WebView accesses the internet without Android network permissions (edit: false alarm?) #2456
-
|
Hi, But I noticed that, on Android, if my help pages happen to contain a link to Wikipedia, WebView would happily jump to that link, even if my app has no network permissions! How is this even possible? I know you could reply, "doctor, doctor, it hurts when I move my arm - don't move your arm, then." I may create my local files and be sure that there are only links to other local files, and no external links. But I wouldn't want my users to be concerned, when recognizing (or if I tell them) that the on-app manual runs a web server. Seems like a security hole to me. Proof-of-concept code attached: poc.zip -- If anyone knows of a way of serving local pages without permissions, I'd be interested. It is possible to fill in an HTML page to the WebView without any local server, by calling set_content instead of setting the "url" property, but then I don't see how links can be followed. Sorry for the false alarm! |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 1 reply
-
|
Glad to hear you worked this out; however, regarding the local pages - I suspect you'll find that the WebView isn't differentiating between localhost and any other address with respect to permissions. You're accessing localhost "over the network" because you're using network protocols to do so; the "hardware reality" of the situation doesn't really enter into consideration. And, as you've noted, set_content will let you show a single page, but not navigate between pages. This is essentially because there's no way for a page to know that the URL is "on the same server". You might be able to pull something together by catching the navigation request and manually setting the page to the new static content - but that's very much "off label" usage of Toga's webview - there definitely isn't a public API for that. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks very much for your time and suggestions. |
Beta Was this translation helpful? Give feedback.
Glad to hear you worked this out; however, regarding the local pages - I suspect you'll find that the WebView isn't differentiating between localhost and any other address with respect to permissions. You're accessing localhost "over the network" because you're using network protocols to do so; the "hardware reality" of the situation doesn't really enter into consideration.
And, as you've noted, set_content will let you show a single page, but not navigate between pages. This is essentially because there's no way for a page to know that the URL is "on the same server". You might be able to pull something together by catching the navigation request and manually setting the page to the new …