WebView is very powerful, but it also has a large attack area. To
improve security, refuse to load WebView components when running as
the root or system UIDs.
Bug: 18376908
Change-Id: I515b819033586076b1a9668023bb43ee0295d003
The WeView provider implementation needs access to
these APIs to implement the WebView functionality.
BUG:18152150
Change-Id: I6b41c623b1e8a776dcee8977d0d17259cb4b34f1
Having the default text encoding in config.xml makes it seem like
it's something that could be changed, but upon further inspection
we can't see any good reason for anyone to ever want to change it
from UTF-8.
BUG: 17634120
Change-Id: I10a09ab1d65590c29efb10222abfa08ca52b5c84
- Both are move to FileChooserParams, remove UploadHelper class.
- createIntent only handls non-capture intents
- parseResult is the static member of FileChooseParams and should
be used with createIntent.
BUG:17253647,16624450
Change-Id: I81cac7c1b739880db4e4c1f2b4612ed2ee87cb1b
It turns out that the semantics of the return value are confusing
and so we decided to not return a result from this method at all.
The developer can call canZoomIn/canZoomOut to determine whether
the WebView is at the zoom limit, so there is no loss of
functionality.
BUG: 17374808
Change-Id: I4dfde71d5ac4a3f91c8755b257411aad06a1b1f6
Bug: 17253647
This is Part I of API feedback. It does not address portions
of the feedback that is still pending a response from API council.
Change-Id: I6ae250c6455a5545912623aeb34332d564fffde7
When loading the WebView, save the PackageInfo for the package so that
it can be retrieved later to access the package name, version data, etc.
This will be used to detect WebView downgrades that may affect an app's
saved WebView-related data.
Bug: 16724751
Change-Id: I05ce469308cc87f79c73206327f43b76b1bab222
Add system trace events for several interesting points during the
loading of the WebView APK so we can measure how much each part
contributes to startup time.
Bug: 16870075
Change-Id: Iadfd1881faea0377fa01313dddabb1d030962c5f
Catch and discard any exception thrown in getWebViewNativeLibraryPaths
to avoid the system server crashing if there is something wrong with the
update APK. prepareWebViewInSystemServer(nativePaths) is safe to call
even if nativePaths is null or invalid, and must be called to ensure
that any process waiting for relro processing is unblocked.
Bug: 16894062
Change-Id: I76c759bebcb7c4643fb50979376afea764c859c4
We don't want to preload the WebView library in the zygote process any
more, as loading an updatable WebView in the zygote is a stability risk.
The memory benefits of preloading will be obtained in other ways.
Bug: 13005501
Change-Id: Ic89f2a1d057dc92b01fb775bf326b47ac2d4caa2
To aid in debugging app behaviour when WebView updates may be present,
log the package name, version name, and version code of the WebView
package when we are about to load it into an application. Do this before
we actually load any part of the package in case of an issue loading it
in the first place.
Change-Id: Id653bad431760b7ead8e3f8eb29f9d6a8bb68d07
Putting the deprecated at the beginning of a class comment seems
to cause problems with JavaDoc so I've moved it to the end.
Bug: 16799480
Change-Id: Ia23dab2ad8ceb8e107e047480b5cb324d11a1457
We load the null WebView if the real WebView package is not available to
support devices that aren't intended to have a WebView, but this results
in confusing log messages if the real WebView is supposed to be present
but is broken/unloadable for some reason. Since the null WebView is in
the system classpath on devices that should use it, swallow any failures
to load it on the assumption that this is actually just a failure of the
real WebView to be loaded.
Change-Id: I15820da3517daffde6169343c648a4486c0309d7
This is just a cleanup CL which fixes:
- Some erroneous debug messages about the relro creator process.
- The condition checked in WebViewUpdateService, to prevent the
WebView to be used from the SystemServer (it now looks at the
process id, previously it was erroneously looking at the uid).
- Adds a 5s. timeout to the waitForRelroCreationCompleted.
Original BUG:16403706
Original Change-Id: I43a953949050d7df5fe334cfa7257315ee6db071
Bug: 16723226
Change-Id: I2f40be3622b8e6c68b2b52cae7f4d3a95e148cbf
Use a config resource to determine the package name for the WebView
implementation to allow it to be changed by a resource overlay.
Original Bug: 16329371
Original Change-Id: I5977691c0223347e0382d584c3d3ee4428660180
Bug: 16723226
Change-Id: Ib0b4245f26cbf93f364aa0f30b231786931f9f16
This CL removes the final use of the hardcoded WebView
library path from WebViewFactory. We now use a system
property to set the amount of address space to reserve
in the zygote rather than stat'ing the file.
See also I07ad5a774623c1899eb50474d999a2b1447783f0
Original Change-Id: Id3c1e3cc2e2a06c1021ad0260a37abcd07d78fd6
Bug: 16723226
Change-Id: I55acad96b6d9ee69f14b84d772abf7740ea96b94
This CL adds more robustness to the logic in WebViewFactory, checking
whether the isolated process did start at all and catching exceptions
in its java side.
Also, this addresses the refactor comments received in CL 509840.
Original BUG:16403706
Original Change-Id: Iaaea6d36142ece6d974c2438259edf421fce9f2e
Bug: 16723226
Change-Id: Id308f2ffde9b67a3eb4719c7b81b4f46421f0c2e
