e52907de01
Any site could call navigator.setAppBadge(n) and Electron drew n over the app's taskbar icon. Every site wrote the same single number, so the icon showed a count with no way to tell whose it was. A session-wide preload now removes the Badging API in pages and service workers, so sites fall back to their own title or favicon counters.
27 lines
1.2 KiB
JavaScript
27 lines
1.2 KiB
JavaScript
// no-badge-preload.js — session-wide preload (frames and service workers)
|
|
// that removes the web Badging API before any site code runs.
|
|
//
|
|
// navigator.setAppBadge(n) makes Electron draw n over the app's taskbar icon.
|
|
// Every site wrote that same single number, so the icon said "40" with no way
|
|
// to tell whose 40, and Theseus shows no unread counts on its icon at all.
|
|
// Deleting the methods (rather than making them do nothing) lets a site see a
|
|
// browser without badges and fall back to its own title or favicon counter.
|
|
// The Chromium switch --disable-blink-features=Badging no longer removes the
|
|
// API, which is why this runs as a preload. Electron runs no preload in an
|
|
// about:blank or srcdoc iframe, so a page could still reach the API through
|
|
// one; sites set their counts from the page or its service worker, which is
|
|
// what this covers.
|
|
const { contextBridge } = require("electron");
|
|
|
|
try {
|
|
contextBridge.executeInMainWorld({
|
|
func: () => {
|
|
for (const ctor of [globalThis.Navigator, globalThis.WorkerNavigator]) {
|
|
if (!ctor) continue;
|
|
for (const name of ["setAppBadge", "clearAppBadge"]) {
|
|
try { delete ctor.prototype[name]; } catch {}
|
|
}
|
|
}
|
|
},
|
|
});
|
|
} catch {}
|