diff options
| author | Selim Gurun <sgurun@google.com> | 2012-09-12 17:02:51 -0700 |
|---|---|---|
| committer | Android Git Automerger <android-git-automerger@android.com> | 2012-09-12 17:02:51 -0700 |
| commit | 36562741f921b92d9a9f101c1cd2175dd9368bf9 (patch) | |
| tree | 55f58517e674912d399f1c6fababa52c4d239bfe /core/java/android/webkit/WebView.java | |
| parent | 0829a09f72ce3c10db273265824b95d648253955 (diff) | |
| parent | 6e28f1aacfa4c82ab0c8b740a24ed233b031272f (diff) | |
am 6e28f1aa: am 4f8da32f: Merge "Make JavascriptInterface annotation public." into jb-mr1-dev
* commit '6e28f1aacfa4c82ab0c8b740a24ed233b031272f':
Make JavascriptInterface annotation public.
Diffstat (limited to 'core/java/android/webkit/WebView.java')
| -rw-r--r-- | core/java/android/webkit/WebView.java | 25 |
1 files changed, 17 insertions, 8 deletions
diff --git a/core/java/android/webkit/WebView.java b/core/java/android/webkit/WebView.java index 8b9b777c76d4..9560e5bf313c 100644 --- a/core/java/android/webkit/WebView.java +++ b/core/java/android/webkit/WebView.java @@ -26,7 +26,6 @@ import android.graphics.Picture; import android.graphics.Rect; import android.graphics.drawable.Drawable; import android.net.http.SslCertificate; -import android.os.Build; import android.os.Bundle; import android.os.Looper; import android.os.Message; @@ -1494,10 +1493,20 @@ public class WebView extends AbsoluteLayout /** * Injects the supplied Java object into this WebView. The object is * injected into the JavaScript context of the main frame, using the - * supplied name. This allows the Java object's public methods to be - * accessed from JavaScript. Note that that injected objects will not + * supplied name. This allows the Java object's methods to be + * accessed from JavaScript. For API level {@link android.os.Build.VERSION_CODES#JELLY_BEAN_MR1} + * and above, only public methods that are annotated with + * {@link android.webkit.JavascriptInterface} can be accessed from JavaScript. + * For API level {@link android.os.Build.VERSION_CODES#JELLY_BEAN} or below, + * all public methods (including the inherited ones) can be accessed, see the + * important security note below for implications. Note that injected objects will not * appear in JavaScript until the page is next (re)loaded. For example: - * <pre> webView.addJavascriptInterface(new Object(), "injectedObject"); + * <pre> + * class JsObject { + * {@literal @}JavascriptInterface + * public String toString() { return "injectedObject"; } + * } + * webView.addJavascriptInterface(new JsObject(), "injectedObject"); * webView.loadData("<!DOCTYPE html><title></title>", "text/html", null); * webView.loadUrl("javascript:alert(injectedObject.toString())");</pre> * <p> @@ -1505,7 +1514,9 @@ public class WebView extends AbsoluteLayout * <ul> * <li> This method can be used to allow JavaScript to control the host * application. This is a powerful feature, but also presents a security - * risk, particularly as JavaScript could use reflection to access an + * risk for applications targeting API level + * {@link android.os.Build.VERSION_CODES#JELLY_BEAN} or below, because + * JavaScript could use reflection to access an * injected object's public fields. Use of this method in a WebView * containing untrusted content could allow an attacker to manipulate the * host application in unintended ways, executing Java code with the @@ -1514,6 +1525,7 @@ public class WebView extends AbsoluteLayout * <li> JavaScript interacts with Java object on a private, background * thread of this WebView. Care is therefore required to maintain thread * safety.</li> + * <li> The Java object's fields are not accessible.</li> * </ul> * * @param object the Java object to inject into this WebView's JavaScript @@ -1523,9 +1535,6 @@ public class WebView extends AbsoluteLayout public void addJavascriptInterface(Object object, String name) { checkThread(); mProvider.addJavascriptInterface(object, name); - // TODO in a separate CL provide logic to enable annotations for API level JB_MR1 and above. Don't forget to - // update the doc, set a link to annotation and unhide the annotation. - // also describe that fields of java objects are not accessible from JS. } /** |