Chromium Code Reviews Chromium Code Reviews
Issue 9192008:
Hook up ContentViewCore.add/removeJavascriptInterface() (Closed)
Base URL: svn://svn.chromium.org/chrome/trunk/src| Index: content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java |
| diff --git a/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java b/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java |
| index 5fcbf2c38d408f8f51f571fcb778dc6b7884d8f6..c75a1720ae78c85995331965b187fdf87815cd19 100644 |
| --- a/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java |
| +++ b/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java |
| @@ -747,6 +747,58 @@ public class ContentViewCore { |
| return mZoomManager.getZoomControlsViewForTest(); |
| } |
| + /** |
| + * This method injects the supplied Java object into the WebView. The |
|
Ted C
2012/07/27 18:09:04
should WebView be ContentViewCore?
same for other
Steve Block
2012/07/30 11:45:14
Yes, well spotted, I just copied this from the Web
|
| + * object is injected into the JavaScript context of the main frame, using |
| + * the supplied name. This allows the Java object to be accessed from |
| + * JavaScript. Note that that injected objects will not appear in |
| + * JavaScript until the page is next (re)loaded. For example: |
| + * <pre> webView.addJavascriptInterface(new Object(), "injectedObject"); |
|
Ted C
2012/07/27 18:09:04
same, should these webView's be renamed.
|
| + * webView.loadData("<!DOCTYPE html><title></title>", "text/html", null); |
| + * webView.loadUrl("javascript:alert(injectedObject.toString())");</pre> |
| + * <p><strong>IMPORTANT:</strong> |
| + * <ul> |
| + * <li> addJavascriptInterface() can be used to allow JavaScript to control |
| + * the host application. This is a powerful feature, but also presents a |
| + * security risk. Use of this method in a WebView containing untrusted |
| + * content could allow an attacker to manipulate the host application in |
| + * unintended ways, executing Java code with the permissions of the host |
| + * application. Use extreme care when using this method in a WebView which |
| + * could contain untrusted content. Particular care should be taken to avoid |
| + * unintentional access to inherited methods, such as |
| + * {@link Object#getClass()}. To prevent access to inherited methods, set |
| + * {@code allowInheritedMethods} to {@code false}. In addition, ensure that |
| + * the injected object's public methods return only objects designed to be |
| + * used by untrusted code, and never return a raw Object instance. |
| + * <li> JavaScript interacts with Java objects on a private, background |
| + * thread of the WebView. Care is therefore required to maintain thread |
| + * safety.</li> |
| + * </ul></p> |
| + * |
| + * @param object the Java object to inject into the WebView's JavaScript |
|
Ted C
2012/07/27 18:09:04
It looks like most other javadocs in this file fol
Steve Block
2012/07/30 11:45:14
Done.
|
| + * context. Null values are ignored. |
| + * @param name the name used to expose the instance in JavaScript |
| + * @param allowInheritedMethods whether or not inherited methods may be |
| + * called from JavaScript |
| + */ |
| + public void addJavascriptInterface(Object object, String name, boolean allowInheritedMethods) { |
| + if (mNativeContentViewCore != 0 && object != null) { |
| + nativeAddJavascriptInterface(mNativeContentViewCore, object, name, |
| + allowInheritedMethods); |
| + } |
| + } |
| + |
| + /** |
| + * Removes a previously added JavaScript interface with the given name. |
| + * |
| + * @param name The name of the interface to remove. |
| + */ |
| + public void removeJavascriptInterface(String name) { |
| + if (mNativeContentViewCore != 0) { |
| + nativeRemoveJavascriptInterface(mNativeContentViewCore, name); |
| + } |
| + } |
| + |
| @CalledByNative |
| private void startContentIntent(String contentUrl) { |
| getContentViewClient().onStartContentIntent(getContext(), contentUrl); |
| @@ -807,4 +859,8 @@ public class ContentViewCore { |
| private native boolean nativeNeedsReload(int nativeContentViewCoreImpl); |
| private native void nativeClearHistory(int nativeContentViewCoreImpl); |
| + |
| + private native void nativeAddJavascriptInterface(int nativeContentViewCore, Object object, |
| + String name, boolean allowInheritedMethods); |
| + private native void nativeRemoveJavascriptInterface(int nativeContentViewCore, String name); |
| } |
