Investigate to enable webview in sandboxed environment

[bpasero]

According to @deepak1556 it seems possible to use webview even whith sandbox: true and contextIsolation: true. This would be great to explore given blocking issues such as #96307 for #83188.

I am unfortunately not able to get a simple webview based editor (release notes) to open in sandboxed environments, here are my steps:

• make sure to be able to run sources from ben/webview-sandbox branch (this simply adds webview code to sandbox layer)
• run with scripts/code.sh --__sandbox
• open command palette
• select Show Release Notes

Observe devtools (you can open via Cmd+Shift+I, but you need to click once into the workbench first for focus):

[Embedded Page] undefined

I was able to get a better error message when I flip contextIsolation: false (here):

[Embedded Page] Unable to load preload script: /Users/bpasero/Development/Microsoft/monaco/out/vs/workbench/contrib/webview/electron-browser/pre/electron-index.js
[Embedded Page] Error: module not found: ../../browser/pre/main

@mjbvz @deepak1556 I will need your help here for how to proceed. Any clues? I verified that these files are not getting blocked from our protocol, this must be something else...

[mjbvz]

@bpasero Looks like the webview preload script is using a file: uri which ends up being blocked:

file:///Users/matb/projects/vscode/out/vs/workbench/contrib/webview/electron-browser/pre/electron-index.js

@deepak1556 Would we be able to serve this script using a vscode-file or vscode-webview uri instead?

[bpasero]

@mjbvz @deepak1556 my understanding is that preload scripts for webview must use the file protocol, as any other protocol is blocked by Electron from loading. Since the preload scripts seems to be loaded using node.js, we cannot use our custom protocol.

Besides, if I disable our blocking of file protocol by comment out this line, it still does not work.

[bpasero]

Since we want to invest in #96307 which would give us a path to dropping webview entirely, moving this to Backlog for now.

[bpasero]

I am no longer convinced that webview is the future for sandbox, so closing.