Android Webview Java and Javascript safe interaction

Android Webview Java and Javascript safe interaction

Recently, I need to detect the source code of a web page. There is no direct interface to obtain the source code of the web page in Android Webview. The traditional addJavascriptInterface method has security risks, so I studied the security interaction between Java and Javascript.

Android Webview Vulnerability

Android Webview has two very well-known vulnerabilities:

  • The recently exposed UXSS vulnerability can bypass the same-origin policy and obtain the cookies and other information of any web page. This problem exists on Android 4.4 and below, and there is basically no solution. It can only be solved by recompiling the browser kernel. For details, please refer to the recent mobile security events. If you are interested, you can watch the video of @RAyH4c hijacking Weibo and QQ space.
  • The long-known arbitrary command execution vulnerability, through the addJavascriptInterface method, Js can call Java object methods, through the reflection mechanism, Js can directly obtain the Runtime, and thus execute arbitrary commands. For Android 4.2 and above, you can ensure security by declaring @JavascriptInterface. For Android 4.2 and below, you can no longer call addJavascriptInterface, and you need to find another way.

Safe interaction between Java and Javascript

First of all, a few points:

1. It is easy to call Js methods from Java in Android Webview. loadUrl("javascript:isOk()") can call the isOk Js method, but the return result of the Js method cannot be directly obtained.

  1.  class JsObject {
  2.  @JavascriptInterface  
  3.  public String toString() { return   "injectedObject" ; }
  4.  }
  5.     webView.addJavascriptInterface( new JsObject(), "injectedObject" );
  6.     webView.loadData( "" , "text/html" , null );
  7.     webView.loadUrl( "javascript:alert(injectedObject.toString())" );

2. In the traditional method, Js can obtain Java information in the following ways:

  1.  import android.app.Activity;
  2.  import android.graphics.Bitmap;
  3.  import android.os.Bundle;
  4.  import android.util.Log;
  5.  import android.webkit.WebView;
  6.  import android.webkit.WebViewClient; 
  7.  
  8.  public   class HtmlSource extends Activity {
  9.  private WebView webView; 
  10.  
  11.  @Override  
  12.  public   void onCreate(Bundle savedInstanceState) {
  13.  super .onCreate(savedInstanceState);
  14.         setContentView(R.layout.main);
  15.         webView = (WebView)findViewById(R.id.webview);
  16.         webView.getSettings().setJavaScriptEnabled( true );
  17.         webView.addJavascriptInterface( new InJavaScriptLocalObj(), "local_obj" );
  18.         webView.setWebViewClient( new MyWebViewClient());
  19.         webView.loadUrl( "http://www.cnblogs.com/hibraincol/" );
  20.  } 
  21.  
  22.  
  23.  final   class MyWebViewClient extends WebViewClient{
  24.  public   boolean shouldOverrideUrlLoading(WebView view, String url) {
  25.             view.loadUrl(url);
  26.  return   true ;
  27.  }
  28.  public   void onPageStarted(WebView view, String url, Bitmap favicon) {
  29.             Log.d( "WebView" , "onPageStarted" );
  30.  super .onPageStarted(view, url, favicon);
  31.  }
  32.  public   void onPageFinished(WebView view, String url) {
  33.             Log.d( "WebView" , "onPageFinished " );
  34.             view.loadUrl( "javascript:window.local_obj.showSource('<head>'+" +
  35.  "document.getElementsByTagName('html')[0].innerHTML+'</head>');" );
  36.  super .onPageFinished(view, url);
  37.  }
  38.  } 
  39.  
  40.  final   class InJavaScriptLocalObj { 
  41.  
  42.  public   void showSource(String html) {
  43.             Log.d( "HTML" , html);
  44.  }
  45.  }
  46.  }

3. When there is a hyperlink jump in the web page, the shouldOverrideUrlLoading method of WebClient will be called. If WebViewClient is set and the method returns true, it means that the URL is processed by the application code and WebView does not, which can achieve the effect of intercepting the jump.

Understanding the above points, we can summarize a relatively safe way for Java and Js to interact :

We can learn from the idea of ​​Android Intent. Java and Js define a URL format such as js://_. Java calls the Js method. In the Js method, window.location.href='js://_?key=value#key1=value1' is used to simulate the jump. It is captured by Java's shouldOverrideUrlLoading. The return value of the function can be placed in the URL parameter. (The principle of Js calling Java methods is the same)

This interaction method is asynchronous. What if you want to know whether calling a Js method returns a value? Generally, Java calls the Js method in the onPageFinished method, and obtains the Js return value in the shouldOverrideUrlLoading method. The two methods have a common parameter webview, so you can first call webview.setTag(false). If the return result is captured, then call webview.setTag(true). After a short time, such as 300 milliseconds, call webview.getTag() to check whether there is any change.

<<:  Changsi Advertising won the "Golden Coordinate" 2014 Best Mobile Advertising Platform Award

>>:  Which three “mobile industry chains” has WeChat created?

Recommend

"WEAK, STRONG, UNOWNED, for goodness sake!" - References in SWIFT

I find myself constantly worrying about retain cy...

Useful information sharing: Correct use of const, static, extern

Preface This article mainly introduces how to use...

It is difficult to make money from TV hardware, and the profit model has changed into a trend

Users are at hand, but it is not easy to monetize...

Analysis of Estee Lauder’s Double 11 marketing strategy!

In the fiercely competitive beauty industry, majo...

Wearing technology on your body brings both warmth and style

During the just-concluded Spring Festival holiday...

Mante frog: colorful little "poisonous creature"

Cowan's Mantella, scientific name Mantella co...

China Association of Automobile Manufacturers: A brief summary of automobile industry production and sales in October 2021

According to statistics and analysis by the China...

How much does it cost for Jinchang to be an agent for a voting mini program?

How much does it cost to be an agent of Jinchang ...

It can cause diarrhea at the mildest and be fatal at the worst... An urgent reminder: Don’t eat it!

Recently, the Market Supervision and Administrati...

Methods and tools to improve iOS development efficiency

introduce This article mainly introduces some met...

Why is there a fine for adding acesulfame potassium, a common beverage, into orange juice?

Recently, another piece of news related to food a...

Mercedes-Benz: Mercedes-Benz electric and hybrid vehicles are expected to account for 50% of sales in 2025

Mercedes-Benz reportedly expects to have a dedica...

BYD's "DiLink System": Cars of the future will not only have a body, but also a soul!

At present, the automobile industry is facing unp...

Thunderstorms occur frequently in summer. How to ensure flight safety?

Have you ever had the experience of being woken u...

Where can I customize the African Mercenary Happy Birthday video?

The African Mercenary's Happy Birthday video ...