moluopro · Sep 25, 2026 · Sep 25, 2026 · Sep 25, 2026 · Sep 25, 2026 · Sep 25, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -269,6 +269,12 @@ jobs:
           channel: stable
           cache: true
 
+      - name: Test native download policies
+        run: |
+          cmake -S webview_all_linux/linux/test -B build/linux-native-tests
+          cmake --build build/linux-native-tests
+          xvfb-run -a ctest --test-dir build/linux-native-tests --output-on-failure
+
       - name: Build Linux example
         working-directory: examples/platform
         run: |

diff --git a/docs/src/content/docs/guides/debugging.md b/docs/src/content/docs/guides/debugging.md
@@ -35,6 +35,23 @@ final windows = controller.platform as WindowsWebViewController;
 await windows.openDevTools();
 ```
 
+The plugin disables user access to DevTools by default in all build modes.
+Enable the menu and keyboard entry points (including F12 and Ctrl+Shift+I)
+per controller when needed:
+
+```dart
+await windows.setDevToolsEnabled(true);
+```
+
+Apply this setting before loading content; runtime changes take effect on the
+next top-level navigation. It does not close existing DevTools or prevent the
+app from calling `openDevTools()` explicitly.
+
+To allow user access only in debug builds, pass `devToolsEnabled: kDebugMode`
+to `WindowsWebViewControllerCreationParams`. Import `kDebugMode` from
+`package:flutter/foundation.dart`. Browser shortcuts must also be enabled for
+the DevTools shortcuts to work.
+
 Check runtime availability:
 
 ```dart

diff --git a/docs/src/content/docs/platforms/linux.md b/docs/src/content/docs/platforms/linux.md
@@ -29,6 +29,7 @@ runner realizes `FlView`; applications do not need to modify their runner.
 ```dart
 final params = const LinuxWebViewControllerCreationParams(
   developerExtrasEnabled: true,
+  downloadsEnabled: false,
   javascriptCanOpenWindowsAutomatically: true,
   mediaPlaybackRequiresUserGesture: false,
   mediaPlaybackAllowsInline: true,
@@ -45,12 +46,18 @@ final params = const LinuxWebViewControllerCreationParams(
 
 Each field is nullable. `null` leaves the WebKitGTK default unchanged.
 
+Downloads are allowed by default. Set `downloadsEnabled: false` at creation, or
+await `setDownloadsEnabled(false)` before loading content, to cancel new
+downloads before a file is saved. Ongoing downloads and other WebViews are not
+affected. Allowed downloads use WebKitGTK's default download destination.
+
 ## Controller API
 
 | API | Purpose |
 | --- | --- |
 | `setDeveloperExtrasEnabled(bool enabled)` | Enables WebKitGTK developer extras. |
 | `openDevTools()` | Opens the Web Inspector. |
+| `setDownloadsEnabled(bool enabled)` | Allows or cancels new downloads for this WebView. Enabled by default. |
 | `setJavaScriptCanOpenWindowsAutomatically(bool enabled)` | Controls JavaScript popups. |
 | `setMediaPlaybackRequiresUserGesture(bool require)` | Controls media autoplay policy. |
 | `setMediaPlaybackAllowsInline(bool allow)` | Controls inline media playback. |

diff --git a/docs/src/content/docs/platforms/web.md b/docs/src/content/docs/platforms/web.md
@@ -35,7 +35,7 @@ final controller = WebViewController.fromPlatformCreationParams(params);
 | Param | Meaning |
 | --- | --- |
 | `iFrameAllow` | Sets iframe `allow`. |
-| `iFrameSandbox` | Sets iframe `sandbox` when JavaScript is unrestricted. |
+| `iFrameSandbox` | Sets iframe sandbox permissions. Disabling JavaScript removes `allow-scripts` without adding permissions. |
 | `iFrameReferrerPolicy` | Sets iframe `referrerpolicy`. |
 | `iFrameAttributes` | Additional iframe attributes. `null` removes an attribute. |
 | `httpRequestFactory` | Test hook for fetch-backed loads. |
@@ -44,6 +44,11 @@ Attribute names are validated before they reach the DOM. Empty or malformed
 names are rejected, and `id`, `src`, and `srcdoc` are reserved because the
 controller owns iframe identity and document loading.
