Fix lint warnings: AddJavascriptInterface, SetJavaScriptEnabled, WrongConstant

[jim-daf]

Fix Lint Warnings (Issue #8)

Resolves #8

Changes

1. D3SView.java -- Add @SuppressLint for SetJavaScriptEnabled and AddJavascriptInterface

• Why: JavaScript is fundamental to how this 3DS WebView component works -- it injects JS to extract payment authorization data (MD, PaRes, CRes) from the ACS page. The lint warning about XSS is acknowledged but accepted since the component only loads trusted ACS server pages provided by payment gateways.
• addJavascriptInterface is required for the JS bridge (D3SJSInterface) that captures HTML from the ACS page. The class already correctly uses @JavascriptInterface annotation on exposed methods.
• Added import: android.annotation.SuppressLint

2. D3SRegexUtils.java -- Use qualified Pattern.compile() instead of static import

• Why: The WrongConstant lint warning was triggered because the static import of compile made lint unable to verify that the integer flags (DOTALL | CASE_INSENSITIVE) are valid Pattern flag constants. Using the fully qualified Pattern.compile() resolves this.
• Removed unused static imports of compile, DOTALL, and CASE_INSENSITIVE.

Testing

• No behavioral changes -- all fixes are lint warning suppressions and equivalent code restructuring.
• Compiled and verified D3SRegexUtils.java -- 15/15 regex tests passed (MD, PaRes, CRes, threeDSSessionData extraction including case-insensitive and multiline/DOTALL scenarios).

Note on minSdkVersion

The AddJavascriptInterface lint warning exists because minSdkVersion is currently set to 10. On API < 17, addJavascriptInterface exposes all public methods via JavaScript reflection, which is a known security vulnerability (CVE-2012-6636).

This PR suppresses the warning with @SuppressLint, which is the least invasive approach. However, raising minSdkVersion to 17 would eliminate the vulnerability at its root rather than just silencing the lint check.

That said, changing minSdkVersion is a project-wide decision -- it would drop support for Android 2.3–4.1 devices entirely and could affect any app that depends on this library. While those API levels represent effectively 0% of active devices today, it's a change the maintainers should evaluate for their user base.

If raising the minimum SDK is acceptable, the @SuppressLint("AddJavascriptInterface") annotation could be removed in favor of that.

[Copilot]

Pull request overview

This PR addresses Android lint warnings in the 3DS WebView component by suppressing security-related WebView lint checks where JavaScript/JS-bridging is required, and by restructuring regex compilation to avoid a WrongConstant lint false positive.

Changes:

• Suppress SetJavaScriptEnabled and AddJavascriptInterface lint warnings on D3SView.initUI().
• Replace static-import compile(...) usage with Pattern.compile(...) and qualify regex flag constants to satisfy WrongConstant.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
3DSView/src/main/java/eu/livotov/labs/android/d3s/D3SView.java	Adds @SuppressLint for WebView JavaScript and JS-interface lint warnings.
3DSView/src/main/java/eu/livotov/labs/android/d3s/D3SRegexUtils.java	Qualifies Pattern.compile and flag constants to avoid lint misclassification.

Comments suppressed due to low confidence (1)

3DSView/src/main/java/eu/livotov/labs/android/d3s/D3SView.java:80

• @SuppressLint({"SetJavaScriptEnabled", "AddJavascriptInterface"}) silences a real security issue when minSdkVersion is 10: on API < 17, addJavascriptInterface exposes all public methods via reflection (CVE-2012-6636), and this WebView also enables JS and injects javascript: URLs. Instead of only suppressing lint, please either (a) raise the library minSdkVersion to 17+, or (b) gate the addJavascriptInterface call behind Build.VERSION.SDK_INT >= 17 and provide a safer fallback/explicit failure on older devices. If you intentionally keep API < 17 support, add an in-code comment documenting the threat model and why it is acceptable here so consumers understand the risk.

    @SuppressLint({"SetJavaScriptEnabled", "AddJavascriptInterface"})
    private void initUI() {
        getSettings().setJavaScriptEnabled(true);
        getSettings().setBuiltInZoomControls(true);
        addJavascriptInterface(new D3SJSInterface(), JavaScriptNS);

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.