Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

am efbbb182: Merge "cherrypick from klp-docs docs: security consideration for Android <4.2 Change-Id: I5fe51641539f7ffe7abcdb0618371dd3f4b62ab5" into klp-modular-docs

Browse Source 
* commit 'efbbb18241c8b74a2813b48af2aeff8f03fbe8e7':
  cherrypick from klp-docs docs: security consideration for Android <4.2 Change-Id: I5fe51641539f7ffe7abcdb0618371dd3f4b62ab5
This commit is contained in:
Robert Ly
2014-08-13 16:07:40 +00:00
committed by Android Git Automerger
parent a5365ed9dd efbbb18241
commit 9ada140fc1
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
core/java/android/webkit/WebView.java
View File

@@ -1637,9 +1637,12 @@ public class WebView extends AbsoluteLayout
* <ul> * <ul>
* <li> This method can be used to allow JavaScript to control the host * <li> This method can be used to allow JavaScript to control the host
* application. This is a powerful feature, but also presents a security * application. This is a powerful feature, but also presents a security
* risk for applications targeted to API level * risk for apps targeting {@link android.os.Build.VERSION_CODES#JELLY_BEAN} or earlier.
* {@link android.os.Build.VERSION_CODES#JELLY_BEAN} or below, because * Apps that target a version later than {@link android.os.Build.VERSION_CODES#JELLY_BEAN}
* JavaScript could use reflection to access an * are still vulnerable if the app runs on a device running Android earlier than 4.2.
* The most secure way to use this method is to target {@link android.os.Build.VERSION_CODES#JELLY_BEAN_MR1}
* and to ensure the method is called only when running on Android 4.2 or later.
* With these older versions, JavaScript could use reflection to access an
* injected object's public fields. Use of this method in a WebView * injected object's public fields. Use of this method in a WebView
* containing untrusted content could allow an attacker to manipulate the * containing untrusted content could allow an attacker to manipulate the
* host application in unintended ways, executing Java code with the * host application in unintended ways, executing Java code with the
@@ -1647,7 +1650,8 @@ public class WebView extends AbsoluteLayout
* method in a WebView which could contain untrusted content.</li> * method in a WebView which could contain untrusted content.</li>
* <li> JavaScript interacts with Java object on a private, background * <li> JavaScript interacts with Java object on a private, background
* thread of this WebView. Care is therefore required to maintain thread * thread of this WebView. Care is therefore required to maintain thread
* safety.</li> * safety.
* </li>
* <li> The Java object's fields are not accessible.</li> * <li> The Java object's fields are not accessible.</li>
* </ul> * </ul>
* *