Merge branch 'dev' of https://github.com/AzureAD/microsoft-authentication-library-common-for-android into fadi/lab-migrate

Author: fadidurah

changelog.txt

@@ -4,6 +4,8 @@ vNext
 - [MINOR] Remove LruCache from SharedPreferencesFileManager (#2910)
 - [MINOR] Edge TB: Claims (#2925)
 - [PATCH] Update Moshi to 1.15.2 to resolve okio CVE-2023-3635 vulnerability (#3005)
+- [MINOR] Handle target="_blank" links in authorization WebView (#3010)
+- [MINOR] Handle openid-vc urls in webview (#3013)
 
 Version 24.0.1
 ----------

common/src/main/java/com/microsoft/identity/common/adal/internal/AuthenticationConstants.java

@@ -1312,6 +1312,13 @@ public static String computeMaxHostBrokerProtocol() {
          */
         public static final String AMAZON_APP_REDIRECT_PREFIX = "aea://";
 
+        /**
+         * Custom URI scheme prefix for OpenID Verifiable Credentials.
+         * WebView cannot load this scheme natively; it must be intercepted and
+         * forwarded to an external handler (wallet app) via an ACTION_VIEW intent.
+         */
+        public static final String OPENID_VC_SCHEME_PREFIX = "openid-vc://";
+
         /**
          * Prefix for the Authenticator MFA linking.
          */
@@ -1481,6 +1488,36 @@ public static String computeMaxHostBrokerProtocol() {
          */
         public static final String REDIRECT_SSL_PREFIX = "https://";
 
+        /**
+         * Path segment for the TLR (Total loss recovery) start page.
+         */
+        public static final String TLR_START_PATH = "/tlr/start";
+
+        /**
+         * WebView routing value when the target URL from a target=_blank navigation is null.
+         */
+        public static final String WEBVIEW_TARGET_BLANK_ROUTE_NULL_URL = "null_url";
+
+        /**
+         * WebView routing value when the target URL is not SSL-protected.
+         */
+        public static final String WEBVIEW_TARGET_BLANK_ROUTE_NON_SSL = "non_ssl";
+
+        /**
+         * WebView routing value when the target URL is loaded inline (non-TLR page).
+         */
+        public static final String WEBVIEW_TARGET_BLANK_ROUTE_NON_TLR = "non_tlr_flow";
+
+        /**
+         * WebView routing value when the target URL is delegated to the system browser (TLR page).
+         */
+        public static final String WEBVIEW_TARGET_BLANK_ROUTE_TLR = "tlr_flow";
+
+        /**
+         * WebView routing value when the popup was not initiated by a user gesture.
+         */
+        public static final String WEBVIEW_TARGET_BLANK_ROUTE_NO_USER_GESTURE = "no_user_gesture";
+
         /**
          * Prefix in the redirect for PlayStore.
          */

common/src/main/java/com/microsoft/identity/common/internal/providers/oauth2/WebViewAuthorizationFragment.java

@@ -40,14 +40,17 @@
 import android.net.Uri;
 import android.os.Build;
 import android.os.Bundle;
+import android.os.Message;
 import android.view.LayoutInflater;
 import android.view.MotionEvent;
 import android.view.View;
 import android.view.ViewGroup;
 import android.webkit.PermissionRequest;
 import android.webkit.WebChromeClient;
+import android.webkit.WebResourceRequest;
 import android.webkit.WebSettings;
 import android.webkit.WebView;
+import android.webkit.WebViewClient;
 import android.widget.ProgressBar;
 
 import androidx.activity.result.ActivityResultLauncher;
@@ -79,6 +82,7 @@
 import com.microsoft.identity.common.java.util.StringUtil;
 import com.microsoft.identity.common.logging.Logger;
 
+import com.microsoft.identity.common.java.opentelemetry.AttributeName;
 import java.io.UnsupportedEncodingException;
 import java.net.URLEncoder;
 import java.util.Arrays;
@@ -87,8 +91,14 @@
 
 import static com.microsoft.identity.common.java.AuthenticationConstants.OAuth2.UTID;
 
+import com.microsoft.identity.common.java.opentelemetry.OTelUtility;
+import com.microsoft.identity.common.java.opentelemetry.SpanExtension;
+import com.microsoft.identity.common.java.opentelemetry.SpanName;
 
+import io.opentelemetry.api.trace.Span;
 import io.opentelemetry.api.trace.SpanContext;
+import io.opentelemetry.api.trace.StatusCode;
+import io.opentelemetry.context.Scope;
 