 
+An explicit sandbox is preserved when JavaScript is disabled, including an empty
+sandbox (all restrictions). Only `allow-scripts` is removed; switching back to
+unrestricted mode restores the configured value. Sandbox changes apply to the
+next document load, not to a document already loaded in the iframe.
+
 ## Controller API
 
 | API | Purpose |

diff --git a/docs/src/content/docs/platforms/windows.md b/docs/src/content/docs/platforms/windows.md
@@ -82,11 +82,26 @@ renderer if hardware device creation fails.
 ```dart
 final params = const WindowsWebViewControllerCreationParams(
   popupWindowPolicy: WindowsPopupWindowPolicy.sameWindow,
+  devToolsEnabled: false,
+  browserAcceleratorKeysEnabled: false,
+  downloadsEnabled: false,
 );
 
 final controller = WebViewController.fromPlatformCreationParams(params);
 ```
 
+DevTools user access is disabled by default in all build modes. Set
+`devToolsEnabled: true` to enable it, or use `kDebugMode` from
+`package:flutter/foundation.dart` to enable it only in debug builds.
+Browser shortcuts and downloads keep their native defaults (enabled) when
+omitted. The DevTools default and explicit settings are applied before the first navigation and retained
+when initialization is retried. A failed setting is reported to the caller;
+navigation remains blocked until the setting is successfully applied or changed.
+Disabling browser shortcuts requires `ICoreWebView2Settings3`; disabling downloads
+requires a successfully registered `ICoreWebView2_4` download handler. Unsupported
+restrictions report `not_supported`; native failures report `method_failed` with
+the setting name and HRESULT.
+
 `WindowsPopupWindowPolicy`:
 
 | Value | Behavior |
@@ -119,10 +134,18 @@ final widget = WebViewWidget.fromPlatformCreationParams(
 | `setPopupWindowPolicy(policy)` | Changes popup handling after creation. |
 | `setZoomFactor(double zoomFactor)` | Sets WebView2 zoom factor. |
 | `setCacheDisabled(bool disabled)` | Toggles cache bypass behavior. |
+| `setDevToolsEnabled(bool enabled)` | Controls the menu and keyboard shortcuts for opening DevTools. Disabled by default; does not block `openDevTools()`. |
+| `setBrowserAcceleratorKeysEnabled(bool enabled)` | Enables or disables browser accelerator keys such as F5, Ctrl+P, and Ctrl+F. Enabled by default. |
+| `setDownloadsEnabled(bool enabled)` | Allows new downloads or cancels them without saving the downloaded file. Enabled by default; ongoing downloads are unchanged. |
 | `dispose()` | Permanently releases this controller and its WebView2 resources. |
 
 Common APIs implemented on Windows include request loading with method, headers, and body; JavaScript execution; JavaScript channels; console messages; JavaScript dialogs; permission requests; HTTP errors; HTTP auth; SSL auth; scroll position; scrollbars; background color; user agent override; and overscroll styling.
 
+DevTools and browser-shortcut changes take effect on the next top-level
+navigation. Editing shortcuts such as copy and paste remain available; disabling
+browser shortcuts does not forward them to Flutter. These switches control
+WebView behavior and do not constitute a sandbox for untrusted content.
+
 `onNavigationRequest` covers controller loads and WebView2 main-frame navigations initiated by page content, including redirects and popups opened with `sameWindow`. Controller loads are approved before native dispatch so custom methods, headers, and bodies are preserved. Page-initiated navigations wait for the asynchronous Dart policy through cancel-and-replay, and the intentional cancellation is suppressed from `onWebResourceError`.
 
 Local files and Flutter assets use private randomized HTTPS hosts per controller. Paths are canonicalized, asset traversal and symlink escapes are rejected, cross-origin access is denied, and mappings are cleared before unrelated remote or inline navigation.

diff --git a/docs/src/content/docs/reference/platform-specific-api.md b/docs/src/content/docs/reference/platform-specific-api.md
@@ -35,15 +35,15 @@ Package: `webview_all_windows`.
