Migrate from CEF to webview2

README.md

@@ -10,32 +10,32 @@ Sandcat is a lightweight multi-tabbed web browser that combines the speed and po
  * `/Resources` - resources package (Resources.pak)
 * `/src` - the main executable source and built-in resource files
  * `/core` - user interface source
+ * `/corewv2` - core source code that loads the renderer
  * `/html` - user interface resources (HTML)
  * `/lua` - Lua API source
 
 ## Download
 
 Compiled binaries for Windows can be downloaded from the links below.
 
-* [6.0 RC2 64-bit](https://dl.syhunt.net/tools/sandcat/sandcat-6.0rc2-win64.exe)
-* [6.0 RC2 32-bit](https://dl.syhunt.net/tools/sandcat/sandcat-6.0rc2-win32.exe)
-* [6.0 RC2 32-bit with Pen-Tester Tools](http://www.syhunt.com/en/?n=Syhunt.DownloadHybridCE) (included as part of Syhunt Community)
+* [7.0 64-bit](https://syhunt.fra1.cdn.digitaloceanspaces.com/tools/sandcat/syhunt-sandcat-7.0.0.exe)
+* [7.0 64-bit with Pen-Tester Tools](http://www.syhunt.com/en/?n=Syhunt.DownloadHybridCE) (included as part of Syhunt Community)
 
 ## Compiling
 
-For compiling Sandcat, you will just need [Catarinka](https://github.com/felipedaragon/catarinka) and [pLua](https://github.com/felipedaragon/pLua-XE).
+For compiling Sandcat, you will just need [Catarinka](https://github.com/exlunaproject/catarinka) and [pLua](https://github.com/exlunaproject/pLua-XE).
 
 The entire Sandcat user interface is created during runtime, so there is no need to install third-party components in the IDE - you can just add the dependencies listed above to the library path and hit compile. It compiles under Delphi 10 Seattle down to XE2.
 
 ## License & Credits
 
-Sandcat was developed by Felipe Daragon, [Syhunt](http://www.syhunt.com/).
+Sandcat was developed by Felipe Daragon, [Syhunt](https://www.syhunt.com/).
 
 This code is licensed under a 3-clause BSD license - see the LICENSE file for details.
 
 Third-party software used in Sandcat include:
 
-* [libcef](http://code.google.com/p/chromiumembedded), based on [Chromium](http://www.chromium.org/), is the engine at the heart of the Sandcat Browser. Sandcat can use the [WACEF3](https://bitbucket.org/WaspAce/wacef) (Chromium Embedded Framework) component or the [DCEF3](https://github.com/hgourvest/dcef3) library). Because we want Sandcat to use the latest Chromium binaries, the most up-to-date and stable wrapper is used for official Sandcat releases.
+* [WebView4Delphi](https://github.com/salvadordf/WebView4Delphi) is now the engine at the heart of the Sandcat Browser 7. In the past, Syhunt used CEF,  now it is built on top of Edge's webview2.
 * [Lua](http://www.lua.org/) - Developed by a small team at Pontifícia Universidade Católica do Rio de Janeiro (PUC-Rio), Lua is the core language used to develop Sandcat extensions as well as portions of the browser itself.
 * [TIScript](http://code.google.com/p/tiscript/) is an extended version of ECMAScript (JavaScript 1.x) developed by Terra Informatica Software and [@AndrewTerra](https://github.com/AndrewTerra), the developers of Sciter. It is used by Sandcat for some of its user interface operations.
 * **Sciter** is the engine currently used by Sandcat for rendering its user interface. Sciter supports TIScript execution and, in Sandcat, it can also execute Lua scripts and be manipulated from Lua scripts.

docs/objects.tab.md

@@ -48,15 +48,18 @@ details - a short description for the request
 
 * **tab:reload** ( ignorecache ): Reloads the page. If the first parameter is supplied and is true, the cache will be ignored.
 
-* **tab:runjs** ( jscode [,url, startline]): Executes a JavaScript code in the loaded page. The last two parameters are optional.
+* **tab:runjseval** ( jscode): Executes a JavaScript code in the loaded page and returns its result as JSON string.
+
+* **tab:runjs** ( jscode): Executes a JavaScript code in the loaded page.
 
