When handling autofill requests that represent web pages (typically + * view structures whose root's {@link android.app.assist.AssistStructure.ViewNode#getClassName()} + * is a {@link android.webkit.WebView}), the service should take the following steps to verify if + * the structure can be autofilled with the data associated with the app requesting it: + * + *
Here's an example on how to get the canonical domain using + * Guava: + * + *
+ * private static String getCanonicalDomain(String domain) {
+ * InternetDomainName idn = InternetDomainName.from(domain);
+ * while (!idn.isTopPrivateDomain() && idn != null) {
+ * idn = idn.parent();
+ * }
+ * return idn == null ? null : idn.toString();
+ * }
+ *
+ *
+ * If the association between the web domain and app package cannot be verified through the steps + * above, the service can still autofill the app, but it should warn the user about the potential + * data leakage first, and askfor the user to confirm. For example, the service could: + * + *
This same procedure could also be used when the autofillable data is contained inside an + * {@code IFRAME}, in which case the WebView generates a new autofill context when a node inside + * the {@code IFRAME} is focused, which the root node containing the {@code IFRAME}'s {@code src} + * attribute on {@link android.app.assist.AssistStructure.ViewNode#getWebDomain()}. A typical and + * legitimate use case for this scenario is a financial app that allows the user + * to login on different bank accounts. For example, a financial app {@code my_financial_app} could + * use a WebView that loads contents from {@code banklogin.my_financial_app.com}, which contains an + * {@code IFRAME} node whose {@code src} attribute is {@code login.some_bank.com}. When fulfilling + * that request, the service could add an + * {@link Dataset.Builder#setAuthentication(android.content.IntentSender) authenticated dataset} + * whose presentation displays "Username for some_bank.com" and + * "Password for some_bank.com". Then when the user taps one of these options, the service + * shows the disclaimer dialog explaining that selecting that option would release the + * {@code login.some_bank.com} credentials to the {@code my_financial_app}; if the user agrees, + * then the service returns an unlocked dataset with the {@code some_bank.com} credentials. + * + *
Note: The autofill service could also whitelist well-known browser apps and skip the + * verifications above, as long as the service can verify the authenticity of the browser app by + * checking its signing certificate. */ public abstract class AutofillService extends Service { private static final String TAG = "AutofillService"; @@ -424,7 +494,7 @@ public abstract class AutofillService extends Service { * {@link SaveCallback#onSuccess()} or {@link SaveCallback#onFailure(CharSequence)}) * to notify the result of the request. * - *
NOTE: to retrieve the actual value of the field, the service should call + *
Note: To retrieve the actual value of the field, the service should call * {@link android.app.assist.AssistStructure.ViewNode#getAutofillValue()}; if it calls * {@link android.app.assist.AssistStructure.ViewNode#getText()} or other methods, there is no * guarantee such method will return the most recent value of the field. diff --git a/core/java/android/webkit/WebView.java b/core/java/android/webkit/WebView.java index 650c7d97d357f..049f1efbb101c 100644 --- a/core/java/android/webkit/WebView.java +++ b/core/java/android/webkit/WebView.java @@ -2725,6 +2725,18 @@ public class WebView extends AbsoluteLayout * understood by the {@link android.service.autofill.AutofillService} implementations: * *