Fix five known web_view JavaScript bridge defects

Harden lifecycle (drop queued outbound JS after release), re-validate origin
on the main thread, compare hosts case-insensitively, fix payload KDoc, and
exclude ERROR_CANCELLED from fallback triggers. Each fix has a regression test.

Co-authored-by: jacob.rakidzich <jacob.rakidzich@revenuecat.com>

Author: 2 people

ui/revenuecatui/src/main/kotlin/com/revenuecat/purchases/ui/revenuecatui/PaywallWebViewMessage.kt

@@ -36,21 +36,20 @@ public interface PaywallWebViewController {
 
     /**
      * Sends a `rc:variables` message into the web view targeting [componentId]. The SDK already replies
-     * with SDK-managed variables (such as `locale`); use this to provide additional values, typically
-     * nested under the `custom` key.
-     *
-     * Reserved SDK-managed top-level keys cannot be overwritten; provide app-specific values under
-     * `custom`.
+     * with SDK-managed variables (such as `locale`); use this to provide additional values. The flat
+     * [variables] map is sent as the transport envelope's `payload` field (not nested under a
+     * `variables` key). Reserved SDK-managed top-level keys cannot be overwritten; provide
+     * app-specific values under `custom`.
      */
     public fun postVariables(
         componentId: String,
         variables: Map<String, PaywallWebViewValue>,
     )
 
     /**
-     * Sends a message of the given [type] into the web view targeting [componentId], following the web
-     * view protocol envelope `{ "type", "component_id", "variables" }`. [variables] is delivered under
-     * the `variables` key. Use [postVariables] for the common `rc:variables` case.
+     * Sends a message of the given [type] into the web view targeting [componentId]. The flat
+     * [variables] map is sent as the transport envelope's `payload` field (not nested under a
+     * `variables` key). Use [postVariables] for the common `rc:variables` case.
      */
     public fun postMessage(
         componentId: String,

ui/revenuecatui/src/main/kotlin/com/revenuecat/purchases/ui/revenuecatui/components/webview/WebViewComponentView.kt

@@ -28,7 +28,6 @@ import com.revenuecat.purchases.ui.revenuecatui.components.stack.StackComponentV
 import com.revenuecat.purchases.ui.revenuecatui.components.style.WebViewComponentStyle
 import com.revenuecat.purchases.ui.revenuecatui.data.PaywallState
 import com.revenuecat.purchases.ui.revenuecatui.helpers.PaywallComponentInteractionTracker
-import java.net.URL
 
 @JvmSynthetic
 @Composable
@@ -85,7 +84,7 @@ internal fun WebViewComponentView(
                         WebViewJavaScriptBridge(
                             webView = this,
                             componentId = id,
-                            expectedUrl = URL(resolvedUrl),
+                            expectedUrl = resolvedUrl,
                             locale = locale,
                             messageHandler = null,
                             protocolVersion = style.protocolVersion ?: WebViewEnvelope.DEFAULT_PROTOCOL_VERSION,

ui/revenuecatui/src/main/kotlin/com/revenuecat/purchases/ui/revenuecatui/components/webview/WebViewJavaScriptBridge.kt

@@ -2,6 +2,7 @@
 
 package com.revenuecat.purchases.ui.revenuecatui.components.webview
 
+import android.net.Uri
 import android.os.Handler
 import android.os.Looper
 import android.webkit.JavascriptInterface
@@ -14,7 +15,7 @@ import com.revenuecat.purchases.ui.revenuecatui.helpers.Logger
 import com.revenuecat.purchases.ui.revenuecatui.toJsonObject
 import org.json.JSONObject
 import java.lang.ref.WeakReference
-import java.net.URL
+import java.util.Locale
 
