Skip to content
This repository has been archived by the owner on Apr 17, 2021. It is now read-only.

Drop malformed url requests for non-main frame (was: AmazonWebView does not have WebResourceRequest) #38

Closed
ekager opened this issue Dec 13, 2017 · 5 comments
Labels
P3 Low impact and frequency

Comments

@ekager
Copy link
Contributor

ekager commented Dec 13, 2017

shouldInterceptRequest method takes a string instead of WebResourceRequest with AmazonWebView. Look into if we need to create a WebResourceRequest here.

@ekager
Copy link
Contributor Author

ekager commented Dec 14, 2017

I don't think it's possible to create a WebResourceRequest object from the string. We may be able to salvage some of the code because the String "request" is the URL of the request and a lot of the code in Focus is about matching the URLs to know which URL to show in the URL bar.

@ekager ekager removed their assignment Dec 14, 2017
@mcomella
Copy link
Contributor

mcomella commented Jan 12, 2018

The only method we use is request.isForMainFrame, which I think we can check with the TrackingProtectionWebViewClient.currentPageUrl:

        if (!request.isForMainFrame() &&
                !scheme.equals("http") && !scheme.equals("https")) {
            // Block any malformed non-http(s) URIs. WebView will already ignore things like market: URLs,
            // but not in all cases (malformed market: URIs, such as market:://... will still end up here).
            // (Note: data: URIs are automatically handled by WebView, and won't end up here either.)
            // file:// URIs are disabled separately by setting WebSettings.setAllowFileAccess()
            return new AmazonWebResourceResponse(null, null, null);
        }

I didn't have time to investigate whether or not this would be sufficient, however.

Note that the UrlMatcher for tracking protection whitelists first-party requests (against the currentPageUrl so the later code that checks against for main frames is actually unnecessary, afaict. I removed it in #311.

@mcomella mcomella changed the title AmazonWebView does not have WebResourceRequest Drop malformed url requests for non-main frame (was: AmazonWebView does not have WebResourceRequest) Jan 12, 2018
@mcomella
Copy link
Contributor

liuche found where this was initially implemented and it contains useful comments: mozilla-mobile/focus-android#106 (comment)

@mcomella
Copy link
Contributor

[triage] We're going to wait on the WebView upgrade to see if this API is added back in #379.

@bbinto bbinto added the P3 Low impact and frequency label Feb 20, 2018
@mcomella
Copy link
Contributor

This is handled by components now: they're probably doing the right thing. :)

@ghost ghost removed the ⛔ blocked label Oct 31, 2018
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
P3 Low impact and frequency
Projects
None yet
Development

No branches or pull requests

4 participants