Add a configurable origin trust policy

core/src/main/assets/js/bridge_components.js

@@ -1,4 +1,10 @@
 (() => {
+  // BridgeComponentsChannel is injected by the native side via WebViewCompat.addWebMessageListener().
+  const BridgeComponentsNative = new Proxy({}, {
+    get: (_, name) => (...args) =>
+      window.BridgeComponentsChannel.postMessage(JSON.stringify({ name, args }))
+  })
+
   // This represents the adapter that is installed on the webBridge
   // All adapters implement the same interface so the web doesn't need to
   // know anything specific about the client platform

core/src/main/assets/js/turbo.js

@@ -1,6 +1,12 @@
 (() => {
   const TURBO_LOAD_TIMEOUT = 4000
 
+  // TurboSessionChannel is injected by the native side via WebViewCompat.addWebMessageListener().
+  const TurboSession = new Proxy({}, {
+    get: (_, name) => (...args) =>
+      window.TurboSessionChannel.postMessage(JSON.stringify({ name, args }))
+  })
+
   // Bridge between Turbo JS and native code. Built for Turbo 7
   // with backwards compatibility for Turbolinks 5
   class TurboNative {

core/src/main/kotlin/dev/hotwire/core/bridge/Bridge.kt

@@ -1,16 +1,19 @@
 package dev.hotwire.core.bridge
 
-import android.webkit.JavascriptInterface
 import android.webkit.WebView
 import androidx.annotation.VisibleForTesting
 import dev.hotwire.core.logging.logDebug
 import dev.hotwire.core.logging.logVerbose
+import dev.hotwire.core.logging.logWarning
+import dev.hotwire.core.security.JavascriptChannel
+import dev.hotwire.core.security.JavascriptMessage
+import dev.hotwire.core.security.stringAt
 import kotlinx.serialization.json.JsonElement
 import java.lang.ref.WeakReference
 
 // These need to match whatever is set in bridge_components.js
 private const val bridgeGlobal = "window.nativeBridge"
-private const val bridgeJavascriptInterface = "BridgeComponentsNative"
+private const val bridgeChannelName = "BridgeComponentsChannel"
 
 @Suppress("unused")
 class Bridge internal constructor(webView: WebView) {
@@ -20,14 +23,14 @@ class Bridge internal constructor(webView: WebView) {
     internal val webView: WebView? get() = webViewRef.get()
     internal var repository = Repository()
     internal var delegate: BridgeDelegate<*>? = null
+    internal val channel = JavascriptChannel(bridgeChannelName, ::dispatchBridgeMessage)
 
     init {
         // Use a weak reference in case the WebView is no longer being
         // used by the app, such as when the render process is gone.
         webViewRef = WeakReference(webView)
 
-        // The JavascriptInterface must be added before the page is loaded
-        webView.addJavascriptInterface(this, bridgeJavascriptInterface)
+        channel.install(webView)
     }
 
     internal fun register(component: String) {
@@ -69,26 +72,31 @@ class Bridge internal constructor(webView: WebView) {
         return componentsAreRegistered
     }
 
-    @JavascriptInterface
-    fun bridgeDidInitialize() {
-        logDebug("bridgeDidInitialize", "success")
-        runOnUiThread {
-            delegate?.bridgeDidInitialize()
+    private fun dispatchBridgeMessage(message: JavascriptMessage) {
+        when (message.name) {
+            "bridgeDidInitialize" -> bridgeDidInitialize()
+            "bridgeDidUpdateSupportedComponents" -> bridgeDidUpdateSupportedComponents()
+            "bridgeDidReceiveMessage" -> bridgeDidReceiveMessage(message.args.stringAt(0))
+            else -> logWarning(
+                "javascriptMessageUnknown",
+                listOf("channel" to bridgeChannelName, "name" to message.name)
+            )
         }
     }
 
-    @JavascriptInterface
-    fun bridgeDidUpdateSupportedComponents() {
+    private fun bridgeDidInitialize() {
+        logDebug("bridgeDidInitialize", "success")
+        delegate?.bridgeDidInitialize()
+    }
+
+    private fun bridgeDidUpdateSupportedComponents() {
         logDebug("bridgeDidUpdateSupportedComponents", "success")
         componentsAreRegistered = true
     }
 
