Atte149/book-reader
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(webview): gate setWebContentsDebuggingEnabled on BuildConfig.DEBUG and drop unused allowFileAccess in MathMLRenderer (#303)

Browse source 
Three WebView setup paths exist in the app. MyApplication.kt already wraps
setWebContentsDebuggingEnabled in 'if (BuildConfig.DEBUG)'. The other two
paths were missing the guard:

  - MainActivity.onCreate calls WebView.setWebContentsDebuggingEnabled(true)
    unconditionally at the end of onCreate. On a release build that leaves
    chrome://inspect attachable from any USB-connected machine for any
    WebView the app spawns later. CWE-489.

  - MathMLRenderer.setupWebView does the same thing before constructing
    the renderer WebView. Same exposure.

While in MathMLRenderer, drop settings.allowFileAccess = true. The
renderer only ever loads file:///android_asset/MathML-template.html, and
the android_asset scheme is permitted on every supported Android version
even when setAllowFileAccess(false) is in force. The flag is dead and
the WebView is set up with javaScriptEnabled = true + a JS bridge, so
leaving it on widens the surface for no benefit.

ChapterWebView intentionally keeps allowFileAccess = true because the
custom-font path renders @font-face src: url('file://<path>') against
the user-picked font file.
This commit is contained in:
Dimitris Dafnis 2026-05-14 08:56:38 +02:00 • committed by GitHub
parent 6897496423
commit c0d0e57e79
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 7 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
app/src/main/java/com/aryan/reader/paginatedreader/MathMLRenderer.kt
View file

@ -29,6 +29,7 @@ import android.webkit.JavascriptInterface
import android.webkit.WebChromeClient
import android.webkit.WebView
import android.webkit.WebViewClient
import com.aryan.reader.BuildConfig
import kotlinx.coroutines.CompletableDeferred
import kotlinx.coroutines.suspendCancellableCoroutine
import kotlinx.coroutines.withTimeoutOrNull
@ -75,12 +76,13 @@ class MathMLRenderer(private val context: Context) {
private fun setupWebView() {
try {
WebView.setWebContentsDebuggingEnabled(true)
if (BuildConfig.DEBUG) {
WebView.setWebContentsDebuggingEnabled(true)
}
webView = WebView(context).apply {
@SuppressLint("SetJavaScriptEnabled")
settings.javaScriptEnabled = true
settings.allowFileAccess = true
settings.domStorageEnabled = true
addJavascriptInterface(WebAppInterface { svg ->
completeCurrentJob(RenderResult.Success(svg))