Skip to content
Open
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@
import android.os.Bundle;
import android.os.Handler;
import android.os.Looper;
import android.util.AndroidRuntimeException;
import android.util.DisplayMetrics;
import android.view.Display;
import android.view.Gravity;
Expand Down Expand Up @@ -200,9 +201,12 @@
applyWindowGravity(getDialog().getWindow(), "onCreateView");
}

webView = new IterableWebView(getContext());
webView = createWebViewSafely(getContext());
if (webView == null) {
dismissAllowingStateLoss();
return null;
}
webView.setId(R.id.webView);

webView.createWithHtml(this, htmlString);

if (orientationListener == null) {
Expand Down Expand Up @@ -324,7 +328,9 @@
*/
@Override
public void onStop() {
orientationListener.disable();
if (orientationListener != null) {
orientationListener.disable();
}

super.onStop();
}
Expand Down Expand Up @@ -747,6 +753,15 @@
return InAppLayout.CENTER;
}
}

private IterableWebView createWebViewSafely(Context context) {
try {
return new IterableWebView(context);

Check warning

Code scanning / CodeQL

Android WebView settings allows access to content links Medium

Sensitive information may be exposed via a malicious link due to access to content:// links being allowed in this WebView.
} catch (AndroidRuntimeException e) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The stack trace shows AndroidRuntimeException wrapping Resources$NotFoundException, but Resources.NotFoundException extends RuntimeException directly — not AndroidRuntimeException. If a future Android 16 patch changes the wrapping behavior (or a different OEM throws it unwrapped), this catch misses it entirely

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, this was a point I was trying to consider, having it just looking for the Resources$NotFoundException was an option but then I was concerned other unexpected errors might occur, considering webView is an android implementation.

I can add a new more direct catch for the resources so we directly address that and then have this more generic one if a different problem occurs

IterableLogger.e(TAG, "Failed to create WebView", e);
return null;
}
}
}

enum InAppLayout {
Expand Down
Loading