys.go (1 hunks)
  • v2/internal/frontend/desktop/linux/keys_webkit6.go (1 hunks)
  • v2/internal/frontend/desktop/linux/webkit2.go (1 hunks)
  • v2/internal/frontend/desktop/linux/webkit6.go (1 hunks)
  • v2/pkg/assetserver/webview/request_linux.go (1 hunks)
  • v2/pkg/assetserver/webview/request_linux_webkit6.go (1 hunks)
  • v2/pkg/assetserver/webview/responsewriter_linux.go (1 hunks)
  • v2/pkg/assetserver/webview/responsewriter_linux_webkit6.go (1 hunks)
  • v2/pkg/assetserver/webview/webkit2_36+.go (1 hunks)
  • v2/pkg/assetserver/webview/webkit6.go (1 hunks)
✅ Files skipped from review due to trivial changes (1)
  • v2/pkg/assetserver/webview/webkit2_36+.go
🚧 Files skipped from review as they are similar to previous changes (5)
  • v2/internal/frontend/desktop/linux/webkit2.go
  • v2/pkg/assetserver/webview/responsewriter_linux.go
  • v2/pkg/assetserver/webview/request_linux.go
  • v2/internal/frontend/desktop/linux/keys.go
  • v2/internal/frontend/desktop/linux/clipboard.go
🧰 Additional context used
🧠 Learnings (7)
📓 Common learnings
Learnt from: Mihara
Repo: wailsapp/wails PR: 4481
File: v3/internal/commands/updatable_build_assets/linux/nfpm/nfpm.yaml.tmpl:29-30
Timestamp: 2025-08-08T10:25:32.415Z
Learning: For Wails v3 Linux nfpm template, Debian/Ubuntu WebKitGTK runtime package names differ: Debian 12 (Bookworm) uses libwebkit2gtk-4.1-0 while Ubuntu 22.04 (Jammy) uses libwebkit2gtk-4.0-37. Prefer an OR dependency "libwebkit2gtk-4.1-0 | libwebkit2gtk-4.0-37" in v3/internal/commands/updatable_build_assets/linux/nfpm/nfpm.yaml.tmpl to support both.
Learnt from: Sammy-T
Repo: wailsapp/wails PR: 4570
File: v2/internal/frontend/desktop/linux/window_webkit6.go:97-108
Timestamp: 2025-10-17T23:16:11.570Z
Learning: For webkit_6/GTK4 builds in v2/internal/frontend/desktop/linux/window_webkit6.go, GTK widget creation should not be wrapped in invokeOnMainThread. The activation mechanism (activateWg + onActivate export) already handles thread safety, and additional wrapping would cause issues.
Learnt from: Mihara
Repo: wailsapp/wails PR: 4481
File: v3/internal/commands/updatable_build_assets/linux/nfpm/nfpm.yaml.tmpl:37-38
Timestamp: 2025-08-08T11:10:17.787Z
Learning: In Wails v3 nfpm templates for RPM (RHEL-family), do not use a boolean OR between webkit2gtk3 and webkit2gtk4.1. Binaries built against WebKitGTK 4.1 are not ABI-compatible with 4.0, so the dependency must be pinned to the exact ABI: use webkit2gtk4.1 for 4.1 builds (e.g., RHEL/Rocky 10) and webkit2gtk3 for 4.0 builds (RHEL/Rocky 8/9).
Learnt from: Mihara
Repo: wailsapp/wails PR: 4481
File: v3/internal/commands/updatable_build_assets/linux/nfpm/nfpm.yaml.tmpl:29-30
Timestamp: 2025-08-08T10:25:32.415Z
Learning: Ubuntu 22.04 (Jammy) official repos include both WebKitGTK runtimes: libwebkit2gtk-4.0-37 and libwebkit2gtk-4.1-0 (Universe). For nfpm templates, depend on the exact SONAME matching the built ABI (use libwebkit2gtk-4.1-0 when targeting 4.1; use libwebkit2gtk-4.0-37 when targeting 4.0) rather than an OR across ABIs.
📚 Learning: 2025-10-17T23:16:11.570Z
Learnt from: Sammy-T
Repo: wailsapp/wails PR: 4570
File: v2/internal/frontend/desktop/linux/window_webkit6.go:97-108
Timestamp: 2025-10-17T23:16:11.570Z
Learning: For webkit_6/GTK4 builds in v2/internal/frontend/desktop/linux/window_webkit6.go, GTK widget creation should not be wrapped in invokeOnMainThread. The activation mechanism (activateWg + onActivate export) already handles thread safety, and additional wrapping would cause issues.

