fix(DefaultWebClient): allow file:// and javascript: navigations to fall through (#762)#1084
Open
jim-daf wants to merge 1 commit intoJustson:androidxfrom
Open
fix(DefaultWebClient): allow file:// and javascript: navigations to fall through (#762)#1084jim-daf wants to merge 1 commit intoJustson:androidxfrom
jim-daf wants to merge 1 commit intoJustson:androidxfrom
Conversation
jim-daf
force-pushed
the
fix/security-issue-762
branch
from
33ee6b8 to
9c2b828
Compare
…all through (Justson#762) Resolves Justson#762 DefaultWebClient.shouldOverrideUrlLoading explicitly handles http/https, then runs through phone/email/intent/wechat/alipay handlers, and finally intercepts every remaining URL when mIsInterceptUnkownUrl is true (the default). file:// links between bundled assets (the most common pattern for offline H5 apps that hit this method) end up in that final branch, which returns true and silently drops the navigation. The same is true of javascript: URLs. Two new scheme constants (FILE_SCHEME / JAVASCRIPT_SCHEME) are added near SCHEME_SMS, and both overloads of shouldOverrideUrlLoading return false as soon as they see one of those schemes, letting WebView handle the navigation itself.
jim-daf
changed the title
jim-daf
force-pushed
the
fix/security-issue-762
branch
from
9c2b828 to
30f3f0a
Compare
There was a problem hiding this comment.
Pull request overview
This PR adjusts DefaultWebClient.shouldOverrideUrlLoading to stop swallowing file:// and javascript: navigations when mIsInterceptUnkownUrl is enabled by default, restoring in-page navigation for locally bundled HTML (e.g., file:///android_asset/...) and javascript: links.
Changes:
- Added
FILE_SCHEMEandJAVASCRIPT_SCHEMEconstants. - Updated both
shouldOverrideUrlLoadingoverloads to returnfalseforfile://andjavascript:URLs so WebView can handle them.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+204
to
208
| if (url.startsWith(FILE_SCHEME) || url.startsWith(JAVASCRIPT_SCHEME)) { | ||
| return false; | ||
| } | ||
| if (!webClientHelper) { | ||
| return super.shouldOverrideUrlLoading(view, request); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Let
file://(andjavascript:) navigations fall through to WebViewResolves #762 - clicking a link inside a
file:///android_asset/...pagedoes nothing.
Why nothing happens
DefaultWebClient.shouldOverrideUrlLoadingis structured as:mIsInterceptUnkownUrlistrueby default, so any URL that doesn'tmatch http/https/tel/mailto/intent/weixin/alipays falls into the final
catch-all and returns
true— tellingWebView"I handled this, donot load it".
file:///android_asset/social/h5/other.htmlandjavascript:URLs both end up there, which is why the user's<a>link to a sibling local page silently does nothing.
Fix
agentweb-core/src/main/java/com/just/agentweb/DefaultWebClient.java:SCHEME_SMS:shouldOverrideUrlLoading(the modernWebResourceRequestone and the legacyStringone) returnfalseas soon as they see one of those schemes, letting
WebViewperformthe navigation itself.
This is the minimal change that restores in-page navigation for
locally-bundled HTML without weakening the existing intent/alipay/wechat
interception behavior.