 
 Main types: `WindowsWebViewController`, `WindowsWebViewWidget`, `WindowsNavigationDelegate`, `WindowsWebViewCookieManager`, `WindowsWebViewDataManager`, `WindowsWebViewCookie`, `WindowsPlatformSslAuthError`, `WindowsWebResourceRequest`, `WindowsWebResourceResponse`, `WindowsWebResourceError`.
 
-Important APIs: idempotent `ensureEnvironment`, strict `initializeEnvironment`, `getWebViewVersion`, `openDevTools`, `suspend`, `resume`, `setPopupWindowPolicy`, `setZoomFactor`, `setCacheDisabled`, Windows-specific deterministic `dispose`, full cookie set/query/delete. `WindowsWebViewDataManagerCreationParams` carries the same environment options into controller-independent data cleanup. Removing the widget does not dispose a reusable controller; call `dispose` only when its owner will never use it again.
+Important APIs: idempotent `ensureEnvironment`, strict `initializeEnvironment`, `getWebViewVersion`, `openDevTools`, `setDevToolsEnabled`, `setBrowserAcceleratorKeysEnabled`, `setDownloadsEnabled`, `suspend`, `resume`, `setPopupWindowPolicy`, `setZoomFactor`, `setCacheDisabled`, Windows-specific deterministic `dispose`, full cookie set/query/delete. `WindowsWebViewDataManagerCreationParams` carries the same environment options into controller-independent data cleanup. Removing the widget does not dispose a reusable controller; call `dispose` only when its owner will never use it again.
 
 ## Linux
 
 Package: `webview_all_linux`.
 
 Main types: `LinuxWebViewController`, `LinuxWebViewWidget`, `LinuxNavigationDelegate`, `LinuxWebViewCookieManager`, `LinuxWebViewDataManager`, `LinuxWebResourceRequest`, `LinuxWebResourceResponse`, `LinuxWebResourceError`, `LinuxPlatformWebViewPermissionRequest`, `LinuxPlatformSslAuthError`.
 
-Important APIs: WebKitGTK developer extras, Inspector, JS popup, media settings, page cache, file URL access, font size, zoom factor, and the pre-existing Linux-specific `dispose()` for optional early release. Normal cleanup is automatic through its finalizer; no common controller lifecycle API is added.
+Important APIs: WebKitGTK developer extras, Inspector, `setDownloadsEnabled`, JS popup, media settings, page cache, file URL access, font size, zoom factor, and the pre-existing Linux-specific `dispose()` for optional early release. Normal cleanup is automatic through its finalizer; no common controller lifecycle API is added.
 
 ## OHOS
 

diff --git a/docs/src/content/docs/zh/guides/debugging.md b/docs/src/content/docs/zh/guides/debugging.md
@@ -31,6 +31,20 @@ final version = await WindowsWebViewController.getWebViewVersion();
 
 `getWebViewVersion()` 可用于启动时确认 WebView2 Runtime 是否存在。
 
+插件在所有构建模式下默认关闭 DevTools 的用户入口，需要时可按 controller
+开启菜单和快捷键入口（包括 F12 和 Ctrl+Shift+I）：
+
+```dart
+await windows.setDevToolsEnabled(true);
+```
+
