From 3b3bd9b6c917fe3ca9fdc967e9812b56ce7ca47a Mon Sep 17 00:00:00 2001 From: Ian Clelland <iclelland@chromium.org> Date: Thu, 21 Aug 2014 16:10:32 -0400 Subject: [PATCH] CB-7291: Only add file, content and data URLs to internal whitelist --- framework/src/org/apache/cordova/ConfigXmlParser.java | 5 +++++ framework/src/org/apache/cordova/Whitelist.java | 4 ---- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/framework/src/org/apache/cordova/ConfigXmlParser.java b/framework/src/org/apache/cordova/ConfigXmlParser.java index 9179f982..2a667a9a 100644 --- a/framework/src/org/apache/cordova/ConfigXmlParser.java +++ b/framework/src/org/apache/cordova/ConfigXmlParser.java @@ -82,6 +82,11 @@ public class ConfigXmlParser { boolean insideFeature = false; ArrayList<String> urlMap = null; + // Add implicitly allowed URLs + internalWhitelist.addWhiteListEntry("file:///*", false); + internalWhitelist.addWhiteListEntry("content:///*", false); + internalWhitelist.addWhiteListEntry("data:*", false); + while (eventType != XmlResourceParser.END_DOCUMENT) { if (eventType == XmlResourceParser.START_TAG) { String strNode = xml.getName(); diff --git a/framework/src/org/apache/cordova/Whitelist.java b/framework/src/org/apache/cordova/Whitelist.java index 5101ec35..d0f823c3 100644 --- a/framework/src/org/apache/cordova/Whitelist.java +++ b/framework/src/org/apache/cordova/Whitelist.java @@ -98,10 +98,6 @@ public class Whitelist { public Whitelist() { this.whiteList = new ArrayList<URLPattern>(); - // Add implicitly allowed URLs - addWhiteListEntry("file:///*", false); - addWhiteListEntry("content:///*", false); - addWhiteListEntry("data:*", false); } /* Match patterns (from http://developer.chrome.com/extensions/match_patterns.html)