-    @JavascriptInterface
-    fun bridgeDidReceiveMessage(message: String?) {
-        runOnUiThread {
-            InternalMessage.fromJson(message)?.let {
-                delegate?.bridgeDidReceiveMessage(it.toMessage())
-            }
+    private fun bridgeDidReceiveMessage(message: String) {
+        InternalMessage.fromJson(message)?.let {
+            delegate?.bridgeDidReceiveMessage(it.toMessage())
         }
     }
 

core/src/main/kotlin/dev/hotwire/core/bridge/BridgeDelegate.kt

@@ -5,6 +5,7 @@ import androidx.lifecycle.DefaultLifecycleObserver
 import androidx.lifecycle.LifecycleOwner
 import dev.hotwire.core.logging.logDebug
 import dev.hotwire.core.logging.logWarning
+import dev.hotwire.core.security.isTrustedForNativeAccess
 
 @Suppress("unused")
 class BridgeDelegate<D : BridgeDestination>(
@@ -14,15 +15,19 @@ class BridgeDelegate<D : BridgeDestination>(
 ) : DefaultLifecycleObserver {
     internal var bridge: Bridge? = null
     private var destinationIsActive: Boolean = false
+    // Trust checks use this, not resolvedLocation: the destination's intended
+    // location says nothing about what is loaded.
+    private val currentLocation: String?
+        get() = bridge?.webView?.url
     private val resolvedLocation: String
-        get() = bridge?.webView?.url ?: location
+        get() = currentLocation ?: location
 
     val initializedComponents = hashMapOf<String, BridgeComponent<D>>()
     val activeComponents: List<BridgeComponent<D>>
         get() = initializedComponents.map { it.value }.takeIf { destinationIsActive }.orEmpty()
 
     fun onColdBootPageCompleted() {
-        bridge?.load()
+        loadBridge()
     }
 
     fun onColdBootPageStarted() {
@@ -36,7 +41,7 @@ class BridgeDelegate<D : BridgeDestination>(
 
         if (bridge != null) {
             if (shouldReloadBridge()) {
-                bridge?.load()
+                loadBridge()
             }
         } else {
             logWarning("bridgeNotInitializedForWebView", resolvedLocation)
@@ -49,6 +54,11 @@ class BridgeDelegate<D : BridgeDestination>(
     }
 
     fun replyWith(message: Message): Boolean {
+        if (!isTrustedForNativeAccess(currentLocation)) {
+            logBlockedForUntrustedOrigin("bridgeReplyBlockedForUntrustedOrigin")
+            return false
+        }
+
         bridge?.replyWith(message) ?: run {
             logWarning("bridgeMessageFailedToReply", "bridge is not available")
             return false
@@ -72,10 +82,23 @@ class BridgeDelegate<D : BridgeDestination>(
         }
     }
 
+    private fun loadBridge() {
+        if (!isTrustedForNativeAccess(currentLocation)) {
+            logBlockedForUntrustedOrigin("bridgeLoadBlockedForUntrustedOrigin")
+            return
+        }
+
+        bridge?.load()
+    }
+
     private fun shouldReloadBridge(): Boolean {
         return destination.bridgeWebViewIsReady() && bridge?.isReady() == false
     }
 
+    private fun logBlockedForUntrustedOrigin(event: String) {
+        logWarning(event, listOf("location" to currentLocation.orEmpty()))
+    }
+
     // Lifecycle events
 
