github/cordova-android
github/cordova-android
3
0
Fork 1
mirror of https://github.com/apache/cordova-android.git synced 2025-01-31 17:32:51 +08:00
Code Issues Packages Projects Releases Wiki Activity

CB-7291: Only add file, content and data URLs to internal whitelist

Browse Source
This commit is contained in:
Ian Clelland 2014-08-21 16:10:32 -04:00
parent 4e3331ba66
commit 3b3bd9b6c9
2 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
framework/src/org/apache/cordova/ConfigXmlParser.java
View File

@ -82,6 +82,11 @@ public class ConfigXmlParser {
boolean insideFeature = false; boolean insideFeature = false;
ArrayList<String> urlMap = null; ArrayList<String> urlMap = null;
// Add implicitly allowed URLs
internalWhitelist.addWhiteListEntry("file:///*", false);
internalWhitelist.addWhiteListEntry("content:///*", false);
internalWhitelist.addWhiteListEntry("data:*", false);
while (eventType != XmlResourceParser.END_DOCUMENT) { while (eventType != XmlResourceParser.END_DOCUMENT) {
if (eventType == XmlResourceParser.START_TAG) { if (eventType == XmlResourceParser.START_TAG) {
String strNode = xml.getName(); String strNode = xml.getName();

4
framework/src/org/apache/cordova/Whitelist.java
View File

@ -98,10 +98,6 @@ public class Whitelist {
public Whitelist() { public Whitelist() {
this.whiteList = new ArrayList<URLPattern>(); this.whiteList = new ArrayList<URLPattern>();
// Add implicitly allowed URLs
addWhiteListEntry("file:///*", false);
addWhiteListEntry("content:///*", false);
addWhiteListEntry("data:*", false);
} }
/* Match patterns (from http://developer.chrome.com/extensions/match_patterns.html) /* Match patterns (from http://developer.chrome.com/extensions/match_patterns.html)