 * **tab:runjs** ( luatable ): Performs a custom JavaScript call in the loaded page. The following keys can be provided:
  * code (required): the JavaScript code
  * url: the JS URL
  * startln: the start line number (default is 0)
  * silent: If supplied, and is true, JS execution errors are not reported. Default false.
+
+* **tab:runluaafterjs** (luacode,jscode): Runs a Lua script after executing a JavaScript code. It is possible to obtain the result of the JS execution through tab.lastjsexecresult in the form of a string.
 
-* **tab:runluaonlog** (msg,luacode): Sets a Lua script to be executed after a certain message is received through the JS console.log() method. This method should be used with caution.
 
 * **tab:runtask** ( luacode [,json, menuhtml] ): Executes a Lua code in an isolated process. The second parameter is optional and can be used to pass parameters to the task process. Returns an unique task ID. Returns `string`
 
@@ -81,6 +84,7 @@ capturebrowser|boolean|Enables or disables the live headers capture just for bro
 downloadfiles|boolean|Enables or disables the download capability
 headersfilter|string|Gets or sets the live headers filter
 icon|string|Gets or sets the tab icon
+lastjsexecresult|string|Gets the last JS result from a tab:runluaafterjs() call
 lastjslogmsg|string|Gets the last message from a JS console.log() call
 loadend|string|Sets a Lua script to be executed after the page finishes loading
 loadendjs|string|Sets a JavaScript to be executed after the page finishes loading

packs/Resources/consolecmds.lua

@@ -14,7 +14,8 @@ function M:AddCommands()
  console.addcmd('help','Sandcat.Commands:DisplayHelp()','Displays a screen with the list of commands available')
  console.addcmd('hide','browser.options.showconsole = false','Hides the console')
  console.addcmd('ip','print(ctk.net.nametoip(ctk.url.crack(tab.url).host))','Displays the server IP address')
- console.addcmd('js [code]','tab:runjs(cmd.params,tab.url,0)','Runs JavaScript Code in Loaded Page')
+ console.addcmd('js [code]','tab:runjs(cmd.params)','Runs JavaScript Code in Loaded Page')
+ console.addcmd('jseval [code]','print(tab:runjseval(cmd.params))','Evaluates JavaScript Code in Loaded Page')
  console.addcmd('jscs','console.setmode("js")','JS Console')
  console.addcmd('load [url]','Sandcat.Commands:LoadURL(cmd.params)','Goes to URL')
  console.addcmd('lp [path]','tab:gotourl(ctk.url.combine(tab.url,cmd.params))','Goes to URL path (eg: lp /admin)')

packs/Resources/dialog_about.html

@@ -46,7 +46,7 @@
 <img filename="%iconfilename%" style="width:32px;height:32px;behavior:file-icon;-icon-size:'large';"><br><br>
 <b>Syhunt &reg; %appname%</b><br><br>
 %ver%<br><br>
-Copyright &copy; 2022 Syhunt Application Security Company<br><br>
+Copyright &copy; 2023 Syhunt Application Security Company<br><br>
 URL: <a #abtlink href="#">%appurl%</a><br><br>
 Made possible by the <a #crmlink href="#">Chromium</a> project and other open source projects.<br><br>
 <hr width="100%">