+建议在加载内容前设置；运行时修改会在下次顶层导航时生效。该开关不会关闭已经
+打开的 DevTools，也不影响应用主动调用 `openDevTools()`。
+
+如需仅在调试构建中开放用户入口，可在 `WindowsWebViewControllerCreationParams`
+中设置 `devToolsEnabled: kDebugMode`，并从 `package:flutter/foundation.dart`
+导入 `kDebugMode`。使用 DevTools 快捷键还需要保持浏览器快捷键启用。
+
 ## Linux
 
 ```dart

diff --git a/docs/src/content/docs/zh/platforms/linux.md b/docs/src/content/docs/zh/platforms/linux.md
@@ -24,6 +24,7 @@ Linux WebView 是 native GTK widget。插件会在标准 Flutter runner realize
 ```dart
 final params = const LinuxWebViewControllerCreationParams(
   developerExtrasEnabled: true,
+  downloadsEnabled: false,
   mediaPlaybackRequiresUserGesture: false,
   pageCacheEnabled: true,
   allowFileAccessFromFileUrls: false,
@@ -34,12 +35,17 @@ final params = const LinuxWebViewControllerCreationParams(
 
 所有字段都可为 `null`，表示保留 WebKitGTK 默认值。
 
+下载默认允许。可在创建时设置 `downloadsEnabled: false`，或在加载内容前等待
+`setDownloadsEnabled(false)` 完成，取消新下载并阻止保存文件。已开始的下载和
+其他 WebView 不受影响。允许下载时沿用 WebKitGTK 的默认保存位置。
+
 ## 主要 API
 
 | API | 作用 |
 | --- | --- |
 | `setDeveloperExtrasEnabled` | 启用开发者功能。 |
 | `openDevTools` | 打开 Web Inspector。 |
+| `setDownloadsEnabled` | 控制此 WebView 是否允许新下载，默认允许。 |
 | `setJavaScriptCanOpenWindowsAutomatically` | 控制 JS popup。 |
 | `setMediaPlaybackRequiresUserGesture` | 控制媒体自动播放。 |
 | `setMediaPlaybackAllowsInline` | 控制内联媒体播放。 |

diff --git a/docs/src/content/docs/zh/platforms/web.md b/docs/src/content/docs/zh/platforms/web.md
@@ -29,6 +29,10 @@ final params = WebWebViewControllerCreationParams(
 iframe 属性名会在写入 DOM 前校验。空名称、非法名称以及由控制器管理的
 `id`、`src`、`srcdoc` 都会被拒绝，避免破坏实例标识和加载状态。
 
+关闭 JavaScript 时会保留自定义 sandbox 的其他限制，仅移除 `allow-scripts`；
+空字符串仍表示启用全部 sandbox 限制。恢复 JavaScript 后会还原用户配置。
+sandbox 的修改在下次文档加载时生效，不会改变已经加载的文档。
+
 ## 主要 API
 
 | API | 作用 |

diff --git a/docs/src/content/docs/zh/platforms/windows.md b/docs/src/content/docs/zh/platforms/windows.md
@@ -58,14 +58,26 @@ controller 初始化失败时，组件中心会显示错误和恢复操作：
 帧捕获及其回调统一使用该 UI 线程队列，Direct3D 硬件设备创建失败时会回退到
 WARP 软件渲染器。
 
-## Popup 策略
+## 创建参数
 
 ```dart
 final params = const WindowsWebViewControllerCreationParams(
   popupWindowPolicy: WindowsPopupWindowPolicy.sameWindow,
+  devToolsEnabled: false,
+  browserAcceleratorKeysEnabled: false,
+  downloadsEnabled: false,
 );
 ```
 
+DevTools 用户入口在所有构建模式下默认关闭，可设置 `devToolsEnabled: true`
+开启；如需仅在调试构建中开启，可使用 `package:flutter/foundation.dart` 的
+`kDebugMode`。浏览器快捷键和下载省略配置时保持原生默认值（启用）。
+DevTools 默认配置及显式配置均会在首次导航前应用，初始化
+重试时也会保留。设置失败会返回错误，后续导航需等待该配置成功应用或被修改。
+禁用浏览器快捷键需要 `ICoreWebView2Settings3`，禁用下载需要成功注册
+`ICoreWebView2_4` 下载监听。不支持的限制返回 `not_supported`；原生调用失败
+返回 `method_failed`，错误详情包含设置名称和 HRESULT。
+
 | 值 | 行为 |
 | --- | --- |
 | `allow` | 允许 popup 新窗口。 |
@@ -82,8 +94,15 @@ final params = const WindowsWebViewControllerCreationParams(
 | `setPopupWindowPolicy` | 运行时修改 popup 策略。 |
 | `setZoomFactor` | 设置 WebView2 缩放因子。 |