Applied to files:

  • v2/internal/frontend/desktop/linux/frontend.go
  • v2/internal/frontend/desktop/linux/keys_webkit6.go
  • v2/pkg/assetserver/webview/request_linux_webkit6.go
  • v2/pkg/assetserver/webview/responsewriter_linux_webkit6.go
  • v2/internal/frontend/desktop/linux/clipboard_webkit6.go
  • v2/pkg/assetserver/webview/webkit6.go
  • v2/internal/frontend/desktop/linux/webkit6.go
  • v2/internal/frontend/desktop/linux/frontend_webkit6.go
📚 Learning: 2025-08-08T10:25:32.415Z
Learnt from: Mihara
Repo: wailsapp/wails PR: 4481
File: v3/internal/commands/updatable_build_assets/linux/nfpm/nfpm.yaml.tmpl:29-30
Timestamp: 2025-08-08T10:25:32.415Z
Learning: For Wails v3 Linux nfpm template, Debian/Ubuntu WebKitGTK runtime package names differ: Debian 12 (Bookworm) uses libwebkit2gtk-4.1-0 while Ubuntu 22.04 (Jammy) uses libwebkit2gtk-4.0-37. Prefer an OR dependency "libwebkit2gtk-4.1-0 | libwebkit2gtk-4.0-37" in v3/internal/commands/updatable_build_assets/linux/nfpm/nfpm.yaml.tmpl to support both.

Applied to files:

  • v2/internal/frontend/desktop/linux/frontend.go
  • v2/pkg/assetserver/webview/webkit6.go
  • v2/internal/frontend/desktop/linux/webkit6.go
📚 Learning: 2025-08-08T09:13:16.916Z
Learnt from: APshenkin
Repo: wailsapp/wails PR: 4480
File: v2/internal/frontend/desktop/darwin/message.h:17-19
Timestamp: 2025-08-08T09:13:16.916Z
Learning: In Wails v2 bindings origin verification, processBindingMessage intentionally has different signatures across platforms: Darwin includes an isMainFrame bool (WKWebKit provides it), Linux uses two params (message, source) as WebKitGTK doesn’t expose main-frame info there, and Windows handles origin checks in Go via WebView2 sender/args without a C bridge. This divergence is acceptable/expected per maintainer (APshenkin).

Applied to files:

  • v2/pkg/assetserver/webview/responsewriter_linux_webkit6.go
  • v2/pkg/assetserver/webview/webkit6.go
  • v2/internal/frontend/desktop/linux/webkit6.go
  • v2/internal/frontend/desktop/linux/frontend_webkit6.go
📚 Learning: 2025-08-08T11:10:17.787Z
Learnt from: Mihara
Repo: wailsapp/wails PR: 4481
File: v3/internal/commands/updatable_build_assets/linux/nfpm/nfpm.yaml.tmpl:37-38
Timestamp: 2025-08-08T11:10:17.787Z
Learning: In Wails v3 nfpm templates for RPM (RHEL-family), do not use a boolean OR between webkit2gtk3 and webkit2gtk4.1. Binaries built against WebKitGTK 4.1 are not ABI-compatible with 4.0, so the dependency must be pinned to the exact ABI: use webkit2gtk4.1 for 4.1 builds (e.g., RHEL/Rocky 10) and webkit2gtk3 for 4.0 builds (RHEL/Rocky 8/9).

Applied to files:

  • v2/pkg/assetserver/webview/webkit6.go
  • v2/internal/frontend/desktop/linux/webkit6.go
📚 Learning: 2025-08-08T10:25:32.415Z
Learnt from: Mihara
Repo: wailsapp/wails PR: 4481
File: v3/internal/commands/updatable_build_assets/linux/nfpm/nfpm.yaml.tmpl:29-30
Timestamp: 2025-08-08T10:25:32.415Z
Learning: Ubuntu 22.04 (Jammy) official repos include both WebKitGTK runtimes: libwebkit2gtk-4.0-37 and libwebkit2gtk-4.1-0 (Universe). For nfpm templates, depend on the exact SONAME matching the built ABI (use libwebkit2gtk-4.1-0 when targeting 4.1; use libwebkit2gtk-4.0-37 when targeting 4.0) rather than an OR across ABIs.

