Skip to content
This repository has been archived by the owner on Feb 22, 2023. It is now read-only.

[webview_flutter] Add setAllowFileAccess #3802

Conversation

douglasiacovelli
Copy link

This PR intends to expose the method allowFileAccess on Android, which might be a security concern explained in more detail here: https://labs.integrity.pt/articles/review-android-webviews-fileaccess-attack-vectors/index.html

Besides that Android has changed the default behaviour of this after API 29 from true to false, meaning that developers who are willing to load local files won't be able to do so.

It solves part of this issue: flutter/flutter#37291

Pre-launch Checklist

  • I read the Contributor Guide and followed the process outlined there for submitting PRs.
  • I read the Tree Hygiene wiki page, which explains my responsibilities.
  • I read and followed the Flutter Style Guide and the C++, Objective-C, Java style guides.
  • I signed the CLA.
  • The title of the PR starts with the name of the plugin surrounded by square brackets, e.g. [shared_preferences]
  • I listed at least one issue that this PR fixes in the description above.
  • I updated pubspec.yaml with an appropriate new version according to the pub versioning philosophy.
  • I updated CHANGELOG.md to add a description of the change.
  • I updated/added relevant documentation (doc comments with ///).
  • I added new tests to check the change I am making or feature I am adding, or Hixie said the PR is test exempt.
  • All existing and new tests are passing.

If you need help, consider asking for advice on the #hackers-new channel on Discord.

@google-cla google-cla bot added the cla: yes label Apr 9, 2021
@github-actions github-actions bot added p: webview_flutter Edits files for a webview_flutter plugin platform-android labels Apr 9, 2021
@stuartmorgan
Copy link
Contributor

Thanks for the submission! We’re currently working through a large backlog of PRs, and this will require non-trivial review, so it will take some time before we’re able to review it. As explained in CONTRIBUTING.md, votes for the corresponding issue are the primary way we’re prioritizing non-trivial reviews, so we encourage you to file an issue (one that's not closed) and associate it with this PR.

Note that this is not only an Android issue; see #3693, #3613, #2830. The eventual solution here should be an API that's designed to consider the needs of multiple platforms rather than just exposing one platform's APIs directly.

@stuartmorgan
Copy link
Contributor

/cc @mvanbeusekom

@stuartmorgan stuartmorgan changed the title [web_view] Add setAllowFileAccess [webview_flutter] Add setAllowFileAccess Nov 16, 2021
@stuartmorgan
Copy link
Contributor

I'm going to close this for now as the newly added ability to load local files and assets addresses the use cases we're aware of (and this implementation has been obsoleted by substantial rewrites to the plugin). If you need this functionality specifically, please file an issue explaining the use case, and we can discuss further there to decide if it's something we want to support.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
cla: yes p: webview_flutter Edits files for a webview_flutter plugin platform-android
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants