Skip to content

Commit d0d41f9

Browse files
david-allisoncriticalAY
authored andcommitted
!deprecation/security: remove setAcceptFileSchemeCookies
**Breaking change (security)**. Cards can no longer set or read `document.cookie` from file:// origins. I chose `CookieManager.getInstance()` to reduce code churn. `getWebViewPackage` is an alternative. **Deprecation: API 30** This setting is not secure, please use androidx.webkit.WebViewAssetLoader instead. Assisted-by: Claude Opus 4.6 - research Fixes 19863 ---- https://chromium.googlesource.com/chromium/src/+/refs/heads/main/android_webview/browser/cookie_manager.cc#867 https://chromium.googlesource.com/chromium/src/+/refs/heads/main/android_webview/glue/java/src/com/android/webview/chromium/CookieManagerAdapter.java
1 parent e6ff458 commit d0d41f9

1 file changed

Lines changed: 9 additions & 7 deletions

File tree

AnkiDroid/src/main/java/com/ichi2/anki/AnkiDroidApp.kt

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -190,8 +190,8 @@ open class AnkiDroidApp :
190190

191191
makeBackendUsable(this)
192192

193-
// Configure WebView to allow file scheme pages to access cookies.
194-
if (!acceptFileSchemeCookies()) {
193+
// Probe WebView availability before any other init touches it (#5794).
194+
if (!checkWebViewAvailable()) {
195195
return
196196
}
197197

@@ -331,18 +331,20 @@ open class AnkiDroidApp :
331331
notifications.postValue(null)
332332
}
333333

334-
@Suppress("deprecation") // 7109: setAcceptFileSchemeCookies
335-
protected fun acceptFileSchemeCookies(): Boolean =
334+
/**
335+
* Checks that [android.webkit.WebView] is usable.
336+
*/
337+
protected fun checkWebViewAvailable(): Boolean =
336338
try {
337-
CookieManager.setAcceptFileSchemeCookies(true)
339+
CookieManager.getInstance()
338340
true
339341
} catch (e: Throwable) {
340342
// 5794: Errors occur if the WebView fails to load
341343
// android.webkit.WebViewFactory.MissingWebViewPackageException.MissingWebViewPackageException
342344
// Error may be excessive, but I expect a UnsatisfiedLinkError to be possible here.
343345
fatalInitializationError = FatalInitializationError.WebViewError(e)
344-
sendExceptionReport(e, "setAcceptFileSchemeCookies")
345-
Timber.e(e, "setAcceptFileSchemeCookies")
346+
sendExceptionReport(e, "checkWebViewAvailable")
347+
Timber.e(e, "checkWebViewAvailable")
346348
false
347349
}
348350

0 commit comments

Comments
 (0)