 /**
  * Authorization fragment with embedded webview.
@@ -147,6 +157,7 @@ public void onCreate(@Nullable Bundle savedInstanceState) {
         if (activity != null) {
             WebViewUtil.setDataDirectorySuffix(activity.getApplicationContext());
         }
+
         if (CommonFlightsManager.INSTANCE.getFlightsProvider().isFlightEnabled(CommonFlight.ENABLE_LEGACY_FIDO_SECURITY_KEY_LOGIC)
                 && Build.VERSION.SDK_INT < Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
             mFidoLauncher = registerForActivityResult(
@@ -264,6 +275,14 @@ public void onPageLoaded(final String url) {
                         if (!mAuthResultSent && !StringExtensions.isNullOrBlank(javascriptToExecute[0])) {
                             mWebView.evaluateJavascript(javascriptToExecute[0], null);
                         }
+
+                        // Dynamically toggle multiple-windows support so that target="_blank"
+                        // interception is active ONLY on the TLR start page. On all other
+                        // pages the WebView behaves exactly as before.
+                        if (CommonFlightsManager.INSTANCE.getFlightsProvider()
+                                .isFlightEnabled(CommonFlight.ENABLE_WEBVIEW_MULTIPLE_WINDOWS)) {
+                            mWebView.getSettings().setSupportMultipleWindows(isTlrUrl(url));
+                        }
                     }
                 },
                 mRedirectUri,
@@ -352,6 +371,7 @@ public boolean onTouch(final View view, final MotionEvent event) {
         mWebView.getSettings().setUseWideViewPort(true);
         mWebView.getSettings().setBuiltInZoomControls(webViewZoomControlsEnabled);
         mWebView.getSettings().setSupportZoom(webViewZoomEnabled);
+
         mWebView.setVisibility(View.INVISIBLE);
         mWebView.setWebViewClient(webViewClient);
         mWebView.setWebChromeClient(new WebChromeClient() {
@@ -376,10 +396,125 @@ public Bitmap getDefaultVideoPoster() {
                 // We will return a 10x10 empty image, instead of the default grey playback image. #2424
                 return Bitmap.createBitmap(10, 10, Bitmap.Config.ARGB_8888);
             }
+
+            @Override
+            public boolean onCreateWindow(final WebView view, boolean isDialog,
+                                          boolean isUserGesture, final Message resultMsg) {
+                if (resultMsg.obj == null) {
+                    Logger.error(methodTag, "onCreateWindow: resultMsg.obj is null, cannot set up transport.", null);
+                    return false;
+                }
+
+                final SpanContext parentSpanContext = requireActivity() instanceof AuthorizationActivity
+                        ? ((AuthorizationActivity) requireActivity()).getSpanContext() : null;
+                final Span span = OTelUtility.createSpanFromParent(
+                        SpanName.WebViewTargetBlankNavigation.name(), parentSpanContext);
+                boolean windowHandled = false;
+                try (final Scope scope = SpanExtension.makeCurrentSpan(span)) {
+                    Logger.info(methodTag, "onCreateWindow: intercepting target=_blank navigation.");
+                    final WebView interceptorWebView = new WebView(view.getContext());
+                    interceptorWebView.setWebViewClient(new WebViewClient() {
+                        @Override
+                        public boolean shouldOverrideUrlLoading(WebView v, WebResourceRequest request) {
+                            handleInterceptedUrlFromNewWindow(view, v, request, span, isUserGesture);
+                            return true;
+                        }
+                    });
+                    final WebView.WebViewTransport transport = (WebView.WebViewTransport) resultMsg.obj;
+                    transport.setWebView(interceptorWebView);
+                    resultMsg.sendToTarget();
+                    // Span status and end are handled in handleInterceptedUrlFromNewWindow,
+                    // which fires asynchronously when shouldOverrideUrlLoading is called.
+                    windowHandled = true;
+                } catch (@NonNull final Exception e) {
+                    Logger.error(methodTag, "Error handling target=_blank navigation.", e);
+                    span.recordException(e);
+                    span.setStatus(StatusCode.ERROR);
+                    span.end();
+                }
+                return windowHandled;
+            }
         });
         setupPasskeyWebListener(mWebView, webViewClient);
     }
 
