Repository navigation
Runtime Custom CSS JavaScript and cookie persistence - #19
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 08cd42ec51
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| public static void clearForFreshSession() { | ||
| CookieManager cookies = CookieManager.getInstance(); | ||
| cookies.removeAllCookies(null); |
There was a problem hiding this comment.
When COOKIE_PERSISTENCE_MODE is session and cookies remain from a previous Activity instance, removeAllCookies(null) performs deletion asynchronously, but MainActivity.onCreate() proceeds directly to the initial loadUrl. That first request can therefore still carry the previous authentication cookie, and deletion may then occur after the new page has begun establishing its session. Supply a callback and defer initial navigation until removal completes.
Useful? React with 👍 / 👎.
| if (CookiePersistencePolicy.usesEncryptedPersistence(AppConfig.COOKIE_PERSISTENCE_MODE)) { | ||
| sessionCookieStore = new QuantumSessionCookieStore(this); | ||
| sessionCookieStore.restore(); | ||
| } else if (savedInstanceState == null | ||
| && CookiePersistencePolicy.startsFreshSession(AppConfig.COOKIE_PERSISTENCE_MODE)) { | ||
| CookiePersistencePolicy.clearForFreshSession(); |
There was a problem hiding this comment.
When an installed app changes from the legacy/persistent mode to server or session, this branch stops constructing QuantumSessionCookieStore but leaves its previously captured encrypted payload in SharedPreferences. If a later app update selects persistent again, restore() revives that stale session cookie, including one that the session-mode startup was supposed to discard. Non-persistent modes should delete the custom store's saved payload as part of the mode transition.
Useful? React with 👍 / 👎.
| } else if (savedInstanceState == null | ||
| && CookiePersistencePolicy.startsFreshSession(AppConfig.COOKIE_PERSISTENCE_MODE)) { |
There was a problem hiding this comment.
When Android kills the app in the background and later recreates this Activity, it supplies a non-null savedInstanceState even though a new app process and cookie session have started. In session mode this condition therefore skips the fresh-session clear; any server-persistent authentication cookie remains available while restoreState() resumes the prior page, defeating session-only behavior after a common process-death restore. Session initialization must distinguish a new process from an in-process Activity recreation rather than relying solely on savedInstanceState.
Useful? React with 👍 / 👎.
| if (navigationPolicy.isTrustedHttps(url)) { | ||
| WebOverrides.apply(view); |
There was a problem hiding this comment.
When a trusted page rapidly navigates to an in-WebView data:, about:, or blob: document, this callback can still arrive with the completed trusted URL while evaluateJavascript() asynchronously targets the newer document. Because those schemes are deliberately allowed to remain in the WebView, the configured CSS and arbitrary JavaScript can execute on content outside the trusted HTTPS boundary. The injected script itself should verify the active document's origin at execution time rather than relying only on the callback URL.
Useful? React with 👍 / 👎.
Implements the Web Overrides runtime block: trusted-page Custom CSS injection, trusted-page Custom JavaScript execution, and configurable cookie persistence modes. Legacy Quantum/default cookie behavior remains persistent for compatibility. Includes unit tests and keeps Android 6/API 23 support.