 /**
  * Installs and drives the bidirectional bridge between a Paywalls V2 `web_view` component and native
@@ -30,20 +31,22 @@ import java.net.URL
  * the same connect/init handshake as on web. No document-start shim is injected.
  *
  * Because `addJavascriptInterface` provides no platform origin scoping, the bridge enforces the origin
- * itself: before delivering any inbound message it verifies the WebView's current URL still has the
- * same origin (scheme + host + port) as the resolved component URL, rejecting messages received after
- * navigation to an unexpected origin.
+ * itself: before delivering any inbound or outbound message it verifies the WebView's current URL still
+ * has the same origin (scheme + host + port) as the resolved component URL, rejecting messages received
+ * after navigation to an unexpected origin. Origin is always re-checked on the main thread at delivery
+ * time.
  *
  * ## Lifecycle & threading
  * The bridge holds only a [WeakReference] to the [WebView] (no Activity/Context), and stops delivering
  * messages once [release] is called. Inbound JavaScript callbacks arrive on a binder thread and are
  * hopped onto the main thread; app callbacks and all WebView interactions happen on the main thread.
+ * Outbound [WebView.evaluateJavascript] calls queued before [release] are dropped when they run.
  */
 @Suppress("LongParameterList", "TooManyFunctions")
 internal class WebViewJavaScriptBridge(
     webView: WebView,
     private val componentId: String,
-    expectedUrl: URL,
+    expectedUrl: String,
     locale: String,
     messageHandler: PaywallWebViewMessageHandler?,
     protocolVersion: Int = WebViewEnvelope.DEFAULT_PROTOCOL_VERSION,
@@ -103,8 +106,10 @@ internal class WebViewJavaScriptBridge(
      */
     @JavascriptInterface
     fun postMessage(json: String) {
-        if (released) return
-        mainHandler.post { handleInboundMessage(json) }
+        mainHandler.post {
+            if (released) return@post
+            handleInboundMessage(json)
+        }
     }
 
     @MainThread
@@ -314,7 +319,7 @@ internal class WebViewJavaScriptBridge(
     @MainThread
     private fun isOriginTrusted(webView: WebView, allowBeforeNavigation: Boolean): Boolean {
         if (expectedOrigin == null) return false
-        val currentOrigin = webView.url?.let { runCatching { URL(it).toOriginOrNull() }.getOrNull() }
+        val currentOrigin = webView.url?.toOriginOrNull()
         return when {
             currentOrigin == null -> allowBeforeNavigation
             else -> currentOrigin == expectedOrigin
@@ -323,9 +328,13 @@ internal class WebViewJavaScriptBridge(
 
     private fun runOnMainThread(block: () -> Unit) {
         if (Looper.myLooper() == Looper.getMainLooper()) {
+            if (released) return
             block()
         } else {
-            mainHandler.post(block)
+            mainHandler.post {
+                if (released) return@post
+                block()
+            }
         }
     }
 
@@ -345,13 +354,25 @@ internal class WebViewJavaScriptBridge(
 }
 
 /**
- * The origin of this URL as `scheme://host[:port]`, or `null` if it lacks a host. Only HTTPS URLs are
- * expected here (the resolver already enforces this), but the origin string includes the scheme so a
- * scheme change would also be detected.
+ * The origin of this URL as `scheme://host[:port]`, or `null` if it lacks a host. Host comparison is
+ * case-insensitive. Default ports (443 for https, 80 for http) are omitted.
  */
-private fun URL.toOriginOrNull(): String? {
-    val host = host?.takeIf { it.isNotBlank() } ?: return null
-    val effectivePort = if (port == -1) defaultPort else port
-    val portSuffix = if (effectivePort == -1) "" else ":$effectivePort"
-    return "$protocol://$host$portSuffix"
+@Suppress("ReturnCount", "MagicNumber")
+internal fun String.toOriginOrNull(): String? {
+    val uri = Uri.parse(this)
+    val scheme = uri.scheme?.lowercase(Locale.US) ?: return null
+    val host = uri.host?.takeIf { it.isNotBlank() }?.lowercase(Locale.US) ?: return null
+    val effectivePort = when {
+        uri.port != -1 -> uri.port
+        scheme == "https" -> 443
+        scheme == "http" -> 80
+        else -> -1
+    }
+    val portSuffix = when {
+        effectivePort == -1 -> ""
+        scheme == "https" && effectivePort == 443 -> ""
+        scheme == "http" && effectivePort == 80 -> ""
+        else -> ":$effectivePort"
+    }
+    return "$scheme://$host$portSuffix"
 }

ui/revenuecatui/src/test/kotlin/com/revenuecat/purchases/ui/revenuecatui/components/webview/WebViewJavaScriptBridgeTest.kt

@@ -14,13 +14,12 @@ import org.junit.runner.RunWith
 import org.robolectric.RobolectricTestRunner
 import org.robolectric.Shadows.shadowOf
 import org.robolectric.shadows.ShadowWebView
-import java.net.URL
 
