feat: add WebviewBuilder.disable_javascript and WebviewWindowBuilder.disable_javascript (#12821)

* feat: add `WebviewBuilder.disable_javascript` and `WebviewWindowBuilder.disable_javascript`

* wry 0.50.3

* add missing config options and API types

* add change file for api

---------

Co-authored-by: Lucas Nogueira <lucas@tauri.app>

.changes/disable-javascript-api.md

@@ -0,0 +1,6 @@
+---
+"@tauri-apps/api": minor:feat
+---
+
+Added `WindowOptions::javascriptDisabled` and `WebviewOptions::javascriptDisabled`.
+

.changes/disable-javascript.md

@@ -0,0 +1,6 @@
+---
+tauri: 'minor:feat'
+tauri-runtime-wry: 'minor:feat'
+---
+
+Add `WebviewBuilder.disable_javascript` and `WebviewWindowBuilder.disable_javascript` api to disable JavaScript.

Cargo.lock

@@ -10854,9 +10854,9 @@ checksum = "1e9df38ee2d2c3c5948ea468a8406ff0db0b29ae1ffde1bcf20ef305bcc95c51"
 
 [[package]]
 name = "wry"
-version = "0.50.0"
+version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eaa83204cc976ccffdc50559914edb93945f472863916c61de5cc772d452fb4a"
+checksum = "d2ec139df5102db821f92a42033c3fa0467c5ab434511e79c65881d6bdf2b369"
 dependencies = [
  "base64 0.22.1",
  "block2 0.6.0",

crates/tauri-cli/config.schema.json

@@ -527,6 +527,11 @@
               "type": "null"
             }
           ]
+        },
+        "javascriptDisabled": {
+          "description": "Whether we should disable JavaScript code execution on the webview or not.",
+          "default": false,
+          "type": "boolean"
         }
       },
       "additionalProperties": false

crates/tauri-runtime-wry/Cargo.toml

@@ -17,7 +17,7 @@ rustc-args = ["--cfg", "docsrs"]
 rustdoc-args = ["--cfg", "docsrs"]
 
 [dependencies]
-wry = { version = "0.50.0", default-features = false, features = [
+wry = { version = "0.50.3", default-features = false, features = [
   "drag-drop",
   "protocol",
   "os-webview",

crates/tauri-runtime-wry/src/lib.rs

@@ -4211,6 +4211,10 @@ fn create_webview<T: UserEvent>(
     });
   }
 
+  if webview_attributes.javascript_disabled {
+    webview_builder = webview_builder.with_javascript_disabled();
+  }
+
   if let Some(color) = webview_attributes.background_color {
     webview_builder = webview_builder.with_background_color(color.into());
   }

crates/tauri-runtime/src/webview.rs

@@ -218,6 +218,7 @@ pub struct WebviewAttributes {
   pub devtools: Option<bool>,
   pub background_color: Option<Color>,
   pub background_throttling: Option<BackgroundThrottlingPolicy>,
+  pub javascript_disabled: bool,
 }
 
 impl From<&WindowConfig> for WebviewAttributes {
@@ -254,6 +255,7 @@ impl From<&WindowConfig> for WebviewAttributes {
     if let Some(color) = config.background_color {
       builder = builder.background_color(color);
     }
+    builder.javascript_disabled = config.javascript_disabled;
     builder
   }
 }
@@ -285,6 +287,7 @@ impl WebviewAttributes {
       devtools: None,
       background_color: None,
       background_throttling: None,
+      javascript_disabled: false,
     }
   }
 

crates/tauri-schema-generator/schemas/config.schema.json

@@ -527,6 +527,11 @@
               "type": "null"
             }
           ]
+        },
+        "javascriptDisabled": {
+          "description": "Whether we should disable JavaScript code execution on the webview or not.",
+          "default": false,
+          "type": "boolean"
         }
       },
       "additionalProperties": false

