Three WebView setup paths exist in the app. MyApplication.kt already wraps
setWebContentsDebuggingEnabled in 'if (BuildConfig.DEBUG)'. The other two
paths were missing the guard:
- MainActivity.onCreate calls WebView.setWebContentsDebuggingEnabled(true)
unconditionally at the end of onCreate. On a release build that leaves
chrome://inspect attachable from any USB-connected machine for any
WebView the app spawns later. CWE-489.
- MathMLRenderer.setupWebView does the same thing before constructing
the renderer WebView. Same exposure.
While in MathMLRenderer, drop settings.allowFileAccess = true. The
renderer only ever loads file:///android_asset/MathML-template.html, and
the android_asset scheme is permitted on every supported Android version
even when setAllowFileAccess(false) is in force. The flag is dead and
the WebView is set up with javaScriptEnabled = true + a JS bridge, so
leaving it on widens the surface for no benefit.
ChapterWebView intentionally keeps allowFileAccess = true because the
custom-font path renders @font-face src: url('file://<path>') against
the user-picked font file.
c0d0e57e79