VectorWebViewActivity and WidgetWebView enable the FromFileURLs flags despite only loading https URLs

[jim-daf]

Two WebView setup paths still toggle the deprecated allowFileAccessFromFileURLs and allowUniversalAccessFromFileURLs flags.

VectorWebViewActivity

vector/src/main/java/im/vector/app/features/webview/VectorWebViewActivity.kt:

views.simpleWebview.settings.apply {
    javaScriptEnabled = true
    ...
    domStorageEnabled = true

    @Suppress("DEPRECATION")
    allowFileAccessFromFileURLs = true
    @Suppress("DEPRECATION")
    allowUniversalAccessFromFileURLs = true

    displayZoomControls = false
}
...
val url = intent.extras?.getString(EXTRA_URL) ?: return

EXTRA_URL is always an http/https URL (identity-server terms pages, third-party-id links, etc.). The WebView never loads a file:// main frame.

WidgetWebView

vector/src/main/java/im/vector/app/features/widgets/webview/WidgetWebView.kt:

@Suppress("DEPRECATION")
settings.allowFileAccessFromFileURLs = true
@Suppress("DEPRECATION")
settings.allowUniversalAccessFromFileURLs = true

Widgets are served from the integration server's https widget URL. There is no widget flow that loads a file:// document.

Why this matters

Both flags only take effect when the WebView's main frame is itself a file:// URL. Since neither call site loads one, the flags are not load-bearing for any current path. allowUniversalAccessFromFileURLs in particular lets a file:// page XHR any origin, the classic CWE-200 sandbox escape. The @Suppress("DEPRECATION") lines suggest the deprecation warning was noticed but the flags were never re-evaluated.

On pre-API-30 devices the WebView defaults are true for both, so removing the explicit true lines is a tightening on those devices rather than a no-op.

Suggested fix: drop both lines in both files. The https widget and link flows continue to work unchanged.

A PR is open at #285.

(For reference, the same flags also live in the matching upstream files in element-hq/element-android. The PR here just covers the SchildiChat tree.)

[SpiritCroc]

Please file upstream, if you think this is an upstream issue, and link here so we can follow the discussion.

[jim-daf]

Filed upstream as element-hq/element-android#9144 with a PR at element-hq/element-android#9145. Will follow up on the SchildiChat side after upstream lands.