[webview_flutter] [url_launcher] Handle Multiwindows in WebViews #2991

bparrishMines · 2020-09-02T16:58:45Z

Related Issues

Checklist

Before you create this PR confirm that it meets all requirements listed below by checking the relevant checkboxes ([x]). This will ensure a smooth and quick review process.

Breaking Change

Does your PR require plugin users to manually update their apps to accommodate your change?

Yes, this is a breaking change (please indicate a breaking change in CHANGELOG.md and increment major revision).
No, this is not a breaking change.

.../webview_flutter/android/src/main/java/io/flutter/plugins/webviewflutter/FlutterWebView.java

amirh · 2020-09-02T20:04:42Z

.../webview_flutter/android/src/main/java/io/flutter/plugins/webviewflutter/FlutterWebView.java

+    @Override
+    public boolean onCreateWindow(
+        final WebView view, boolean isDialog, boolean isUserGesture, Message resultMsg) {
+      final WebViewClient webViewClient =


Not sure I understand this part, it seems like we're creating a new WebViewClient type and delegate some of the calls to the existing flutterWebViewClient, do we not want all functionality implemented by FlutterWebViewClient to work for the new WebView as well? (e.g should we not just use FlutterWebViewClient as the client for the new webview?)

I assumed that we only wanted the new WebView to filter out non https/http calls and load any secure url. I'm not sure what else we would need it to do? Im assuming you're talking about returning WebResourceErrors and onPageStarted/onPageFinished callbacks. Won't our FlutterWebViewClient receive these after we call loadUrl?

amirh · 2020-09-02T20:05:36Z

.../webview_flutter/android/src/main/java/io/flutter/plugins/webviewflutter/FlutterWebView.java

+            public boolean shouldOverrideUrlLoading(
+                @NonNull WebView view, @NonNull WebResourceRequest request) {
+              final String url = request.getUrl().toString();
+              if (isSecure(url)) {


Not sure I follow the logic here, can you comment on why we only delegate calls for http and https URLs?

this can be addressed by resolving https://github.com/flutter/plugins/pull/2991/files#r483177693

amirh · 2020-09-02T20:06:55Z

.../webview_flutter/android/src/main/java/io/flutter/plugins/webviewflutter/FlutterWebView.java

+      return true;
+    }
+
+    private boolean isSecure(String url) {


I was a little confused by the name isSecure, my initial guess when looking on the call site would have been "is it https"? though I'm not sure even why we're checking on this condition here.

blasten · 2020-09-03T18:29:15Z

...ncher/url_launcher/android/src/main/java/io/flutter/plugins/urllauncher/WebViewActivity.java

+        final WebView view, boolean isDialog, boolean isUserGesture, Message resultMsg) {
+      final WebViewClient webViewClient =
+          new WebViewClient() {
+            @TargetApi(Build.VERSION_CODES.LOLLIPOP)


what API needs this particular version?

This method should only be called in Android API 24+: https://developer.android.com/reference/android/webkit/WebViewClient#shouldOverrideKeyEvent(android.webkit.WebView,%20android.view.KeyEvent)

However, WebResourceRequest.getUrl() is only available in Android API 21: https://developer.android.com/reference/android/webkit/WebViewClient#shouldOverrideKeyEvent(android.webkit.WebView,%20android.view.KeyEvent)

blasten · 2020-09-03T18:32:10Z

...ncher/url_launcher/android/src/main/java/io/flutter/plugins/urllauncher/WebViewActivity.java

+    }
+
+    private boolean isSecure(String url) {
+      return url.startsWith("https://") || url.startsWith("http://");


I would suggest we rename this as: isJavaScriptScheme(String url) and check for url.startsWith("javascript:"). Link to https://tools.ietf.org/html/draft-hoehrmann-javascript-scheme-03 would be useful too.

I would only do this after we get an ok from the internal team. This method is currently just following their suggestion.

.../webview_flutter/android/src/main/java/io/flutter/plugins/webviewflutter/FlutterWebView.java

amirh · 2020-09-03T18:51:51Z

.../webview_flutter/android/src/main/java/io/flutter/plugins/webviewflutter/FlutterWebView.java

+            @Override
+            public boolean shouldOverrideUrlLoading(WebView view, String url) {
+              if (isSecure(url)) {
+                flutterWebViewClient.shouldOverrideUrlLoading(FlutterWebView.this.webView, url);


Does invoking shouldOVerrideUrlLoading has a side effect of loading the URL? It seems like our implementation of shouldOVerrideUrlLoading introduces such a side effect on older webview versions only if a navigation delegate is set. Does this work when no navigation delegate is set?