 @RunWith(RobolectricTestRunner::class)
 internal class WebViewJavaScriptBridgeTest {
 
     private val componentId = "promo_web_view"
-    private val expectedUrl = URL("https://assets.example.com/promo/index.html")
+    private val expectedUrl = "https://assets.example.com/promo/index.html"
 
     private lateinit var webView: WebView
     private lateinit var shadowWebView: ShadowWebView
@@ -36,7 +35,7 @@ internal class WebViewJavaScriptBridgeTest {
     private fun bridge(
         handler: PaywallWebViewMessageHandler? = PaywallWebViewMessageHandler { message, _ -> received.add(message) },
         locale: String = "en-US",
-        navigateTo: URL? = expectedUrl,
+        navigateTo: String? = expectedUrl,
         sizeToContentWidth: Boolean = false,
         sizeToContentHeight: Boolean = false,
         onContentResize: (widthCssPx: Int?, heightCssPx: Int?) -> Unit = { _, _ -> },
@@ -52,7 +51,7 @@ internal class WebViewJavaScriptBridgeTest {
             onContentResize = onContentResize,
         )
         bridge.attach()
-        navigateTo?.let { webView.loadUrl(it.toString()) }
+        navigateTo?.let { webView.loadUrl(it) }
         return bridge
     }
 
@@ -251,9 +250,53 @@ internal class WebViewJavaScriptBridgeTest {
         assertThat(received).isEmpty()
     }
 
+    @Test
+    fun `does not execute queued outbound evaluateJavascript after release`() {
+        val bridge = bridge()
+        connect(bridge)
+        val background = Thread {
+            bridge.postMessage(
+                componentId = componentId,
+                type = "rc:queued",
+                variables = mapOf("foo" to PaywallWebViewValue.String("bar")),
+            )
+        }
+        background.start()
+        background.join()
+        bridge.release()
+        idleMainLooper()
+
+        assertThat(shadowWebView.lastEvaluatedJavascript).doesNotContain("rc:queued")
+    }
+
+    @Test
+    fun `re-validates origin at main-thread delivery after navigation race`() {
+        val bridge = bridge()
+        connect(bridge)
+        webView.loadUrl("https://evil.example.org/phish.html")
+        val background = Thread {
+            bridge.postMessage(appMessage(WebViewMessageType.STEP_LOADED))
+        }
+        background.start()
+        background.join()
+        idleMainLooper()
+
+        assertThat(received).isEmpty()
+    }
+
+    @Test
+    fun `treats host comparison as case insensitive`() {
+        val bridge = bridge(navigateTo = "https://Assets.Example.COM/promo/index.html")
+        connect(bridge)
+        bridge.postMessage(appMessage(WebViewMessageType.STEP_LOADED))
+        idleMainLooper()
+
+        assertThat(received).hasSize(1)
+    }
+
     @Test
     fun `rejects messages after navigation to an unexpected origin`() {
-        val bridge = bridge(navigateTo = URL("https://evil.example.org/phish.html"))
+        val bridge = bridge(navigateTo = "https://evil.example.org/phish.html")
         connect(bridge)
         bridge.postMessage(appMessage(WebViewMessageType.STEP_LOADED))
         idleMainLooper()
@@ -263,7 +306,7 @@ internal class WebViewJavaScriptBridgeTest {
 
     @Test
     fun `allows messages from the same origin on a different path`() {
-        val bridge = bridge(navigateTo = URL("https://assets.example.com/promo/step-two.html"))
+        val bridge = bridge(navigateTo = "https://assets.example.com/promo/step-two.html")
         connect(bridge)
         bridge.postMessage(appMessage(WebViewMessageType.STEP_LOADED))
         idleMainLooper()
@@ -273,7 +316,7 @@ internal class WebViewJavaScriptBridgeTest {
 
     @Test
     fun `does not deliver outbound messages after navigation to an unexpected origin`() {
-        val bridge = bridge(navigateTo = URL("https://evil.example.org/phish.html"))
+        val bridge = bridge(navigateTo = "https://evil.example.org/phish.html")
         connect(bridge)
         bridge.postMessage(
             componentId = componentId,
@@ -287,7 +330,7 @@ internal class WebViewJavaScriptBridgeTest {
 
     @Test
     fun `treats the default https port as the same origin`() {
-        val bridge = bridge(navigateTo = URL("https://assets.example.com:443/promo/index.html"))
+        val bridge = bridge(navigateTo = "https://assets.example.com:443/promo/index.html")
         connect(bridge)
         bridge.postMessage(
             componentId = componentId,