permissionlesstech/bitchat-android
1
0
Fork 0
mirror of https://github.com/permissionlesstech/bitchat-android.git synced 2026-07-24 22:45:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

Harden GeohashPickerActivity WebView security by blocking mixed content and restricting navigation to local asset only on experimental security branch. (#698)

Browse Source
This commit is contained in:
bladexian94-code
2026-06-25 21:57:17 +02:00
committed by GitHub
parent 13c771aa29
commit 648ae6c1dd
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/src/main/java/com/bitchat/android/ui/GeohashPickerActivity.kt
+7
View File
@@ -10,6 +10,7 @@ import android.webkit.JavascriptInterface
import android.webkit.WebChromeClient import android.webkit.WebChromeClient
import android.webkit.WebSettings import android.webkit.WebSettings
import android.webkit.WebView import android.webkit.WebView
import android.webkit.WebResourceRequest
import android.webkit.WebViewClient import android.webkit.WebViewClient
import androidx.activity.compose.setContent import androidx.activity.compose.setContent
import androidx.compose.foundation.layout.* import androidx.compose.foundation.layout.*
@@ -104,10 +105,16 @@ class GeohashPickerActivity : OrientationAwareActivity() {
settings.javaScriptEnabled = true settings.javaScriptEnabled = true
settings.domStorageEnabled = true settings.domStorageEnabled = true
settings.cacheMode = WebSettings.LOAD_DEFAULT settings.cacheMode = WebSettings.LOAD_DEFAULT
settings.mixedContentMode = WebSettings.MIXED_CONTENT_NEVER_ALLOW
settings.allowFileAccess = true settings.allowFileAccess = true
settings.allowContentAccess = true settings.allowContentAccess = true
webChromeClient = WebChromeClient() webChromeClient = WebChromeClient()
webViewClient = object : WebViewClient() { webViewClient = object : WebViewClient() {
override fun shouldOverrideUrlLoading(view: WebView?, request: WebResourceRequest?): Boolean {
val url = request?.url?.toString() ?: return true
// Block navigation away from the local geohash picker asset
return !url.startsWith("file:///android_asset/geohash_picker.html")
}
override fun onPageFinished(view: WebView?, url: String?) { override fun onPageFinished(view: WebView?, url: String?) {
super.onPageFinished(view, url) super.onPageFinished(view, url)
// Initialize to last/initial geohash if provided, otherwise center // Initialize to last/initial geohash if provided, otherwise center