I added a test, so it does still work without a navigation delegate.

bparrishMines · 2020-09-10T00:34:53Z

@amirh @blasten is this ready to land?

blasten · 2020-09-10T01:24:35Z

packages/webview_flutter/example/test_driver/webview_flutter_e2e.dart

@@ -828,6 +828,40 @@ void main() {
    final String currentUrl = await controller.currentUrl();
    expect(currentUrl, 'about:blank');
  });
+
+  testWidgets(
+    'can open new window and go back',


this one is good, but what about a test case like the one in the internal doc?

I'm not sure how to do a test like that. I would need to load a link that tries to open a window and test to see if javascript ran?

blasten

LGTM + nit about adding test case

blasten · 2020-09-11T20:40:16Z

packages/webview_flutter/example/test_driver/webview_flutter_e2e.dart

+        <!DOCTYPE html><html>
+        <head><title>Resize test</title>
+          <script>
+            setTimeout(function() {


this document needs to be inside the <iframe>

blasten · 2020-09-12T23:39:03Z

packages/webview_flutter/example/test_driver/webview_flutter_e2e.dart

+            }, 0);
+          </script>
+        </head>
+        <body onload="onLoad();" bgColor="blue">


onLoad isn't defined. Actually, you might be able to remove the setTimeout and just define:

function onLoad() { window.open('javascript:var elem = document.createElement("p");elem.innerHTML = "<b>Executed JS in parent origin: "+window.location.origin+"</b>"; document.body.append(elem);alert("XSS in doc.domain: "+document.domain+", win.origin: "+window.location.origin)'); }

blasten · 2020-09-12T23:44:40Z

packages/webview_flutter/example/test_driver/webview_flutter_e2e.dart

+      final WebViewController controller = await controllerCompleter.future;
+      final String result = await controller.evaluateJavascript(
+          'document.querySelector("p") && document.querySelector("p").textContent');
+      expect(result, isEmpty);


This might be racy.

How do we know that the code inside the iframe has run at this point? One solution is to add a onLoad handler to iframe and set some global state once the event has fired. e.g. window.iframeLoaded = true. Then, at this point check that window.iframeLoaded is true and document.querySelector("p") && document.querySelector("p").textContent is empty.

blasten · 2020-09-17T22:48:17Z

packages/webview_flutter/example/test_driver/webview_flutter_e2e.dart

+
+      final WebViewController controller = await controllerCompleter.future;
+      final String result = await controller.evaluateJavascript(
+        'iframeLoaded && document.querySelector("p") && document.querySelector("p").textContent',


I was thinking something like this:

expect(controller.evaluateJavascript('iframeLoaded'), completion('true')); expect(controller.evaluateJavascript('document.querySelector("p") && document.querySelector("p").textContent'), isEmpty);

Actually, when iframeLoaded was false, it returned 'false', but I understand what you mean. done

blasten · 2020-09-18T00:29:34Z

packages/webview_flutter/example/test_driver/webview_flutter_e2e.dart

+    (WidgetTester tester) async {
+      final String openWindowTest = '''
+        <!DOCTYPE html><html>
+        <head><title>Resize test</title>


uber nit: resize test -> XSS test

blasten

LGTM! Thanks for the test.

…tter#2991)

bparrishMines added 3 commits September 2, 2020 07:39

webview portion

68f8848

url_launcher

7337002

formatting

3fa09aa

googlebot added the cla: yes label Sep 2, 2020

bparrishMines added 3 commits September 2, 2020 12:18

Seperate to a class

39b030b

Add documentation

bb8154b

Change doc location

625f673

bparrishMines requested review from blasten, amirh and cyanglaz September 2, 2020 19:24

amirh reviewed Sep 2, 2020

View reviewed changes

blasten reviewed Sep 3, 2020

View reviewed changes

.../webview_flutter/android/src/main/java/io/flutter/plugins/webviewflutter/FlutterWebView.java Show resolved Hide resolved