 | `setCacheDisabled` | 控制请求是否绕过 cache。 |
+| `setDevToolsEnabled` | 控制通过菜单和快捷键打开 DevTools。默认关闭，不影响 `openDevTools()`。 |
+| `setBrowserAcceleratorKeysEnabled` | 启用或禁用浏览器快捷键，例如 F5、Ctrl+P 和 Ctrl+F。默认启用。 |
+| `setDownloadsEnabled` | 允许新下载，或在开始时取消并阻止保存下载文件。默认允许，不影响已开始的下载。 |
 | `dispose` | 永久释放此 controller 及其 WebView2 资源。 |
 
+开发者工具和浏览器快捷键设置会在下次顶层导航时生效。复制、粘贴等编辑快捷键
+不受影响；禁用浏览器快捷键也不会自动将按键交给 Flutter。这些开关用于控制
+WebView 行为，不是隔离不可信内容的完整安全沙箱。
+
 `onNavigationRequest` 会覆盖 controller 加载以及页面内容触发的 WebView2 主 frame 导航，包括 redirect 和 `sameWindow` popup。controller 请求在原生分发前完成判断，因此会保留自定义 method、headers 和 body；页面导航通过取消后等待异步 Dart 决策、放行后重放来实现，策略性取消不会触发 `onWebResourceError`。
 
 本地文件和 Flutter asset 会使用每个 controller 独立的随机 HTTPS host。路径会先规范化，asset 路径穿越和逃出 bundle 的符号链接会被拒绝，跨 origin 访问默认禁止，切换到无关的远程或 inline 内容前会清理映射。

diff --git a/docs/src/content/docs/zh/reference/platform-specific-api.md b/docs/src/content/docs/zh/reference/platform-specific-api.md
@@ -35,15 +35,15 @@ if (controller.platform is WindowsWebViewController) {
 
 主要类型：`WindowsWebViewController`、`WindowsWebViewWidget`、`WindowsNavigationDelegate`、`WindowsWebViewCookieManager`、`WindowsWebViewDataManager`、`WindowsWebViewCookie`、`WindowsPlatformSslAuthError`、`WindowsWebResourceRequest`、`WindowsWebResourceResponse`、`WindowsWebResourceError`。
 
-重要 API：幂等的 `ensureEnvironment`、严格的 `initializeEnvironment`、`getWebViewVersion`、`openDevTools`、`suspend`、`resume`、`setPopupWindowPolicy`、`setZoomFactor`、`setCacheDisabled`、Windows 专属的确定性 `dispose`、完整 cookie 设置/查询/删除。`WindowsWebViewDataManagerCreationParams` 可把同一套环境参数传给无需 controller 的数据清理。移除组件不会销毁仍可复用的 controller；仅在其所有者确认不再使用时调用 `dispose`。
+重要 API：幂等的 `ensureEnvironment`、严格的 `initializeEnvironment`、`getWebViewVersion`、`openDevTools`、`setDevToolsEnabled`、`setBrowserAcceleratorKeysEnabled`、`setDownloadsEnabled`、`suspend`、`resume`、`setPopupWindowPolicy`、`setZoomFactor`、`setCacheDisabled`、Windows 专属的确定性 `dispose`、完整 cookie 设置/查询/删除。`WindowsWebViewDataManagerCreationParams` 可把同一套环境参数传给无需 controller 的数据清理。移除组件不会销毁仍可复用的 controller；仅在其所有者确认不再使用时调用 `dispose`。
 
 ## Linux
 
 包：`webview_all_linux`。
 
 主要类型：`LinuxWebViewController`、`LinuxWebViewWidget`、`LinuxNavigationDelegate`、`LinuxWebViewCookieManager`、`LinuxWebViewDataManager`、`LinuxWebResourceRequest`、`LinuxWebResourceResponse`、`LinuxWebResourceError`、`LinuxPlatformWebViewPermissionRequest`、`LinuxPlatformSslAuthError`。
 
-重要 API：WebKitGTK developer extras、Inspector、JS popup、media settings、page cache、file URL access、font size、zoom factor，以及可选提前释放资源的既有 Linux 专属 `dispose()`。正常生命周期由 finalizer 自动清理，没有给公共 controller 增加生命周期 API。
+重要 API：WebKitGTK developer extras、Inspector、`setDownloadsEnabled`、JS popup、media settings、page cache、file URL access、font size、zoom factor，以及可选提前释放资源的既有 Linux 专属 `dispose()`。正常生命周期由 finalizer 自动清理，没有给公共 controller 增加生命周期 API。
 
 ## OHOS