Applied to files:

  • v2/pkg/assetserver/webview/webkit6.go
  • v2/internal/frontend/desktop/linux/webkit6.go
📚 Learning: 2024-09-30T06:13:46.595Z
Learnt from: leaanthony
Repo: wailsapp/wails PR: 3763
File: v3/examples/window/main.go:472-475
Timestamp: 2024-09-30T06:13:46.595Z
Learning: In `v3/examples/window/main.go`, `time.Sleep` is used within a goroutine and does not block the UI thread.

Applied to files:

  • v2/internal/frontend/desktop/linux/frontend_webkit6.go
🧬 Code graph analysis (5)
v2/internal/frontend/desktop/linux/keys_webkit6.go (1)
v2/pkg/menu/keys/keys.go (5)
  • Modifier (9-9)
  • ShiftKey (17-17)
  • ControlKey (21-21)
  • CmdOrCtrlKey (13-13)
  • OptionOrAltKey (15-15)
v2/pkg/assetserver/webview/request_linux_webkit6.go (2)
v2/pkg/assetserver/webview/request.go (1)
  • Request (8-17)
v2/pkg/assetserver/webview/responsewriter.go (1)
  • ResponseWriter (20-25)
v2/internal/frontend/desktop/linux/clipboard_webkit6.go (1)
v2/internal/frontend/desktop/windows/win32/clipboard.go (2)
  • GetClipboardText (37-75)
  • SetClipboardText (77-143)
v2/internal/frontend/desktop/linux/webkit6.go (1)
v2/pkg/assetserver/webview/webkit6.go (1)
  • Webkit2MinMinorVersion (23-23)
v2/internal/frontend/desktop/linux/frontend_webkit6.go (6)
v2/pkg/options/options.go (4)
  • SecondInstanceData (196-199)
  • SingleInstanceLock (190-194)
  • RGBA (111-116)
  • DragAndDrop (201-216)
v2/internal/frontend/originvalidator/originValidator.go (2)
  • OriginValidator (10-12)
  • NewOriginValidator (15-23)
v2/pkg/assetserver/assetserver.go (1)
  • NewAssetServerMainPage (53-59)
v2/pkg/assetserver/webview/request.go (1)
  • Request (8-17)
v2/pkg/assetserver/webview/request_linux.go (1)
  • NewRequest (23-29)
v2/pkg/assetserver/webview/request_linux_webkit6.go (1)
  • NewRequest (21-27)

Comment thread v2/internal/frontend/desktop/linux/clipboard_webkit6.go
Comment thread v2/internal/frontend/desktop/linux/keys_webkit6.go
Comment thread v2/pkg/assetserver/webview/webkit6.go
@sonarqubecloud

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
6 Security Hotspots
50.6% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud

@leaanthony

Copy link
Copy Markdown
Member

@Sammy-T - sorry for the delay in getting to this. Looking at it now along with a port to v3. @COD3HUNT3R - I'll sort out the v3 port, thanks for offering 👍

@sonarqubecloud

sonarqubecloud Bot commented Jan 4, 2026

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
6 Security Hotspots
50.6% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud

@Sammy-T

Sammy-T commented Jan 5, 2026

Copy link
Copy Markdown
Author

@leaanthony It's alright. It's not a small PR so I wasn't expecting it to be a quick review. Thanks for getting to it.

leaanthony added a commit that referenced this pull request Apr 29, 2026
* chore: remove orphaned root-level debris

Drops files that accumulated at the repo root and aren't referenced
anywhere:

- pr_4570.diff (orphaned patch artifact from PR #4570)
- test-changelog-extraction.sh, test-ios-compile.sh,
  test-version-logic.sh (one-off helper scripts; logic that is still
  needed lives under v3/scripts/ instead)
- test-workflow.md (notes file, no longer current)

Reduces noise at the repo root and trims surface area before the
v3-alpha → master merge.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: remove abandoned mkdocs-website experiment

Deletes the entire `mkdocs-website/` directory. It was an
alternative MkDocs-based docs setup, not deployed anywhere
(the v3 docs ship from `docs/` via Cloudflare Pages and
the v2 docs ship from `website/`), and has been confirmed
abandoned.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(workflows): drop auto-label-issues workflow

Companion deletion to the master-side PR; retiring the auto-labeller
rather than keeping it across both versions. Removing here so the
v3-alpha → master merge has no conflict on this file.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(workflows): drop test-nightly-releases and issue-triage-automation