crates/tauri-utils/src/config.rs

@@ -1717,6 +1717,9 @@ pub struct WindowConfig {
   /// see https://github.com/tauri-apps/tauri/issues/5250#issuecomment-2569380578
   #[serde(default, alias = "background-throttling")]
   pub background_throttling: Option<BackgroundThrottlingPolicy>,
+  /// Whether we should disable JavaScript code execution on the webview or not.
+  #[serde(default, alias = "javascript-disabled")]
+  pub javascript_disabled: bool,
 }
 
 impl Default for WindowConfig {
@@ -1770,6 +1773,7 @@ impl Default for WindowConfig {
       devtools: None,
       background_color: None,
       background_throttling: None,
+      javascript_disabled: false,
     }
   }
 }
@@ -3047,6 +3051,7 @@ mod build {
       let devtools = opt_lit(self.devtools.as_ref());
       let background_color = opt_lit(self.background_color.as_ref());
       let background_throttling = opt_lit(self.background_throttling.as_ref());
+      let javascript_disabled = self.javascript_disabled;
 
       literal_struct!(
         tokens,
@@ -3098,7 +3103,8 @@ mod build {
         use_https_scheme,
         devtools,
         background_color,
-        background_throttling
+        background_throttling,
+        javascript_disabled
       );
     }
   }

crates/tauri/src/webview/mod.rs

@@ -891,6 +891,17 @@ fn main() {
     self.webview_attributes.background_throttling = Some(policy);
     self
   }
+
+  /// Whether JavaScript should be disabled.
+  ///
+  /// ## Platform-specific
+  ///
+  /// - **Android:** Not implemented yet.
+  #[must_use]
+  pub fn disable_javascript(mut self) -> Self {
+    self.webview_attributes.javascript_disabled = true;
+    self
+  }
 }
 
 /// Webview.

crates/tauri/src/webview/plugin.rs

@@ -50,6 +50,8 @@ mod desktop_commands {
     zoom_hotkeys_enabled: bool,
     #[serde(default)]
     background_throttling: Option<BackgroundThrottlingPolicy>,
+    #[serde(default)]
+    javascript_disabled: bool,
   }
 
   #[cfg(feature = "unstable")]
@@ -66,6 +68,7 @@ mod desktop_commands {
       builder.webview_attributes.incognito = config.incognito;
       builder.webview_attributes.zoom_hotkeys_enabled = config.zoom_hotkeys_enabled;
       builder.webview_attributes.background_throttling = config.background_throttling;
+      builder.webview_attributes.javascript_disabled = config.javascript_disabled;
       builder
     }
   }

crates/tauri/src/webview/webview_window.rs

@@ -996,6 +996,17 @@ impl<R: Runtime, M: Manager<R>> WebviewWindowBuilder<'_, R, M> {
     self.webview_builder = self.webview_builder.background_throttling(policy);
     self
   }
+
+  /// Whether JavaScript should be disabled.
+  ///
+  /// ## Platform-specific
+  ///
+  /// - **Android:** Not implemented yet.
+  #[must_use]
+  pub fn disable_javascript(mut self) -> Self {
+    self.webview_builder = self.webview_builder.disable_javascript();
+    self
+  }
 }
 
 /// A type that wraps a [`Window`] together with a [`Webview`].

packages/api/src/webview.ts

@@ -791,6 +791,10 @@ interface WebviewOptions {
    * @since 2.3.0
    */
   backgroundThrottling?: BackgroundThrottlingPolicy
+  /**
+   * Whether we should disable JavaScript code execution on the webview or not.
+   */
+  javascriptDisabled?: boolean
 }
 
 export { Webview, getCurrentWebview, getAllWebviews }

packages/api/src/window.ts

@@ -2363,6 +2363,10 @@ interface WindowOptions {
    * @since 2.3.0
    */
   backgroundThrottling?: BackgroundThrottlingPolicy
+  /**
+   * Whether we should disable JavaScript code execution on the webview or not.
+   */
+  javascriptDisabled?: boolean
 }
 
 function mapMonitor(m: Monitor | null): Monitor | null {