From 54127521a4fb2909993c67c7e38cded8b626d0ef Mon Sep 17 00:00:00 2001
From: Ying Zhong <0x00eeee@gmail.com>
Date: Wed, 16 Sep 2026 09:43:37 +0800
Subject: [PATCH] Isolate user scripts to main frame only

---
 MarkEditKit/Sources/EditorMessageHandler.swift                | 4 ++++
 .../Sources/Editor/Controllers/EditorViewController.swift     | 2 +-
 QuickLookMac/QuickLookConfig.swift                            | 2 +-
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/MarkEditKit/Sources/EditorMessageHandler.swift b/MarkEditKit/Sources/EditorMessageHandler.swift
index a3eee7b23..3f1362023 100644
--- a/MarkEditKit/Sources/EditorMessageHandler.swift
+++ b/MarkEditKit/Sources/EditorMessageHandler.swift
@@ -22,6 +22,10 @@ public final class EditorMessageHandler: NSObject, Sendable, WKScriptMessageHand
       return (nil, message)
     }
 
+    guard message.frameInfo.isMainFrame else {
+      return reportError("Native bridge is unavailable to subframes")
+    }
+
     guard message.name == "bridge", let body = message.body as? [String: Any] else {
       return reportError("Invalid message payload: \(message.name), \(message.body)")
     }
diff --git a/MarkEditMac/Sources/Editor/Controllers/EditorViewController.swift b/MarkEditMac/Sources/Editor/Controllers/EditorViewController.swift
index 55ef735ad..aab37b80a 100644
--- a/MarkEditMac/Sources/Editor/Controllers/EditorViewController.swift
+++ b/MarkEditMac/Sources/Editor/Controllers/EditorViewController.swift
@@ -148,7 +148,7 @@ final class EditorViewController: NSViewController {
       controller.addUserScript(WKUserScript(
         source: $0,
         injectionTime: .atDocumentEnd,
-        forMainFrameOnly: false
+        forMainFrameOnly: true
       ))
     }
 
diff --git a/QuickLookMac/QuickLookConfig.swift b/QuickLookMac/QuickLookConfig.swift
index 982df663f..dcace03f6 100644
--- a/QuickLookMac/QuickLookConfig.swift
+++ b/QuickLookMac/QuickLookConfig.swift
@@ -28,7 +28,7 @@ extension QuickLookViewController {
       WKUserScript(
         source: EditorUserAsset.script(for: url, contents: contents),
         injectionTime: .atDocumentEnd,
-        forMainFrameOnly: false
+        forMainFrameOnly: true
       )
     }
   }