[WebView] Disallow geolocation on insecure origins for apps targeting N and higher.

android_webview/java/src/org/chromium/android_webview/AwSettings.java

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 package org.chromium.android_webview;
 
 import android.annotation.SuppressLint;
 import android.content.Context;
 import android.content.pm.PackageManager;
 import android.os.Handler;
@@ skipping 94 matching lines @@
     private boolean mAllowContentUrlAccess = true;
     private boolean mAllowFileUrlAccess = true;
     private int mCacheMode = WebSettings.LOAD_DEFAULT;
     private boolean mShouldFocusFirstNode = true;
     private boolean mGeolocationEnabled = true;
     private boolean mAutoCompleteEnabled = true;
     private boolean mFullscreenSupported = false;
     private boolean mSupportZoom = true;
     private boolean mBuiltInZoomControls = false;
     private boolean mDisplayZoomControls = true;
+    private boolean mAllowGeolocationOnInsecureOrigins = true;

[Torne, 2016/04/13 15:33:01]

The other API level settings are final; I assume they just set it in
construction in the relevant tests? Is it a problem to make this work the same
way?

[timvolodine, 2016/04/13 16:38:57]

right, not a problem ;) done.

 
     static class LazyDefaultUserAgent{
         // Lazy Holder pattern
         private static final String sInstance = nativeGetDefaultUserAgent();
     }
 
     // Protects access to settings global fields.
     private static final Object sGlobalContentSettingsLock = new Object();
     // For compatibility with the legacy WebView, we can only enable AppCache when the path is
     // provided. However, we don't use the path, so we just check if we have received it from the
@@ skipping 78 matching lines @@
     }
 
     interface ZoomSupportChangeListener {
         public void onGestureZoomSupportChanged(
                 boolean supportsDoubleTapZoom, boolean supportsMultiTouchZoom);
     }
 
     public AwSettings(Context context,
             boolean isAccessFromFileURLsGrantedByDefault,
             boolean supportsLegacyQuirks,
-            boolean allowEmptyDocumentPersistence) {
+            boolean allowEmptyDocumentPersistence,
+            boolean allowGeolocationOnInsecureOrigins) {
         boolean hasInternetPermission = context.checkPermission(
                 android.Manifest.permission.INTERNET,
                 Process.myPid(),
                 Process.myUid()) == PackageManager.PERMISSION_GRANTED;
         synchronized (mAwSettingsLock) {
             mHasInternetPermission = hasInternetPermission;
             mBlockNetworkLoads = !hasInternetPermission;
             mEventHandler = new EventHandler();
             if (isAccessFromFileURLsGrantedByDefault) {
                 mAllowUniversalAccessFromFileURLs = true;
                 mAllowFileAccessFromFileURLs = true;
             }
 
             mUserAgent = LazyDefaultUserAgent.sInstance;
 
             // Best-guess a sensible initial value based on the features supported on the device.
             mSpatialNavigationEnabled = !context.getPackageManager().hasSystemFeature(
                     PackageManager.FEATURE_TOUCHSCREEN);
 
             // Respect the system setting for password echoing.
             mPasswordEchoEnabled = Settings.System.getInt(context.getContentResolver(),
                     Settings.System.TEXT_SHOW_PASSWORD, 1) == 1;
 
             // By default, scale the text size by the system font scale factor. Embedders
             // may override this by invoking setTextZoom().
             mTextSizePercent *= context.getResources().getConfiguration().fontScale;
 
             mSupportLegacyQuirks = supportsLegacyQuirks;
             mAllowEmptyDocumentPersistence = allowEmptyDocumentPersistence;
+            mAllowGeolocationOnInsecureOrigins = allowGeolocationOnInsecureOrigins;
         }
         // Defer initializing the native side until a native WebContents instance is set.
     }
 
     @CalledByNative
     private void nativeAwSettingsGone(long nativeAwSettings) {
         assert mNativeAwSettings != 0 && mNativeAwSettings == nativeAwSettings;
         mNativeAwSettings = 0;
     }
 
@@ skipping 995 matching lines @@
         assert Thread.holdsLock(mAwSettingsLock);
         return mSupportLegacyQuirks;
     }
 
     @CalledByNative
     private boolean getAllowEmptyDocumentPersistenceLocked() {
         assert Thread.holdsLock(mAwSettingsLock);
         return mAllowEmptyDocumentPersistence;
     }
 
+    @CalledByNative
+    private boolean getAllowGeolocationOnInsecureOrigins() {
+        assert Thread.holdsLock(mAwSettingsLock);
+        return mAllowGeolocationOnInsecureOrigins;
+    }
+
     /**
      * See {@link android.webkit.WebSettings#setUseWideViewPort}.
      */
     public void setUseWideViewPort(boolean use) {
         if (TRACE) Log.d(LOGTAG, "setUseWideViewPort=" + use);
         synchronized (mAwSettingsLock) {
             if (mUseWideViewport != use) {
                 mUseWideViewport = use;
                 onGestureZoomSupportChanged(
                         supportsDoubleTapZoomLocked(), supportsMultiTouchZoomLocked());
@@ skipping 466 matching lines @@
                         if (mNativeAwSettings != 0) {
                             nativeUpdateRendererPreferencesLocked(mNativeAwSettings);
                         }
                     }
                 });
             }
         }
     }
 
     @VisibleForTesting
+    public void setAllowGeolocationOnInsecureOriginsForTests(final boolean allow) {
+        synchronized (mAwSettingsLock) {
+            mAllowGeolocationOnInsecureOrigins = allow;
+        }
+    }
+
+    @VisibleForTesting
     public void updateAcceptLanguages() {
         synchronized (mAwSettingsLock) {
             mEventHandler.runOnUiThreadBlockingAndLocked(new Runnable() {
                 @Override
                 public void run() {
                     if (mNativeAwSettings != 0) {
                         nativeUpdateRendererPreferencesLocked(mNativeAwSettings);
                     }
                 }
             });
@@ skipping 84 matching lines @@
     private native void nativeUpdateWebkitPreferencesLocked(long nativeAwSettings);
 
     private static native String nativeGetDefaultUserAgent();
 
     private native void nativeUpdateFormDataPreferencesLocked(long nativeAwSettings);
 
     private native void nativeUpdateRendererPreferencesLocked(long nativeAwSettings);
 
     private native void nativeUpdateOffscreenPreRasterLocked(long nativeAwSettings);
 }