packs/Resources/dialog_about.lua

@@ -5,13 +5,13 @@ function about:addcredits()
   browser.addlibinfo('Cromis','1.6.1','Iztok Kacin','browser.newtab([[http://www.opensource.org/licenses/bsd-license.php]])')
   if browser.info.ceflibrary == 'dcef' then
     browser.addlibinfo('DCEF library','3','Henri Gourvest')
-  end
+    browser.addlibinfo('libcef library','file:libcef.dll','The Chromium Embedded Framework Authors','browser.newtab([[chrome://license/]])')
+  end  
   browser.addlibinfo('DCPcrypt','v2 beta 2','David Barton','browser.newtab([[http://opensource.org/licenses/mit-license.php]])')
   browser.addlibinfo('Ext JS wrapper','0.9.8','Wanderlan Santos dos Anjos','browser.newtab([[http://www.opensource.org/licenses/bsd-license.php]])')
   browser.addlibinfo('FatCow Icons','3.5.0','<a href="#" onclick="browser.newtab([[http://www.fatcow.com/free-icons]])">FatCow</a>','Sandcat:ShowLicense(Sandcat.filename,[[docs\\License_FatCowIcons.txt]])')
   browser.addlibinfo('Fugue Icons','3.3.5','<a href="#" onclick="browser.newtab([[http://p.yusukekamiyamane.com/]])">Yusuke Kamiyamane</a>','Sandcat:ShowLicense(Sandcat.filename,[[docs\\License_FugueIcons.txt]])')
   browser.addlibinfo('ICU library','','IBM Corporation and others','Sandcat:ShowLicense(Sandcat.filename,[[docs\\License_icudt.txt]])')
-  browser.addlibinfo('libcef library','file:libcef.dll','The Chromium Embedded Framework Authors','browser.newtab([[chrome://license/]])')
   browser.addlibinfo('Lua','file:lua5.1.dll','Tecgraf/PUC-Rio','Sandcat:ShowLicense(Sandcat.filename,[[docs\\License_Lua5.txt]])')
   browser.addlibinfo('Custom Lua icon','','Yarin Kaul')
   browser.addlibinfo('ObjectCache library','1.0','Colin Wilson')
@@ -24,6 +24,10 @@ function about:addcredits()
   if browser.info.ceflibrary == 'wacef' then
     browser.addlibinfo('WACEF library','3','WaspAce Architector')
   end
+  if browser.info.ceflibrary == 'webview2' then
+    browser.addlibinfo('WebView2 library','file:WebView2Loader.dll','Microsoft Corporation')
+    browser.addlibinfo('WebView2 wrapper','','Salvador Díaz Fau','Sandcat:ShowLicense(Sandcat.filename,[[docs\\License_WebView4Delphi.txt]])')
+  end  
 end
 
 function about:show()

packs/Resources/docs/License_WebView4Delphi.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 Salvador Díaz Fau
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

packs/Resources/pagemenu.lua

@@ -90,7 +90,7 @@ function PageMenu:SaveCachedAs_Ask(filename)
  end
 end
 
-function PageMenu:SaveCachedAs(url)
+function PageMenu:SaveCachedAs_CEF(url)
   if url == nil then
    url = tab.url
   end
@@ -107,6 +107,10 @@ function PageMenu:SaveCachedAs(url)
   end
 end
 
+function PageMenu:SaveCachedAs(url)
+  app.showmessage('This option is not available in this release.')
+end
+
 function PageMenu:SavePageAs()
  if tab:hasloadedurl(true) then
   debug.print('Saving Page from the cloud...')

packs/Resources/tab_navbar-pagemenu.html

@@ -10,9 +10,9 @@
 <li id="topen" onclick="PageMenu:OpenPage()">Open...</li>
 <li id="tsavemenu" style="foreground-image: @ICON_SAVE;">Save Page
  <menu>
- <li id="tsavecached" style="foreground-image: url(Resources.pak#16\icon_savecached.png);" onclick="PageMenu:SaveCachedAs()">Save From Cache As...</li>
- <hr/>
  <li id="tsavefromweb" style="foreground-image: url(Resources.pak#16\icon_dloadpage.png);" onclick="PageMenu:SavePageAs()">Save From Web As...</li>
+ <hr/>
+ <li id="tsavecached" style="foreground-image: url(Resources.pak#16\icon_savecached.png);" onclick="PageMenu:SaveCachedAs()">Save From Cache As...</li>
  </menu>
 </li>
 <li id="tbookmarkpage" style="foreground-image: url(Resources.pak#16\icon_bookmark.png);">Bookmark Page</li>
@@ -33,7 +33,7 @@
   <li id="treloadfc" onclick="tab:gotourl(tab.url,tab.source)">Reload From Cache</li>
  </menu>
 </li>
-<li #auth onclick="tab:showauthdialog()">Authenticate...</li>
+<!--li #auth onclick="tab:showauthdialog()">Authenticate...</li-->
 <hr/>
 <li id="tzoom">Zoom
  <menu>

