fix(driver): add --disable-web-security to the browser options

CHANGELOG.md

@@ -6,6 +6,8 @@
 
 ### Changed
 - Ferrum is bumped to `~> 0.19.0`
+- `--disable-web-security` is added to the browser options, since Ferrum dropped it from its defaults. Tests keep
+  reaching into cross-origin frames, e.g. `current_url` within a frame from another origin [rubycdp/ferrum#472]
 - Change `Node#send_keys` to avoid triggering `click` on an already focused element. `send_keys(:tab)` without an
   element no longer clicks the middle of the page first, so Tab moves focus from the start of the page, and Capybara's
   `#active_element` and `focused:` specs run in the suite [#327]

docs/2-customization.md

@@ -41,7 +41,8 @@ Cuprite changes a few Ferrum defaults:
 * `:save_path` - defaults to `Capybara.save_path` if it's set.
 * `:pending_connection_errors` - `true` by default.
 * `:browser_options` - `"remote-allow-origins" => "*"` is always added, so that
-  [debug](/docs/cuprite/debugging) can open DevTools.
+  [debug](/docs/cuprite/debugging) can open DevTools, and so is `"disable-web-security" => nil`, so that tests
+  can reach into cross-origin frames.
 
 ## Examples
 

lib/capybara/cuprite/driver.rb

@@ -42,6 +42,7 @@ def initialize(app, options = {})
         unless @options[:browser_options][:"remote-allow-origins"]
           @options[:browser_options].merge!("remote-allow-origins": "*")
         end
+        @options[:browser_options] = { "disable-web-security": nil }.merge(@options[:browser_options])
 
         super()
       end

spec/lib/driver_spec.rb

@@ -7,6 +7,12 @@
 
       expect(driver.browser.options.to_h[:browser_options]).to include("remote-allow-origins": "*")
     end
+
+    it "sets the disable-web-security option" do
+      driver = described_class.new(nil)
+
+      expect(driver.browser.options.to_h[:browser_options]).to include("disable-web-security": nil)
+    end
   end
 
   describe "raise_on_unhandled_modal configuration" do