You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cordova.apache.org by ag...@apache.org on 2014/11/06 21:49:26 UTC
[2/6] android commit: CB-7758: Allow content-url-hosted pages to
access the bridge
CB-7758: Allow content-url-hosted pages to access the bridge
This allows e.g. jsHybugger to create pages with access to Cordova APIs.
We restrict access to content provider URLs which are at subdomains of the application itself, ie, begin with "content://com.your.package.id."
Project: http://git-wip-us.apache.org/repos/asf/cordova-android/repo
Commit: http://git-wip-us.apache.org/repos/asf/cordova-android/commit/fc63f66e
Tree: http://git-wip-us.apache.org/repos/asf/cordova-android/tree/fc63f66e
Diff: http://git-wip-us.apache.org/repos/asf/cordova-android/diff/fc63f66e
Branch: refs/heads/4.0.x
Commit: fc63f66e8970ab537dda1397a6b58e6d61252c17
Parents: 832e626
Author: Ian Clelland <ic...@chromium.org>
Authored: Mon Oct 27 15:26:38 2014 -0400
Committer: Ian Clelland <ic...@chromium.org>
Committed: Mon Oct 27 15:26:38 2014 -0400
----------------------------------------------------------------------
framework/src/org/apache/cordova/CordovaBridge.java | 10 +++++++---
framework/src/org/apache/cordova/CordovaWebView.java | 2 +-
2 files changed, 8 insertions(+), 4 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cordova-android/blob/fc63f66e/framework/src/org/apache/cordova/CordovaBridge.java
----------------------------------------------------------------------
diff --git a/framework/src/org/apache/cordova/CordovaBridge.java b/framework/src/org/apache/cordova/CordovaBridge.java
index c3f10f3..f3e48b6 100644
--- a/framework/src/org/apache/cordova/CordovaBridge.java
+++ b/framework/src/org/apache/cordova/CordovaBridge.java
@@ -37,12 +37,14 @@ public class CordovaBridge {
private NativeToJsMessageQueue jsMessageQueue;
private volatile int expectedBridgeSecret = -1; // written by UI thread, read by JS thread.
private String loadedUrl;
+ private String appContentUrlPrefix;
- public CordovaBridge(PluginManager pluginManager, NativeToJsMessageQueue jsMessageQueue) {
+ public CordovaBridge(PluginManager pluginManager, NativeToJsMessageQueue jsMessageQueue, String packageName) {
this.pluginManager = pluginManager;
this.jsMessageQueue = jsMessageQueue;
+ this.appContentUrlPrefix = "content://" + packageName + ".";
}
-
+
public String jsExec(int bridgeSecret, String service, String action, String callbackId, String arguments) throws JSONException, IllegalAccessException {
if (!verifySecret("exec()", bridgeSecret)) {
return null;
@@ -165,7 +167,9 @@ public class CordovaBridge {
// Protect against random iframes being able to talk through the bridge.
// Trust only file URLs and the start URL's domain.
// The extra origin.startsWith("http") is to protect against iframes with data: having "" as origin.
- if (origin.startsWith("file:") || (origin.startsWith("http") && loadedUrl.startsWith(origin))) {
+ if (origin.startsWith("file:") ||
+ origin.startsWith(this.appContentUrlPrefix) ||
+ (origin.startsWith("http") && loadedUrl.startsWith(origin))) {
// Enable the bridge
int bridgeMode = Integer.parseInt(defaultValue.substring(9));
jsMessageQueue.setBridgeMode(bridgeMode);
http://git-wip-us.apache.org/repos/asf/cordova-android/blob/fc63f66e/framework/src/org/apache/cordova/CordovaWebView.java
----------------------------------------------------------------------
diff --git a/framework/src/org/apache/cordova/CordovaWebView.java b/framework/src/org/apache/cordova/CordovaWebView.java
index 862f2de..0c62b76 100755
--- a/framework/src/org/apache/cordova/CordovaWebView.java
+++ b/framework/src/org/apache/cordova/CordovaWebView.java
@@ -152,7 +152,7 @@ public class CordovaWebView extends WebView {
super.setWebViewClient(webViewClient);
pluginManager = new PluginManager(this, this.cordova, pluginEntries);
- bridge = new CordovaBridge(pluginManager, new NativeToJsMessageQueue(this, cordova));
+ bridge = new CordovaBridge(pluginManager, new NativeToJsMessageQueue(this, cordova), this.cordova.getActivity().getPackageName());
resourceApi = new CordovaResourceApi(this.getContext(), pluginManager);
pluginManager.addService("App", "org.apache.cordova.App");
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cordova.apache.org
For additional commands, e-mail: commits-help@cordova.apache.org