From d35e8cd44b51a00e781432b2020fa40febacb9e4 Mon Sep 17 00:00:00 2001
From: Bryce Curtis <curtis.bryce@gmail.com>
Date: Mon, 13 Jun 2011 15:16:08 -0500
Subject: [PATCH] Fix security vulnerability - make sure any requests to run
 native code only come from url currently loaded into webview.

---
 framework/src/com/phonegap/DroidGap.java | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/framework/src/com/phonegap/DroidGap.java b/framework/src/com/phonegap/DroidGap.java
index d09165e7..93dbe552 100755
--- a/framework/src/com/phonegap/DroidGap.java
+++ b/framework/src/com/phonegap/DroidGap.java
@@ -787,10 +787,14 @@ public class DroidGap extends PhonegapActivity {
          */
         @Override
         public boolean onJsPrompt(WebView view, String url, String message, String defaultValue, JsPromptResult result) {
+        	boolean reqOk = false;
+        	if (((DroidGap)(this.ctx)).url.equals(url)) {
+        		reqOk = true;
+        	}
 			
         	// Calling PluginManager.exec() to call a native service using 
         	// prompt(this.stringify(args), "gap:"+this.stringify([service, action, callbackId, true]));
-        	if (defaultValue != null && defaultValue.length() > 3 && defaultValue.substring(0, 4).equals("gap:")) {
+        	if (reqOk && defaultValue != null && defaultValue.length() > 3 && defaultValue.substring(0, 4).equals("gap:")) {
         		JSONArray array;
         		try {
         			array = new JSONArray(defaultValue.substring(4));
@@ -806,13 +810,13 @@ public class DroidGap extends PhonegapActivity {
         	}
         	
         	// Polling for JavaScript messages 
-        	else if (defaultValue.equals("gap_poll:")) {
+        	else if (reqOk && defaultValue.equals("gap_poll:")) {
         		String r = callbackServer.getJavascript();
         		result.confirm(r);
         	}
         	
         	// Calling into CallbackServer
-        	else if (defaultValue.equals("gap_callbackServer:")) {
+        	else if (reqOk && defaultValue.equals("gap_callbackServer:")) {
         		String r = "";
         		if (message.equals("usePolling")) {
         			r = ""+callbackServer.usePolling();