From 648ae6c1dd73c2a2b8fb6d108b43f12f2c9e2b65 Mon Sep 17 00:00:00 2001 From: bladexian94-code Date: Thu, 25 Jun 2026 21:57:17 +0200 Subject: [PATCH] Harden GeohashPickerActivity WebView security by blocking mixed content and restricting navigation to local asset only on experimental security branch. (#698) --- .../java/com/bitchat/android/ui/GeohashPickerActivity.kt | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/app/src/main/java/com/bitchat/android/ui/GeohashPickerActivity.kt b/app/src/main/java/com/bitchat/android/ui/GeohashPickerActivity.kt index b69926d0..e15f9930 100644 --- a/app/src/main/java/com/bitchat/android/ui/GeohashPickerActivity.kt +++ b/app/src/main/java/com/bitchat/android/ui/GeohashPickerActivity.kt @@ -10,6 +10,7 @@ import android.webkit.JavascriptInterface import android.webkit.WebChromeClient import android.webkit.WebSettings import android.webkit.WebView +import android.webkit.WebResourceRequest import android.webkit.WebViewClient import androidx.activity.compose.setContent import androidx.compose.foundation.layout.* @@ -104,10 +105,16 @@ class GeohashPickerActivity : OrientationAwareActivity() { settings.javaScriptEnabled = true settings.domStorageEnabled = true settings.cacheMode = WebSettings.LOAD_DEFAULT + settings.mixedContentMode = WebSettings.MIXED_CONTENT_NEVER_ALLOW settings.allowFileAccess = true settings.allowContentAccess = true webChromeClient = WebChromeClient() webViewClient = object : WebViewClient() { + override fun shouldOverrideUrlLoading(view: WebView?, request: WebResourceRequest?): Boolean { + val url = request?.url?.toString() ?: return true + // Block navigation away from the local geohash picker asset + return !url.startsWith("file:///android_asset/geohash_picker.html") + } override fun onPageFinished(view: WebView?, url: String?) { super.onPageFinished(view, url) // Initialize to last/initial geohash if provided, otherwise center