+    /**
+     * Handles the URL intercepted from a target=_blank navigation (onCreateWindow).
+     * Routes the URL based on whether the main WebView is currently on a TLR page:
+     * - TLR page: opens the URL in an external browser.
+     * - Non-TLR page: loads the URL inline in the main WebView.
+     *
+     * @param mainWebView        The main authentication WebView.
+     * @param interceptorWebView The temporary interceptor WebView (will be destroyed after handling).
+     * @param request            The intercepted URL request.
+     * @param span               The telemetry span to record which routing path is taken.
+     * @param isUserGesture      Whether the popup was initiated by a user gesture (e.g. a click).
+     */
+    @VisibleForTesting
+    void handleInterceptedUrlFromNewWindow(@NonNull final WebView mainWebView,
+                                                   @NonNull final WebView interceptorWebView,
+                                                   @NonNull final WebResourceRequest request,
+                                                   @NonNull final Span span,
+                                                   final boolean isUserGesture) {
+        final String methodTag = TAG + ":handleInterceptedUrlFromNewWindow";
+        try {
+            final String targetUrl = request.getUrl().toString();
+            final String currentPageUrl = mainWebView.getUrl();
+
+            if (targetUrl == null) {
+                span.setAttribute(AttributeName.target_blank_navigation_route.name(), AuthenticationConstants.Broker.WEBVIEW_TARGET_BLANK_ROUTE_NULL_URL);
+                Logger.warn(methodTag, "onCreateWindow: target URL is null, ignoring.");
+            } else if (!isUserGesture) {
+                // Not initiated by user gesture: load inline as a safe fallback instead of
+                // opening an external browser, to prevent programmatic/scripted popups.
+                span.setAttribute(AttributeName.target_blank_navigation_route.name(), AuthenticationConstants.Broker.WEBVIEW_TARGET_BLANK_ROUTE_NO_USER_GESTURE);
+                Logger.warn(methodTag, "onCreateWindow: popup not initiated by user gesture, loading URL inline.");
+                mainWebView.loadUrl(targetUrl);
+            } else if (!targetUrl.toLowerCase().startsWith(AuthenticationConstants.Broker.REDIRECT_SSL_PREFIX)) {
+                // Non-SSL URL: refuse to open, matching AzureActiveDirectoryWebViewClient behavior.
+                span.setAttribute(AttributeName.target_blank_navigation_route.name(), AuthenticationConstants.Broker.WEBVIEW_TARGET_BLANK_ROUTE_NON_SSL);
+                Logger.error(methodTag, "onCreateWindow: URL is not SSL protected, refusing to open.", null);
+            } else if (!isTlrUrl(currentPageUrl)) {
+                // Non-TLR page: load inline, same as WebView default behavior.
+                span.setAttribute(AttributeName.target_blank_navigation_route.name(), AuthenticationConstants.Broker.WEBVIEW_TARGET_BLANK_ROUTE_NON_TLR);
+                Logger.warn(methodTag, "onCreateWindow: non-TLR page, loading URL inline as fallback.");
+                mainWebView.loadUrl(targetUrl);
+            } else {
+                // TLR page: delegate to system browser so user can view terms externally.
+                span.setAttribute(AttributeName.target_blank_navigation_route.name(), AuthenticationConstants.Broker.WEBVIEW_TARGET_BLANK_ROUTE_TLR);
+                Logger.info(methodTag, "onCreateWindow: TLR page, delegating URL to system browser.");
+                final Intent browserIntent = new Intent(Intent.ACTION_VIEW, Uri.parse(targetUrl));
+                mainWebView.getContext().startActivity(browserIntent);
+            }
+            span.setStatus(StatusCode.OK);
+        } catch (final Exception e) {
+            span.recordException(e);
+            span.setStatus(StatusCode.ERROR);
+            Logger.error(methodTag, "Error handling target=_blank URL.", e);
+        } finally {
+            span.end();
+            // Destroy the interceptor WebView after it has served its purpose
+            interceptorWebView.post(interceptorWebView::destroy);
+        }
+    }
+
+    /**
+     * Checks whether the given URL corresponds to a TLR (Terms, License, and Restrictions)
+     * start page.
+     *
+     * @param url The URL to check.
+     * @return {@code true} if the URL is a TLR start page, {@code false} otherwise.
+     */
+    @VisibleForTesting
+    boolean isTlrUrl(@Nullable final String url) {
+        if (url == null) {
+            return false;
+        }
+        final String lowerUrl = url.toLowerCase();
+        return lowerUrl.startsWith(AuthenticationConstants.Broker.REDIRECT_SSL_PREFIX)
+                && lowerUrl.contains(AuthenticationConstants.Broker.TLR_START_PATH);
+    }
+
     /**
      * Loads starting authorization request url into WebView.
      */

common/src/main/java/com/microsoft/identity/common/internal/ui/webview/AzureActiveDirectoryWebViewClient.java

