From 9ad9ce53a3984a04a1f231d07804f3cebaa4d12c Mon Sep 17 00:00:00 2001 From: rjs580 Date: Wed, 4 Dec 2024 14:27:12 -0500 Subject: [PATCH 1/6] Set `setAllowFileAccess` to false by default Ensures file access is disabled by default for WebView since on older Android SDKs this defaults to true which can be a security risk. --- .../lib/src/android_webview_controller.dart | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/packages/webview_flutter/webview_flutter_android/lib/src/android_webview_controller.dart b/packages/webview_flutter/webview_flutter_android/lib/src/android_webview_controller.dart index c250a87d36a9..67107beae52b 100644 --- a/packages/webview_flutter/webview_flutter_android/lib/src/android_webview_controller.dart +++ b/packages/webview_flutter/webview_flutter_android/lib/src/android_webview_controller.dart @@ -89,6 +89,7 @@ class AndroidWebViewController extends PlatformWebViewController { _webView.settings.setUseWideViewPort(true); _webView.settings.setDisplayZoomControls(false); _webView.settings.setBuiltInZoomControls(true); + _webView.settings.setAllowFileAccess(false); _webView.setWebChromeClient(_webChromeClient); } @@ -353,6 +354,12 @@ class AndroidWebViewController extends PlatformWebViewController { void Function(ScrollPositionChange scrollPositionChange)? _onScrollPositionChangedCallback; + /// Sets the file access permission for the web view. + /// + /// Defaults to false. + Future setAllowFileAccess(bool allow) => + _webView.settings.setAllowFileAccess(allow); + /// Whether to enable the platform's webview content debugging tools. /// /// Defaults to false. From 7505ecde9ca3f2e0c1391eaf2d7ee3244f6eba64 Mon Sep 17 00:00:00 2001 From: rjs580 Date: Wed, 4 Dec 2024 15:57:22 -0500 Subject: [PATCH 2/6] Add support for file access configuration in WebView A new test for `setAllowFileAccess` was added to ensure file access permissions can be configured in `AndroidWebViewController`. This update also includes a version bump to 4.1.1 in `pubspec.yaml` and updates the changelog to reflect the new capabilities. --- .../webview_flutter_android/CHANGELOG.md | 4 ++++ .../webview_flutter_android/pubspec.yaml | 2 +- .../test/android_webview_controller_test.dart | 16 ++++++++++++++++ 3 files changed, 21 insertions(+), 1 deletion(-) diff --git a/packages/webview_flutter/webview_flutter_android/CHANGELOG.md b/packages/webview_flutter/webview_flutter_android/CHANGELOG.md index 16dcfd07e48c..f8a4726e1514 100644 --- a/packages/webview_flutter/webview_flutter_android/CHANGELOG.md +++ b/packages/webview_flutter/webview_flutter_android/CHANGELOG.md @@ -1,3 +1,7 @@ +## 4.1.1 + +* Adds support for configuring file access permissions. See `AndroidWebViewController.setAllowFileAccess`. + ## 4.1.0 * Updates internal API wrapper to use `ProxyApi`s. diff --git a/packages/webview_flutter/webview_flutter_android/pubspec.yaml b/packages/webview_flutter/webview_flutter_android/pubspec.yaml index 4ff9b6166a6d..1fe80e367b58 100644 --- a/packages/webview_flutter/webview_flutter_android/pubspec.yaml +++ b/packages/webview_flutter/webview_flutter_android/pubspec.yaml @@ -2,7 +2,7 @@ name: webview_flutter_android description: A Flutter plugin that provides a WebView widget on Android. repository: https://github.com/flutter/packages/tree/main/packages/webview_flutter/webview_flutter_android issue_tracker: https://github.com/flutter/flutter/issues?q=is%3Aissue+is%3Aopen+label%3A%22p%3A+webview%22 -version: 4.1.0 +version: 4.1.1 environment: sdk: ^3.5.0 diff --git a/packages/webview_flutter/webview_flutter_android/test/android_webview_controller_test.dart b/packages/webview_flutter/webview_flutter_android/test/android_webview_controller_test.dart index 6879c33253e7..167b660aa53f 100644 --- a/packages/webview_flutter/webview_flutter_android/test/android_webview_controller_test.dart +++ b/packages/webview_flutter/webview_flutter_android/test/android_webview_controller_test.dart @@ -1495,6 +1495,22 @@ void main() { expect(await controller.getUserAgent(), userAgent); }); + + test('setAllowFileAccess', () async { + final MockWebView mockWebView = MockWebView(); + final MockWebSettings mockSettings = MockWebSettings(); + final AndroidWebViewController controller = createControllerWithMocks( + mockWebView: mockWebView, + mockSettings: mockSettings, + ); + + clearInteractions(mockWebView); + + await controller.setAllowFileAccess(true); + + verify(mockWebView.settings).called(1); + verify(mockSettings.setAllowFileAccess(true)).called(1); + }); }); test('setMediaPlaybackRequiresUserGesture', () async { From b6cda938c3e96ac17c5791982aa027789c67adf4 Mon Sep 17 00:00:00 2001 From: rjs580 Date: Wed, 4 Dec 2024 16:01:06 -0500 Subject: [PATCH 3/6] The CHANGELOG.md document is updated to reflect explicitly setting `setAllowFileAccess` to `false` by default for Android SDK versions less than 29. --- packages/webview_flutter/webview_flutter_android/CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/packages/webview_flutter/webview_flutter_android/CHANGELOG.md b/packages/webview_flutter/webview_flutter_android/CHANGELOG.md index f8a4726e1514..c6f4e8b0f7b4 100644 --- a/packages/webview_flutter/webview_flutter_android/CHANGELOG.md +++ b/packages/webview_flutter/webview_flutter_android/CHANGELOG.md @@ -1,5 +1,6 @@ ## 4.1.1 +* Explicitly set WebView Settings `setAllowFileAccess` to `false` by default for Android SDK versions less than 29 to enhance security. * Adds support for configuring file access permissions. See `AndroidWebViewController.setAllowFileAccess`. ## 4.1.0 From dbc79919d1ec6aa964daa375099ab7b02dd7449c Mon Sep 17 00:00:00 2001 From: rjs580 Date: Fri, 6 Dec 2024 09:25:05 -0500 Subject: [PATCH 4/6] Update version to 4.2.0. This is considered to be a new API, hence the minor version changes. --- packages/webview_flutter/webview_flutter_android/CHANGELOG.md | 2 +- packages/webview_flutter/webview_flutter_android/pubspec.