amirh reviewed Sep 3, 2020

View reviewed changes

bparrishMines added 8 commits September 4, 2020 09:25

load with no navigation delegate

9f8014f

formatting

ef55f08

test for window open

9bd470a

Merge branch 'master' of github.com:flutter/plugins into eat_js_webview

3c6de98

Add test to check for http/https

833bb0a

dont filter url and set test to only run on android

dde8c7f

Merge branch 'master' of github.com:flutter/plugins into eat_js_webview

c12449a

version bump

c5bf9d1

blasten reviewed Sep 10, 2020

View reviewed changes

blasten approved these changes Sep 10, 2020

View reviewed changes

cyanglaz mentioned this pull request Sep 10, 2020

[webview_flutter] Support for loading progress tracking #2151

Merged

13 tasks

bparrishMines added 2 commits September 11, 2020 13:02

Merge branch 'master' of github.com:flutter/plugins into eat_js_webview

7657a2c

javascript test

380c7dd

blasten reviewed Sep 11, 2020

View reviewed changes

bparrishMines added 2 commits September 11, 2020 18:56

Add iframe

9bfc1d2

Merge branch 'master' of github.com:flutter/plugins into eat_js_webview

dd4deec

blasten reviewed Sep 12, 2020

View reviewed changes

bparrishMines added 4 commits September 14, 2020 20:33

Merge branch 'master' of github.com:flutter/plugins into eat_js_webview

022e717

replace onLoad

9d6a594

Merge branch 'master' of github.com:flutter/plugins into eat_js_webview

2a6d766

use iframeLoaded variable

94c7b5a

bparrishMines requested a review from mklim as a code owner September 17, 2020 03:30

bparrishMines changed the title ~~[webview_flutter] [url_launcher] Handle Multiwindows in WebViews~~ [WIP][webview_flutter] [url_launcher] Handle Multiwindows in WebViews Sep 17, 2020

bparrishMines added the WIP label Sep 17, 2020

blasten reviewed Sep 17, 2020

View reviewed changes

fix iframe test

fab93d7

bparrishMines changed the title ~~[WIP][webview_flutter] [url_launcher] Handle Multiwindows in WebViews~~ [webview_flutter] [url_launcher] Handle Multiwindows in WebViews Sep 18, 2020

bparrishMines removed the WIP label Sep 18, 2020

blasten reviewed Sep 18, 2020

View reviewed changes

blasten approved these changes Sep 18, 2020

View reviewed changes

bparrishMines added 2 commits September 17, 2020 17:32

Test name change

f6bf112

update test

6d53eda

bparrishMines merged commit e80865a into flutter:master Sep 21, 2020

bparrishMines deleted the eat_js_webview branch September 21, 2020 16:27

danielroek pushed a commit to Baseflow/flutter-plugins that referenced this pull request Oct 1, 2020

[webview_flutter] [url_launcher] Handle Multiwindows in WebViews (flu…

062bb36

…tter#2991)

jorgefspereira pushed a commit to jorgefspereira/plugins_flutter that referenced this pull request Oct 10, 2020

[webview_flutter] [url_launcher] Handle Multiwindows in WebViews (flu…

e217a0b

…tter#2991)

mvanbeusekom mentioned this pull request Oct 23, 2020

url_launcher 5.1.2 warning on build flutter/flutter#37616

Closed

kelset mentioned this pull request Nov 17, 2020

Introduce mitigations for CVE-2020-6506 react-native-webview/react-native-webview#1747

Merged

FlutterSu pushed a commit to FlutterSu/flutter-plugins that referenced this pull request Nov 20, 2020

[webview_flutter] [url_launcher] Handle Multiwindows in WebViews (flu…

8f2645b

…tter#2991)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[webview_flutter] [url_launcher] Handle Multiwindows in WebViews #2991

[webview_flutter] [url_launcher] Handle Multiwindows in WebViews #2991

bparrishMines commented Sep 2, 2020

amirh Sep 2, 2020

bparrishMines Sep 8, 2020

amirh Sep 2, 2020

blasten Sep 3, 2020

amirh Sep 2, 2020

blasten Sep 3, 2020

bparrishMines Sep 8, 2020

blasten Sep 10, 2020

blasten Sep 3, 2020

bparrishMines Sep 8, 2020

amirh Sep 3, 2020

bparrishMines Sep 10, 2020

bparrishMines commented Sep 10, 2020

blasten Sep 10, 2020

bparrishMines Sep 11, 2020

blasten left a comment

blasten Sep 11, 2020

blasten Sep 12, 2020

blasten Sep 12, 2020 •

edited

Loading

blasten Sep 17, 2020 •

edited

Loading

bparrishMines Sep 18, 2020

blasten Sep 18, 2020

blasten left a comment

[webview_flutter] [url_launcher] Handle Multiwindows in WebViews #2991

[webview_flutter] [url_launcher] Handle Multiwindows in WebViews #2991

Conversation

bparrishMines commented Sep 2, 2020

Related Issues

Checklist

Breaking Change

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bparrishMines commented Sep 10, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

blasten left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

blasten Sep 12, 2020 • edited Loading

Choose a reason for hiding this comment

blasten Sep 17, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

blasten left a comment

Choose a reason for hiding this comment

blasten Sep 12, 2020 •

edited

Loading

blasten Sep 17, 2020 •

edited

Loading