From b75bc895a14ae861e9d444bd8fe6ea69e93401c2 Mon Sep 17 00:00:00 2001 From: Niklas Merz Date: Wed, 14 Jul 2021 08:12:30 +0200 Subject: [PATCH 1/2] fix: add WebViewAssetloader to default allow list Fixes #1217 --- framework/src/org/apache/cordova/AllowListPlugin.java | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/framework/src/org/apache/cordova/AllowListPlugin.java b/framework/src/org/apache/cordova/AllowListPlugin.java index 7b2e7873b7..ccb0e798ef 100644 --- a/framework/src/org/apache/cordova/AllowListPlugin.java +++ b/framework/src/org/apache/cordova/AllowListPlugin.java @@ -23,6 +23,7 @@ Licensed to the Apache Software Foundation (ASF) under one import org.apache.cordova.ConfigXmlParser; import org.apache.cordova.LOG; import org.apache.cordova.AllowList; +import org.apache.cordova.CordovaPreferences; import org.xmlpull.v1.XmlPullParser; import android.content.Context; @@ -73,12 +74,17 @@ public void pluginInitialize() { } private class CustomConfigXmlParser extends ConfigXmlParser { + private CordovaPreferences prefs = new CordovaPreferences(); + @Override public void handleStartTag(XmlPullParser xml) { String strNode = xml.getName(); if (strNode.equals("content")) { String startPage = xml.getAttributeValue(null, "src"); allowedNavigations.addAllowListEntry(startPage, false); + + // Allow origin for WebViewAssetLoader + allowedNavigations.addAllowListEntry("https://" + this.prefs.getString("hostname", "localhost") + "/" + startPage, false); } else if (strNode.equals("allow-navigation")) { String origin = xml.getAttributeValue(null, "href"); if ("*".equals(origin)) { From 7f5fbad04bce62ebedb3dd2dfd6d5b42aab6d118 Mon Sep 17 00:00:00 2001 From: Niklas Merz Date: Wed, 14 Jul 2021 08:44:50 +0200 Subject: [PATCH 2/2] Check assetloader flag See #1222 --- framework/src/org/apache/cordova/AllowListPlugin.java | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/framework/src/org/apache/cordova/AllowListPlugin.java b/framework/src/org/apache/cordova/AllowListPlugin.java index ccb0e798ef..3333180745 100644 --- a/framework/src/org/apache/cordova/AllowListPlugin.java +++ b/framework/src/org/apache/cordova/AllowListPlugin.java @@ -84,7 +84,9 @@ public void handleStartTag(XmlPullParser xml) { allowedNavigations.addAllowListEntry(startPage, false); // Allow origin for WebViewAssetLoader - allowedNavigations.addAllowListEntry("https://" + this.prefs.getString("hostname", "localhost") + "/" + startPage, false); + if (!this.prefs.getBoolean("AndroidInsecureFileModeEnabled", false)) { + allowedNavigations.addAllowListEntry("https://" + this.prefs.getString("hostname", "localhost"), false); + } } else if (strNode.equals("allow-navigation")) { String origin = xml.getAttributeValue(null, "href"); if ("*".equals(origin)) {