     override fun onStart(owner: LifecycleOwner) {

core/src/main/kotlin/dev/hotwire/core/config/HotwireConfig.kt

@@ -2,11 +2,16 @@ package dev.hotwire.core.config
 
 import android.content.Context
 import android.webkit.WebView
+import androidx.annotation.RestrictTo
 import dev.hotwire.core.bridge.BridgeComponent
 import dev.hotwire.core.bridge.BridgeComponentFactory
 import dev.hotwire.core.bridge.BridgeComponentJsonConverter
 import dev.hotwire.core.logging.DefaultHotwireLogger
 import dev.hotwire.core.logging.HotwireLogger
+import dev.hotwire.core.security.DefaultOriginTrustPolicy
+import dev.hotwire.core.security.Origin
+import dev.hotwire.core.security.OriginTrustPolicy
+import dev.hotwire.core.security.StartLocationRegistry
 import dev.hotwire.core.turbo.config.PathConfiguration
 import dev.hotwire.core.turbo.offline.OfflineRequestHandler
 import dev.hotwire.core.turbo.webview.HotwireWebView
@@ -40,6 +45,33 @@ class HotwireConfig internal constructor() {
      */
     var logger: HotwireLogger = DefaultHotwireLogger
 
+    internal val startLocationRegistry = StartLocationRegistry()
+
+    /**
+     * A live view of the origins of the start locations that `NavigatorHost`
+     * registers.
+     */
+    val registeredOrigins: Set<Origin>
+        get() = startLocationRegistry.origins
+
+    // Not public: under the default policy, adding an origin grants it
+    // native access.
+    @RestrictTo(RestrictTo.Scope.LIBRARY_GROUP)
+    fun registerStartLocation(startLocation: String) {
+        startLocationRegistry.register(startLocation)
+    }
+
+    @RestrictTo(RestrictTo.Scope.LIBRARY_GROUP)
+    fun unregisterStartLocation(startLocation: String) {
+        startLocationRegistry.unregister(startLocation)
+    }
+
+    /**
+     * The default, [DefaultOriginTrustPolicy], trusts only [registeredOrigins].
+     * Set your own if your app trusts more or does not use `NavigatorHost`.
+     */
+    var originTrustPolicy: OriginTrustPolicy = DefaultOriginTrustPolicy
+
     /**
      * Enables/disables debugging of web contents loaded into WebViews.
      * Disabled by default.

core/src/main/kotlin/dev/hotwire/core/files/delegates/FileChooserDelegate.kt

@@ -11,6 +11,8 @@ import dev.hotwire.core.R
 import dev.hotwire.core.files.util.HOTWIRE_REQUEST_CODE_FILES
 import dev.hotwire.core.files.util.HotwireFileProvider
 import dev.hotwire.core.logging.logError
+import dev.hotwire.core.logging.logWarning
+import dev.hotwire.core.security.isTrustedForNativeAccess
 import dev.hotwire.core.turbo.session.Session
 import dev.hotwire.core.turbo.util.dispatcherProvider
 import kotlinx.coroutines.CoroutineScope
@@ -31,6 +33,16 @@ class FileChooserDelegate(val session: Session) : CoroutineScope {
         filePathCallback: ValueCallback<Array<Uri>>,
         params: FileChooserParams
     ): Boolean {
+        // FileChooserParams has no origin, so gate on the page's URL.
+        val pageLocation = session.webView.url
+        if (!isTrustedForNativeAccess(pageLocation)) {
+            logWarning("fileChooserBlockedForUntrustedOrigin", listOf("location" to pageLocation.orEmpty()))
+            filePathCallback.onReceiveValue(null)
+            return true
+        }
+
+        // Answer a request still held from before; the WebView needs a verdict.
+        handleCancellation()
         uploadCallback = filePathCallback
 
         return openChooser(params).also { success ->
@@ -84,8 +96,16 @@ class FileChooserDelegate(val session: Session) : CoroutineScope {
         }
     }
 
-    private fun sendResult(results: Array<Uri>?) {
-        uploadCallback?.onReceiveValue(results)
+    internal fun sendResult(results: Array<Uri>?) {
+        // The WebView may have navigated while the picker was open.
+        val pageLocation = session.webView.url
+
+        if (results != null && !isTrustedForNativeAccess(pageLocation)) {
+            logWarning("fileChooserResultBlockedForUntrustedOrigin", listOf("location" to pageLocation.orEmpty()))
+            uploadCallback?.onReceiveValue(null)
+        } else {
+            uploadCallback?.onReceiveValue(results)
+        }
         uploadCallback = null
     }
 

core/src/main/kotlin/dev/hotwire/core/files/delegates/GeolocationPermissionDelegate.kt

