book-reader/app/src/main/java/com/aryan/reader/MainActivity.kt
Dimitris Dafnis c0d0e57e79
fix(webview): gate setWebContentsDebuggingEnabled on BuildConfig.DEBUG and drop unused allowFileAccess in MathMLRenderer (#303)
Three WebView setup paths exist in the app. MyApplication.kt already wraps
setWebContentsDebuggingEnabled in 'if (BuildConfig.DEBUG)'. The other two
paths were missing the guard:

  - MainActivity.onCreate calls WebView.setWebContentsDebuggingEnabled(true)
    unconditionally at the end of onCreate. On a release build that leaves
    chrome://inspect attachable from any USB-connected machine for any
    WebView the app spawns later. CWE-489.

  - MathMLRenderer.setupWebView does the same thing before constructing
    the renderer WebView. Same exposure.

While in MathMLRenderer, drop settings.allowFileAccess = true. The
renderer only ever loads file:///android_asset/MathML-template.html, and
the android_asset scheme is permitted on every supported Android version
even when setAllowFileAccess(false) is in force. The flag is dead and
the WebView is set up with javaScriptEnabled = true + a JS bridge, so
leaving it on widens the surface for no benefit.

ChapterWebView intentionally keeps allowFileAccess = true because the
custom-font path renders @font-face src: url('file://<path>') against
the user-picked font file.
2026-05-14 12:26:38 +05:30

158 lines
5.7 KiB
Kotlin

/*
* Episteme Reader - A native Android document reader.
* Copyright (C) 2026 Episteme
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see <https://www.gnu.org/licenses/>.
*
* mail: epistemereader@gmail.com
*/
package com.aryan.reader
import android.content.Intent
import android.os.Build
import android.os.Bundle
import android.view.WindowManager
import android.webkit.WebView
import androidx.appcompat.app.AppCompatActivity
import androidx.activity.compose.setContent
import androidx.activity.enableEdgeToEdge
import androidx.activity.result.contract.ActivityResultContracts
import androidx.activity.viewModels
import androidx.annotation.RequiresApi
import androidx.compose.foundation.layout.fillMaxSize
import androidx.compose.material3.MaterialTheme
import androidx.compose.material3.Surface
import androidx.compose.material3.windowsizeclass.ExperimentalMaterial3WindowSizeClassApi
import androidx.compose.material3.windowsizeclass.calculateWindowSizeClass
import androidx.compose.runtime.Composable
import androidx.compose.runtime.DisposableEffect
import androidx.compose.ui.Modifier
import androidx.lifecycle.lifecycleScope
import androidx.navigation.compose.rememberNavController
import com.aryan.reader.data.PlatformFeaturesRepository
import com.aryan.reader.ui.theme.AppTheme
import kotlinx.coroutines.launch
import timber.log.Timber
import androidx.compose.foundation.isSystemInDarkTheme
import androidx.compose.runtime.getValue
import androidx.core.splashscreen.SplashScreen.Companion.installSplashScreen
import androidx.lifecycle.compose.collectAsStateWithLifecycle
import androidx.media3.common.util.UnstableApi
@UnstableApi
class MainActivity : AppCompatActivity() {
private val viewModel: MainViewModel by viewModels()
private lateinit var platformFeaturesRepository: PlatformFeaturesRepository
private val updateLauncher = registerForActivityResult(
ActivityResultContracts.StartIntentSenderForResult()
) { result ->
if (result.resultCode != RESULT_OK) {
Timber.e("Update flow failed! Result code: ${result.resultCode}")
}
}
@RequiresApi(Build.VERSION_CODES.VANILLA_ICE_CREAM)
@OptIn(ExperimentalMaterial3WindowSizeClassApi::class)
override fun onCreate(savedInstanceState: Bundle?) {
installSplashScreen()
enableEdgeToEdge()
super.onCreate(savedInstanceState)
platformFeaturesRepository = PlatformFeaturesRepository(this)
lifecycleScope.launch {
viewModel.reviewRequestEvent.collect {
platformFeaturesRepository.requestReview(this@MainActivity)
}
}
if (savedInstanceState == null) {
handleIntent(intent)
}
lifecycleScope.launch {
platformFeaturesRepository.checkForUpdates(this@MainActivity, updateLauncher)
}
setContent {
val uiState by viewModel.uiState.collectAsStateWithLifecycle()
ScreenCaptureProtectionEffect(enabled = uiState.isScreenCaptureProtectionEnabled)
val darkTheme = when (uiState.appThemeMode) {
AppThemeMode.LIGHT -> false
AppThemeMode.DARK -> true
AppThemeMode.SYSTEM -> isSystemInDarkTheme()
}
val textDimFactor = if (darkTheme) uiState.appTextDimFactorDark else uiState.appTextDimFactorLight
AppTheme(
darkTheme = darkTheme,
dynamicColor = uiState.appSeedColor == null,
seedColor = uiState.appSeedColor,
contrastLevel = uiState.appContrastOption.value,
textDimFactor = textDimFactor
) {
Surface(
modifier = Modifier.fillMaxSize(),
color = MaterialTheme.colorScheme.background
) {
val windowSizeClass = calculateWindowSizeClass(this)
val navController = rememberNavController()
AppNavigation(
navController = navController,
windowSizeClass = windowSizeClass,
viewModel = viewModel
)
}
}
}
if (BuildConfig.DEBUG) {
WebView.setWebContentsDebuggingEnabled(true)
}
}
override fun onNewIntent(intent: Intent) {
super.onNewIntent(intent)
handleIntent(intent)
}
private fun handleIntent(intent: Intent?) {
if (intent?.action == Intent.ACTION_VIEW && intent.data != null) {
Timber.d("Received VIEW intent with URI: ${intent.data}")
val uri = intent.data!!
viewModel.onFileSelected(uri, isFromRecent = false, isExternalIntent = true)
}
}
}
@Composable
private fun MainActivity.ScreenCaptureProtectionEffect(enabled: Boolean) {
DisposableEffect(enabled) {
if (enabled) {
window.addFlags(WindowManager.LayoutParams.FLAG_SECURE)
} else {
window.clearFlags(WindowManager.LayoutParams.FLAG_SECURE)
}
onDispose {
if (enabled) {
window.clearFlags(WindowManager.LayoutParams.FLAG_SECURE)
}
}
}
}