-
Notifications
You must be signed in to change notification settings - Fork 29.7k
Closed
flutter/plugins
#4859Closed
Copy link
Labels
P1High-priority issues at the top of the work listHigh-priority issues at the top of the work listc: regressionIt was better in the past than it is nowIt was better in the past than it is nowp: webviewThe WebView pluginThe WebView pluginpackageflutter/packages repository. See also p: labels.flutter/packages repository. See also p: labels.platform-androidAndroid applications specificallyAndroid applications specifically
Description
Description
WebView class has debuggingEnabled parameter, but it's not used in Android webview_flutter_android module. In file webview_android_widget.dart there is a function which takes parameter enabled, but it's not used, true value is used instead:
Future<void> setWebContentsDebuggingEnabled(bool enabled) {
return android_webview.WebView.setWebContentsDebuggingEnabled(true);
}
Link to the webview_android_widget.dart
As a result, regardless of the passed value, WebView always allows to debug its content even if apk is build in release mode. It can be dangerous in production app due to possible JavaScript injection attack by other applications installed on device.
Steps to reproduce
- Run the example app on Android device
- Open Chrome DevTools inspector - chrome://inspect/#devices
Expected results: WebView debugging shouldn't be enabled
Actual results: WebView debugging in enabled - app webview is visible in Chrome DevTools inspector
Metadata
Metadata
Assignees
Labels
P1High-priority issues at the top of the work listHigh-priority issues at the top of the work listc: regressionIt was better in the past than it is nowIt was better in the past than it is nowp: webviewThe WebView pluginThe WebView pluginpackageflutter/packages repository. See also p: labels.flutter/packages repository. See also p: labels.platform-androidAndroid applications specificallyAndroid applications specifically