src/Sandcat.dpr

@@ -9,6 +9,10 @@ uses
   Windows,
   {$IFEND}
   uMain in 'core\uMain.pas' {SandBrowser} ,
+  CatChromium in 'corewv2\CatChromium.pas',
+  CatChromiumLib in 'corewv2\CatChromiumLib.pas',
+  CatChromiumOSRX in 'corewv2\CatChromiumOSRX.pas',
+  CatChromiumSB in 'corewv2\CatChromiumSB.pas',
   uZones in 'core\uZones.pas',
   uTaskMon in 'core\uTaskMon.pas',
   uUIComponents in 'core\uUIComponents.pas',

src/SandcatEngine.inc

@@ -0,0 +1 @@
+{$DEFINE USEWEBVIEW2}

src/core/uConst.pas

@@ -80,7 +80,7 @@ interface
   SCDIR_CACHE = 7;
   SCDIR_TASKS = 8;
   SCDIR_CONFIGSITE = 9;
-  
+
 const // Sciter related
   // Do not remove &nbsp - workaround for a weird AxSciter error when loading a blank html
   cBlank_Htm = '<html>&nbsp;</html>';

src/core/uLiveHeaders.pas

@@ -17,6 +17,7 @@   TSandcatRequestDetails = record
     Host: string;
     Port: string;
     ReqID: string;
+    ResourceID: int64;
     Details: string;
     Method: string;
     URL: string;

src/core/uMain.pas

@@ -2,18 +2,19 @@
 
 {
   Syhunt Sandcat Browser
-  Copyright (c) 2011-2017, Syhunt Informatica
+  Copyright (c) 2011-2023, Syhunt Informatica
 
   License: 3-clause BSD license
   See https://github.com/felipedaragon/sandcat/ for details.
 
   This software uses the Catarinka components. Catarinka is distributed under
-  the same license as Sandcat. Copyright (c) 2003-2014, Felipe Daragon
+  the same license as Sandcat. Copyright (c) 2003-2023, Felipe Daragon
 }
 
 interface
 
 {$I Catarinka.inc}
+{$I SandcatEngine.inc}
 
 uses
 {$IFDEF DXE2_OR_UP}
@@ -79,8 +80,8 @@ implementation
 
 uses uConst, uUIComponents, CatChromium, CatChromiumLib, uMisc, CatStrings,
   CatFiles,
-{$IFDEF USEWACEF}
-  waceflib,
+{$IFDEF USEWEBVIEW2}
+  uWVLoader,
 {$ELSE}
   ceflib,
 {$ENDIF}
@@ -104,17 +105,23 @@ function ExitBeforeInitializing: boolean;
   if fileexists(ProgDir+'\LocalAppData.json') then
     UseLocalAppData:=true;
   PluginsDir := GetSandcatDir(SCDIR_PLUGINS);
-  CefSingleProcess := false;
-{$IFDEF USEWACEF}
-  CefOnBeforeCommandLineProcessing := Settings.OnbeforeCmdLineWACEF;
-  CefCachePath := GetSandcatDir(SCDIR_CACHE);
+{$IFDEF USEWEBVIEW2}
+  GlobalWebView2Loader := TWVLoader.Create(nil);
+  if IsWindowsSeven = true  then
+  GlobalWebView2Loader.BrowserExecPath := 'C:\SyhuntUtils\Microsoft.WebView2.FixedVersionRuntime.109.0.1518.78.x64\';
+  GlobalWebView2Loader.UserDataFolder := GetSandcatDir(SCDIR_CACHE);
+  if s.AuditXSS = false then
+    GlobalWebView2Loader.AdditionalBrowserArguments := '--disable-xss-auditor';
+  GlobalWebView2Loader.StartWebView2;
 {$ELSE}
+  CefSingleProcess := false;
   CefOnBeforeCommandLineProcessing := OnbeforeCmdLine;
   CefCache := GetSandcatDir(SCDIR_CACHE);
-{$ENDIF}
   CefLocalesDirPath := ProgDir + 'Packs\CEF\Locales\';
   CefResourcesDirPath := ProgDir + 'Packs\CEF\Resources\';
   CefUserAgent := s.UserAgent;
+  CefRemoteDebuggingPort := 8000;
+{$ENDIF}
   if not CatCEFLoadLib then
   begin
     result := true; // This is a CEF renderer process
@@ -286,4 +293,6 @@ procedure TSandBrowser.FormClose(Sender: TObject; var Action: TCloseAction);
   Debug('cefshutdown.end');
 end;
 