Companion deletion to the master-side PR; retiring both ahead of the
v3-alpha → master merge so neither file appears in the conflict set.
Issue triage is moving to a real agent-driven workflow.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@leaanthony leaanthony modified the milestone: v3.0.0-beta.2 May 15, 2026
@leaanthony

Copy link
Copy Markdown
Member

Code review findings

Reviewed the full diff. Summary of issues found, roughly by severity:

Blockers

# Issue File
1 Format string vulnerability (CWE-134)gtk_message_dialog_new's 5th arg is options->message directly; any %s/%n in the message body is interpreted as a format specifier. Fix: "%s", options->message. window_webkit6.c
2 Clipboard always empty for external contentgdk_clipboard_get_content() only returns non-NULL when your app owns the clipboard. Any text copied from another app returns empty. Correct API: gdk_clipboard_read_text_async + gdk_clipboard_read_text_finish with a GMainContext spin loop. clipboard_webkit6.go
3 GObject leak on every monitor queryg_list_model_get_item returns a ref the caller must unref. None of the screen/monitor code calls g_object_unref on returned GdkMonitor*. screen_webkit6.go, window_webkit6.c
4 free instead of g_free for accelerator stringgtk_accelerator_name allocates with GLib's allocator; passing the result to stdlib free is undefined behaviour. Use g_free. menu_webkit6.go
5 Asset truncation via partial stream readsg_input_stream_read is documented to return fewer bytes than requested. No retry loop means large assets are silently truncated. Use g_input_stream_read_all. webkit6.go
6 SoupMessageHeaders reference leaksoup_message_headers_new ref is never released after webkit_uri_scheme_response_set_http_headers. One ref leaked per asset request served. webkit6.go

High priority

# Issue File
7 NULL deref in drag-and-dropg_file_get_path returns NULL for non-local URIs (e.g. smb://, http://); strlen(NULL) follows. Guard with a NULL check. window_webkit6.c
8 Dual event loopg_main_loop_run is started in a goroutine alongside g_application_run. Running two GLib main loops simultaneously is unsupported and will produce unpredictable event dispatch. frontend_webkit6.go
9 GDK_BACKEND=x11 forced unconditionally — kills native Wayland support even though GTK4 supports it. Should only be set when XDG_SESSION_TYPE is x11 or unset. frontend_webkit6.go
10 defer inside for loop — all C.CString and g_menu_new allocations across loop iterations are held until function return, not freed at end of each iteration. menu_webkit6.go

Silent no-ops (functional gaps)

These APIs are commented out with no implementation. Callers get no error and silently broken behaviour:

  • SetPosition / GetPosition — always returns (0, 0)
  • SetMinMaxSize — does nothing
  • Center — does nothing
  • SetKeepAbove — does nothing
  • SetWindowIcon — does nothing
  • Screen.IsPrimary — always false

GTK4 did remove direct equivalents for some of these, but workarounds exist (X11 _NET_WM_STATE_ABOVE for always-on-top, monitor geometry for centering, signal-based size clamping for min/max). The v3 port has implementations for most of these.

Low priority

  • Debug g_print statements left in the onDragDrop callback (stdout noise in production)
  • strncat(paths, path, strlen(path)) — the safety argument is negated, this is identical to strcat
  • buttonPressedName allocated and freed but never passed to anything
  • dialog.go missing !webkit_6 build tag (fragile, will break if GTK3-specific includes are added)
  • GtkFileChooserDialog deprecated since GTK 4.10 (also present in v3; GtkFileDialog is the replacement but requires async handling)

Issues 3, 4, 5, 6 (GObject leak, wrong free, stream reads, soup leak) were also present in the v3 port and have been fixed in #5488. Issues 1, 7, 8, 9, 10 were either absent in v3 or already addressed differently.

@Sammy-T

Sammy-T commented May 29, 2026

Copy link
Copy Markdown
Author

I addressed most of the numbered items.

  • Item 2: Haven't looked at.
  • Item 9: Am I missing something? I'm not seeing where the issue is.
  • Item 8: It's been a while since I looked at this code. I don't remember why it's like that.
  • Item 6: Crashes with a signal arrived during cgo execution error when I try to add the unref.

@leaanthony, I don't know when I'll be able to properly revisit this code. But, in the meantime, you're plenty welcome to make whatever edits you need.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Upgrade to webkitgtk-6.0

3 participants