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/webview_flutter/webview_flutter_android/CHANGELOG.md b/packages/webview_flutter/webview_flutter_android/CHANGELOG.md index c6f4e8b0f7b4..bbd94df8b6c8 100644 --- a/packages/webview_flutter/webview_flutter_android/CHANGELOG.md +++ b/packages/webview_flutter/webview_flutter_android/CHANGELOG.md @@ -1,4 +1,4 @@ -## 4.1.1 +## 4.2.0 * Explicitly set WebView Settings `setAllowFileAccess` to `false` by default for Android SDK versions less than 29 to enhance security. * Adds support for configuring file access permissions. See `AndroidWebViewController.setAllowFileAccess`. diff --git a/packages/webview_flutter/webview_flutter_android/pubspec.yaml b/packages/webview_flutter/webview_flutter_android/pubspec.yaml index 1fe80e367b58..44f19b2af19c 100644 --- a/packages/webview_flutter/webview_flutter_android/pubspec.yaml +++ b/packages/webview_flutter/webview_flutter_android/pubspec.yaml @@ -2,7 +2,7 @@ name: webview_flutter_android description: A Flutter plugin that provides a WebView widget on Android. repository: https://github.com/flutter/packages/tree/main/packages/webview_flutter/webview_flutter_android issue_tracker: https://github.com/flutter/flutter/issues?q=is%3Aissue+is%3Aopen+label%3A%22p%3A+webview%22 -version: 4.1.1 +version: 4.2.0 environment: sdk: ^3.5.0 From 4e949feadb87b71b41029c289ae7f93b65f81bd6 Mon Sep 17 00:00:00 2001 From: rjs580 Date: Fri, 6 Dec 2024 12:42:38 -0500 Subject: [PATCH 5/6] This change no longer explicitly sets `setAllowFileAccess` to `false` for Android SDK versions less than 29. Developers can now configure the file access setting according to their specific needs using `AndroidWebViewController.setAllowFileAccess`. --- packages/webview_flutter/webview_flutter_android/CHANGELOG.md | 1 - .../lib/src/android_webview_controller.dart | 1 - 2 files changed, 2 deletions(-) diff --git a/packages/webview_flutter/webview_flutter_android/CHANGELOG.md b/packages/webview_flutter/webview_flutter_android/CHANGELOG.md index bbd94df8b6c8..24633e85bd86 100644 --- a/packages/webview_flutter/webview_flutter_android/CHANGELOG.md +++ b/packages/webview_flutter/webview_flutter_android/CHANGELOG.md @@ -1,6 +1,5 @@ ## 4.2.0 -* Explicitly set WebView Settings `setAllowFileAccess` to `false` by default for Android SDK versions less than 29 to enhance security. * Adds support for configuring file access permissions. See `AndroidWebViewController.setAllowFileAccess`. ## 4.1.0 diff --git a/packages/webview_flutter/webview_flutter_android/lib/src/android_webview_controller.dart b/packages/webview_flutter/webview_flutter_android/lib/src/android_webview_controller.dart index 67107beae52b..d4718eb6dad8 100644 --- a/packages/webview_flutter/webview_flutter_android/lib/src/android_webview_controller.dart +++ b/packages/webview_flutter/webview_flutter_android/lib/src/android_webview_controller.dart @@ -89,7 +89,6 @@ class AndroidWebViewController extends PlatformWebViewController { _webView.settings.setUseWideViewPort(true); _webView.settings.setDisplayZoomControls(false); _webView.settings.setBuiltInZoomControls(true); - _webView.settings.setAllowFileAccess(false); _webView.setWebChromeClient(_webChromeClient); } From a9bde734a41a714697c66ff8a229760f5636d9ed Mon Sep 17 00:00:00 2001 From: rjs580 Date: Thu, 12 Dec 2024 10:10:34 -0700 Subject: [PATCH 6/6] Adjust the documentation to clarify the default value of file access permissions. Apps targeting API 29 and below default to true, while those targeting API 30 and above default to false. This ensures better transparency in settings behavior. --- .../lib/src/android_webview_controller.dart | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/packages/webview_flutter/webview_flutter_android/lib/src/android_webview_controller.dart b/packages/webview_flutter/webview_flutter_android/lib/src/android_webview_controller.dart index d4718eb6dad8..3cde232ca9f9 100644 --- a/packages/webview_flutter/webview_flutter_android/lib/src/android_webview_controller.dart +++ b/packages/webview_flutter/webview_flutter_android/lib/src/android_webview_controller.dart @@ -355,7 +355,8 @@ class AndroidWebViewController extends PlatformWebViewController { /// Sets the file access permission for the web view. /// - /// Defaults to false. + /// The default value is true for apps targeting API 29 and below, and false + /// when targeting API 30 and above. Future setAllowFileAccess(bool allow) => _webView.settings.setAllowFileAccess(allow);