+
+
 end.

src/core/uRequests.pas

@@ -1,7 +1,7 @@
 unit uRequests;
 {
   Sandcat HTTP Request Logger
-  Copyright (c) 2011-2014, Syhunt Informatica
+  Copyright (c) 2011-2023, Syhunt Informatica
   License: 3-clause BSD license
   See https://github.com/felipedaragon/sandcat/ for details.
 }
@@ -15,7 +15,6 @@ interface
 type
   TSandcatRequests = class
   private
-    fCriticalSection: TCriticalSection;
     fIsClosing: boolean;
     fLogRequests: boolean;
     fLoggedRequests: integer;
@@ -74,7 +73,10 @@ function TSandcatRequests.GetRequest(const jsonrequestfile: string)
   if RequestExists(jsonrequestfile) = false then
     exit;
   j := TSandJINI.Create;
+  try
   j.text := Cache.gettextfile(cReqFolder + jsonrequestfile);
+  except
+  end;
   result.URL := aestostr(j.Values['URL'],GetCatKey(CATKEY_REQUESTHEADERS));
   result.response := j.Values['Response'];
   result.MimeType := j.Values['MimeType'];
@@ -112,15 +114,20 @@ procedure TSandcatRequests.UpdateRequest(const jsonrequestfile: string;
   j.Free;
 end;
 
-// main procedure for logging a Sandcat Request (to a json file) - VFS
+// main procedure for logging a Sandcat Request (to a json file) in VFS
 procedure TSandcatRequests.LogRequest(request: TSandcatRequestDetails);
 var
   logfile: TSandJINI;
   hasreqid, canlog: boolean;
+  hdrmethod:string;
   procedure reconstruct_missing_details;
   begin
-    if request.Method = emptystr then // get it from the sent header
-      request.Method := before(request.SentHead, ' ');
+    if request.Method = emptystr then begin // get it from the sent header
+      request.method := 'GET';
+      hdrmethod := before(request.SentHead, ' ');
+      if hdrmethod = 'POST' then
+      request.Method := hdrmethod;
+    end;
     if request.URL = emptystr then
     begin
       // checks if host and port were provided and reconstruct from them
@@ -205,7 +212,11 @@ procedure TSandcatRequests.LogRequest(request: TSandcatRequestDetails);
     end;
   end;
   // showmessage('storing:'+logfile.text);
-  Cache.StoreString(cReqFolder + logfile.Filename, logfile.text);
+  try
+    Cache.StoreString(cReqFolder + logfile.Filename, logfile.text);
+  except
+  end;
+
   logfile.Free;
   if (request.details = 'Browser Request') and (hasreqid = true) then
     exit; // no need to add the request again to the live list
@@ -272,7 +283,6 @@ procedure TSandcatRequests.LogDynamicRequest(const json: string);
 constructor TSandcatRequests.Create(AOwner: TWinControl; MsgHandle: HWND);
 begin
   inherited Create;
-  fCriticalSection := TCriticalSection.Create;
   fTabHandle := MsgHandle;
   fLogRequests := true;
   fIsClosing := false;
@@ -281,7 +291,6 @@ constructor TSandcatRequests.Create(AOwner: TWinControl; MsgHandle: HWND);
 
 destructor TSandcatRequests.Destroy;
 begin
-  fCriticalSection.Free;
   inherited;
 end;