@@ -338,6 +338,10 @@ else if (isRedirectUrl(formattedURL)) {
             } else if (isAmazonAppRedirect(formattedURL)) {
                 Logger.info(methodTag, "It is an Amazon app request");
                 processAmazonAppUri(url);
+            } else if (isOpenIdVcUrl(formattedURL)) {
+                // TO-DO : Decide whether flight is needed in this case. https://identitydivision.visualstudio.com/Engineering/_workitems/edit/3541420
+                Logger.info(methodTag, "It is an OpenID Verifiable Credentials request.");
+                processOpenIdVcRequest(view, url);
             } else if (isInvalidRedirectUri(url)) {
                 Logger.info(methodTag,"Check for Redirect Uri.");
                 processInvalidRedirectUri(view, url);
@@ -496,6 +500,18 @@ private boolean isAmazonAppRedirect(@NonNull final String url) {
         return url.startsWith(AMAZON_APP_REDIRECT_PREFIX);
     }
 
+    /**
+     * Checks if the URL uses the openid-vc:// custom scheme.
+     * This scheme is used by OpenID Verifiable Credentials flows and must be
+     * intercepted so a registered wallet app can handle it.
+     *
+     * @param url The lowercase URL to check.
+     * @return true if the URL starts with the openid-vc:// scheme.
+     */
+    private boolean isOpenIdVcUrl(@NonNull final String url) {
+        return url.startsWith(AuthenticationConstants.Broker.OPENID_VC_SCHEME_PREFIX);
+    }
+
     private boolean isWebCpEnrollmentUrl(@NonNull final String url) {
         return url.startsWith(AuthenticationConstants.Broker.WEBCP_ENROLLMENT_URL);
     }
@@ -901,6 +917,43 @@ private void processAmazonAppUri(@NonNull final String url) {
         Logger.info(methodTag, "Sent Intent to launch Amazon app");
     }
 
+    /**
+     * Handles an openid-vc:// URL by stopping the WebView and launching an
+     * {@link Intent#ACTION_VIEW} intent so the system can route it to the
+     * registered wallet application.
+     *
+     * @param view The WebView that intercepted the navigation.
+     * @param url  The original (non-lowercased) openid-vc:// URL.
+     */
+    private void processOpenIdVcRequest(@NonNull final WebView view, @NonNull final String url) {
+        final String methodTag = TAG + ":processOpenIdVcRequest";
+        view.stopLoading();
+        final Span span = createSpanWithAttributesFromParent(SpanName.ProcessOpenIdVcRequest.name());
+        try (final Scope scope = SpanExtension.makeCurrentSpan(span)) {
+            final Intent intent = new Intent(Intent.ACTION_VIEW, Uri.parse(url));
+            intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+            if (intent.resolveActivity(getActivity().getPackageManager()) != null) {
+                getActivity().startActivity(intent);
+                Logger.info(methodTag, "Launched external handler for OpenID VC request.");
+                span.setAttribute(AttributeName.is_openid_vc_handler_found.name(), true);
+                span.setStatus(StatusCode.OK);
+            } else {
+                Logger.warn(methodTag, "No application found to handle openid-vc:// URI.");
+                span.setAttribute(AttributeName.is_openid_vc_handler_found.name(), false);
+                span.setStatus(StatusCode.ERROR, "No handler found for openid-vc:// URI");
+                returnError(ErrorStrings.ACTIVITY_NOT_FOUND, "No application found to handle the OpenID Verifiable Credentials request.");
+            }
+        } catch (final ActivityNotFoundException e) {
+            Logger.error(methodTag, "Failed to launch handler for openid-vc:// URI.", e);
+            span.setAttribute(AttributeName.is_openid_vc_handler_found.name(), false);
+            span.recordException(e);
+            span.setStatus(StatusCode.ERROR, "Failed to launch handler for openid-vc:// URI");
+            returnError(ErrorStrings.ACTIVITY_NOT_FOUND, "Failed to launch handler for the OpenID Verifiable Credentials request.");
+        } finally {
+            span.end();
+        }
+    }
+
     @VisibleForTesting(otherwise = VisibleForTesting.PRIVATE)
     protected void openLinkInBrowser(final String url) {
         final String methodTag = TAG + ":openLinkInBrowser";