@@ -10,6 +10,8 @@ import androidx.core.content.ContextCompat
 import androidx.core.content.PermissionChecker
 import dev.hotwire.core.files.util.HOTWIRE_REQUEST_CODE_GEOLOCATION_PERMISSION
 import dev.hotwire.core.logging.logError
+import dev.hotwire.core.logging.logWarning
+import dev.hotwire.core.security.isTrustedForNativeAccess
 import dev.hotwire.core.turbo.session.Session
 
 class GeolocationPermissionDelegate(private val session: Session) {
@@ -23,10 +25,16 @@ class GeolocationPermissionDelegate(private val session: Session) {
         origin: String?,
         callback: GeolocationPermissions.Callback?
     ) {
+        // Answer a request still held from before; the WebView needs a verdict.
+        permissionDenied()
+
         requestOrigin = origin
         requestCallback = callback
 
-        if (requestOrigin == null || requestCallback == null || permissionToRequest == null) {
+        if (!isTrustedForNativeAccess(origin)) {
+            logWarning("geolocationPermissionBlockedForUntrustedOrigin", listOf("origin" to origin.orEmpty()))
+            permissionDenied()
+        } else if (callback == null || permissionToRequest == null) {
             permissionDenied()
         } else if (hasLocationPermission(context)) {
             permissionGranted()
@@ -43,6 +51,16 @@ class GeolocationPermissionDelegate(private val session: Session) {
         }
     }
 
+    /**
+     * Called from [android.webkit.WebChromeClient.onGeolocationPermissionsHidePrompt].
+     * The WebView no longer wants an answer, so the held request is dropped
+     * unanswered.
+     */
+    fun onHidePrompt() {
+        requestOrigin = null
+        requestCallback = null
+    }
+
     private fun startPermissionRequest() {
         val destination = session.currentVisit?.callback?.visitDestination() ?: return
         val resultLauncher = destination.activityPermissionResultLauncher(
@@ -64,7 +82,9 @@ class GeolocationPermissionDelegate(private val session: Session) {
     }
 
     private fun permissionGranted() {
-        requestCallback?.invoke(requestOrigin, true, true)
+        // The policy's answer may have changed while the dialog was up.
+        val allow = isTrustedForNativeAccess(requestOrigin)
+        requestCallback?.invoke(requestOrigin, allow, allow)
         requestOrigin = null
         requestCallback = null
     }

core/src/main/kotlin/dev/hotwire/core/files/delegates/WebViewPermissionDelegate.kt

@@ -11,6 +11,7 @@ import androidx.core.content.PermissionChecker
 import dev.hotwire.core.files.util.HOTWIRE_REQUEST_CODE_WEBVIEW_PERMISSION
 import dev.hotwire.core.logging.logError
 import dev.hotwire.core.logging.logWarning
+import dev.hotwire.core.security.isTrustedForNativeAccess
 import dev.hotwire.core.turbo.session.Session
 
 /**
@@ -39,6 +40,13 @@ class WebViewPermissionDelegate(private val session: Session) {
     private var pendingRequest: PermissionRequest? = null
 
     fun onRequest(request: PermissionRequest) {
+        val origin = request.origin?.toString()
+        if (!isTrustedForNativeAccess(origin)) {
+            logWarning("webViewPermissionBlockedForUntrustedOrigin", listOf("origin" to origin.orEmpty()))
+            request.deny()
+            return
+        }
+
         val requestedResources = request.resources?.toList().orEmpty()
         val supportedResources = requestedResources.filter { it in SUPPORTED_RESOURCES }
 
@@ -100,7 +108,8 @@ class WebViewPermissionDelegate(private val session: Session) {
             grantResults[permission] == true || isGranted(permission)
         }
 
-        if (allGranted) {
+        // The policy's answer may have changed while the dialog was up.
+        if (allGranted && isTrustedForNativeAccess(request.origin?.toString())) {
             request.grant(resources.toTypedArray())
         } else {
             request.deny()