From c0d0e57e7931d7b4af07e8d55f6940f2a523636c Mon Sep 17 00:00:00 2001
From: Dimitris Dafnis <68849116+jim-daf@users.noreply.github.com>
Date: Thu, 14 May 2026 08:56:38 +0200
Subject: [PATCH] fix(webview): gate setWebContentsDebuggingEnabled on
 BuildConfig.DEBUG and drop unused allowFileAccess in MathMLRenderer (#303)

Three WebView setup paths exist in the app. MyApplication.kt already wraps
setWebContentsDebuggingEnabled in 'if (BuildConfig.DEBUG)'. The other two
paths were missing the guard:

  - MainActivity.onCreate calls WebView.setWebContentsDebuggingEnabled(true)
    unconditionally at the end of onCreate. On a release build that leaves
    chrome://inspect attachable from any USB-connected machine for any
    WebView the app spawns later. CWE-489.

  - MathMLRenderer.setupWebView does the same thing before constructing
    the renderer WebView. Same exposure.

While in MathMLRenderer, drop settings.allowFileAccess = true. The
renderer only ever loads file:///android_asset/MathML-template.html, and
the android_asset scheme is permitted on every supported Android version
even when setAllowFileAccess(false) is in force. The flag is dead and
the WebView is set up with javaScriptEnabled = true + a JS bridge, so
leaving it on widens the surface for no benefit.

ChapterWebView intentionally keeps allowFileAccess = true because the
custom-font path renders @font-face src: url('file://<path>') against
the user-picked font file.
---
 app/src/main/java/com/aryan/reader/MainActivity.kt          | 4 +++-
 .../java/com/aryan/reader/paginatedreader/MathMLRenderer.kt | 6 ++++--
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/app/src/main/java/com/aryan/reader/MainActivity.kt b/app/src/main/java/com/aryan/reader/MainActivity.kt
index e746e7a..3033ca8 100644
--- a/app/src/main/java/com/aryan/reader/MainActivity.kt
+++ b/app/src/main/java/com/aryan/reader/MainActivity.kt
@@ -121,7 +121,9 @@ class MainActivity : AppCompatActivity() {
                 }
             }
         }
-        WebView.setWebContentsDebuggingEnabled(true)
+        if (BuildConfig.DEBUG) {
+            WebView.setWebContentsDebuggingEnabled(true)
+        }
     }
 
     override fun onNewIntent(intent: Intent) {
diff --git a/app/src/main/java/com/aryan/reader/paginatedreader/MathMLRenderer.kt b/app/src/main/java/com/aryan/reader/paginatedreader/MathMLRenderer.kt
index 4429fdd..c349d0a 100644
--- a/app/src/main/java/com/aryan/reader/paginatedreader/MathMLRenderer.kt
+++ b/app/src/main/java/com/aryan/reader/paginatedreader/MathMLRenderer.kt
@@ -29,6 +29,7 @@ import android.webkit.JavascriptInterface
 import android.webkit.WebChromeClient
 import android.webkit.WebView
 import android.webkit.WebViewClient
+import com.aryan.reader.BuildConfig
 import kotlinx.coroutines.CompletableDeferred
 import kotlinx.coroutines.suspendCancellableCoroutine
 import kotlinx.coroutines.withTimeoutOrNull
@@ -75,12 +76,13 @@ class MathMLRenderer(private val context: Context) {
 
     private fun setupWebView() {
         try {
-            WebView.setWebContentsDebuggingEnabled(true)
+            if (BuildConfig.DEBUG) {
+                WebView.setWebContentsDebuggingEnabled(true)
+            }
 
             webView = WebView(context).apply {
                 @SuppressLint("SetJavaScriptEnabled")
                 settings.javaScriptEnabled = true
-                settings.allowFileAccess = true
                 settings.domStorageEnabled = true
                 addJavascriptInterface(WebAppInterface { svg ->
                     completeCurrentJob(RenderResult.Success(svg))