Ionic InAppBrowser调用executeScript访问Twitter遇CSP错误求助

2023年6月25日更新 #

回退到应用旧版本后功能恢复正常，显然是近6个月的代码修改引发了该问题。

原问题 #

在Android模拟器中，使用Ionic的@ionic-native/in-app-browser打开Twitter页面并调用executeScript时，页面抛出如下错误：

Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' <以及一些带通配符的URL，Stack Overflow不允许我在问题中包含>".

我的页面打开代码如下：

options = "location=yes,closebuttoncaption=" + buttonWording + ",usewkwebview=yes";
this.browserpopup = this.iab.create(this.temp_selected_link, '_blank', options);
this.browserpopup.on('loadstop').subscribe(event => {
      console.log('loadstop: event = ', event);
      console.log('About to call: this.browserpopup.executeScript');
      this.browserpopup.executeScript({
        code: "(function myFunction() { setTimeout(myFunction, 1000); const returnObject = {'url': '' } returnObject.url = window.location.href; return returnObject;} )()"
// 为简洁起见我精简了代码
      }, (returnObject) => {
        this.returnObject = returnObject;
        console.log('loadstop: returnObject = ', returnObject);
      })
    });

我原本期望returnObject每秒打印到控制台，但实际每秒都会抛出上述错误。

该代码在其他网页上可正常运行，但Twitter会触发错误。此功能之前对Twitter有效，推测是Twitter修改了CSP策略。

我尝试过在window.open对象上调用executeScript，但报错提示executeScript不是window的方法。

ionic info信息 #

Ionic:

   Ionic CLI                     : 7.1.1 
   Ionic Framework               : @ionic/angular 6.2.2
   @angular-devkit/build-angular : 14.1.2
   @angular-devkit/schematics    : 14.1.2
   @angular/cli                  : 14.1.2
   @ionic/angular-toolkit        : 2.3.3

Cordova:

   Cordova CLI       : 12.0.0 (cordova-lib@12.0.1)
   Cordova Platforms : android 11.0.0, ios 6.2.0
   Cordova Plugins   : cordova-plugin-ionic-webview 5.0.0, (and 18 other plugins)

Utility:

   cordova-res : 0.15.4
   native-run  : 1.7.2

System:

   Android SDK Tools : 26.1.1
   NodeJS            : v16.14.0
   npm               : 8.3.1
   OS                : Windows 10

ionic cordova plugin ls信息 #

com.telerik.plugins.nativepagetransitions 0.6.5 "Native Page Transitions"
cordova-admob-sdk 0.24.1 "AdMob SDK"
cordova-plugin-admob-free 0.27.0 "Cordova AdMob Plugin"
cordova-plugin-androidx-adapter 1.1.3 "cordova-plugin-androidx-adapter"
cordova-plugin-background-mode 0.7.3 "BackgroundMode"
cordova-plugin-badge 0.8.8 "Badge"
cordova-plugin-buildinfo 4.0.0 "BuildInfo"
cordova-plugin-camera 4.1.0 "Camera"
cordova-plugin-customurlscheme 5.0.2 "Custom URL scheme"
cordova-plugin-device 2.0.3 "Device"
cordova-plugin-file-transfer 1.7.1 "File Transfer"
cordova-plugin-file 6.0.2 "File"
cordova-plugin-firebase-messaging 7.0.4 "FirebaseMessagingPlugin"
cordova-plugin-inappbrowser 5.0.0 "InAppBrowser"
cordova-plugin-ionic-webview 5.0.0 "cordova-plugin-ionic-webview"
cordova-plugin-safariviewcontroller 2.0.0 "SafariViewController"
cordova-plugin-sign-in-with-apple 0.1.2 "cordova-plugin-sign-in-with-apple"
cordova-plugin-splashscreen 5.0.3 "Splashscreen"
cordova-plugin-statusbar 2.4.3 "StatusBar"
cordova-promise-polyfill 0.0.2 "cordova-promise-polyfill"
cordova-support-android-plugin 2.0.4 "cordova-support-android-plugin"

恳请提供解决该问题的建议，或能在InAppBrowser中获取Twitter页面数据的替代方案。

内容的提问来源于stack exchange，提问作者Jason Berwick