[jira] [Closed] (CB-10939) BridgeSecret is 0 when cordova js is injected as inline script

["Matthew Ma (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CB-10939?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Matthew Ma closed CB-10939.
---------------------------
    Resolution: Workaround

Short version:
add {{<allow-navigation href="*" />}} to config.xml solved the problem.

Long version:
After stepping the code I found out.
The line {{if (pluginManager.shouldAllowBridgeAccess(origin)) }} in CordovaBridge.java needs to return true, otherwise the webview javascript to native android bridge won't be setup.
There are multiple reasons to cause it to return true.
* Latest Android System Webview will set origin to file:///android_assets/www/index.html even it is a remote website. for any file:///, the function will return true;
* Older version of android (4.2 Jelly bean) will somehow return true for the call because it could get navigation whitelist.

However, on android 5 without latest Webview. The {{isUrlWhiteListed()}} in Whitelist.java just won't return true. Setting the {{<allow-navigation href="*" />}} makes it work.

> BridgeSecret is 0 when cordova js is injected as inline script
> --------------------------------------------------------------
>
>                 Key: CB-10939
>                 URL: https://issues.apache.org/jira/browse/CB-10939
>             Project: Apache Cordova
>          Issue Type: Bug
>          Components: Android
>    Affects Versions: 5.1.1
>         Environment: Cordova 6.0.0 
> cordova android 5.1.1
> [cordova-plugin-fastrde-injectview|https://www.npmjs.com/package/cordova-plugin-fastrde-injectview] plugin.
>            Reporter: Matthew Ma
>            Priority: Blocker
>              Labels: android, cordova-6.0.0
>
> The [injectview|https://www.npmjs.com/package/cordova-plugin-fastrde-injectview] plugin looks great to me because I want to open an external website.
> The plugin injects cordova and its plugin js into the webview as inline script. I got device ready event and the cordova demo app looks good.
> However, I found out I can't not use things like navigator.camera.getPicture or navigator.notification.alert. After ruling out common mistake and I start to step the code.
> It turns out the bridgesecret in the js is 0 so it doesn't pass the 
> {code:java}
> if (!verifySecret("exec()", bridgeSecret)) {
>     return null;
> }
> {code}
> in CordovaBridge.java. If I comment out these three lines, things may works fine. but some callback such as camera won't fire.
> If I don't use remote website but use local www, this works fine.(without remove the injectView plugin). 
> I think the issue has something to do with the code injection plugin.
> Any thought? 



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For additional commands, e-mail: issues-help@cordova.apache.org