@capacitor/android 6.2.1 → 6.2.2

package/capacitor/src/main/java/com/getcapacitor/Bridge.java

@@ -372,6 +372,12 @@ public class Bridge {
     }
 
     public boolean launchIntent(Uri url) {
+        // The proxy returns a remote body at the app origin, so block it before plugins can allow it.
+        String path = url.getPath();
+        if (path != null && path.startsWith(CAPACITOR_HTTP_INTERCEPTOR_START)) {
+            return true;
+        }
+
         /*
          * Give plugins the chance to handle the url
          */

package/capacitor/src/main/java/com/getcapacitor/Plugin.java

@@ -999,7 +999,8 @@ public class Plugin {
      * Give the plugins a chance to take control when a URL is about to be loaded in the WebView.
      * Returning true causes the WebView to abort loading the URL.
      * Returning false causes the WebView to continue loading the URL.
-     * Returning null will defer to the default Capacitor policy
+     * Returning null will defer to the default Capacitor policy.
+     * Not called for Capacitor's internal HTTP proxy path, which is always blocked.
      */
     @SuppressWarnings("unused")
     public Boolean shouldOverrideLoad(Uri url) {

package/capacitor/src/main/java/com/getcapacitor/WebViewLocalServer.java

@@ -172,6 +172,11 @@ public class WebViewLocalServer {
         Uri loadingUrl = request.getUrl();
 
         if (null != loadingUrl.getPath() && loadingUrl.getPath().startsWith(Bridge.CAPACITOR_HTTP_INTERCEPTOR_START)) {
+            // Only fetch/XHR should reach the proxy; a document would run remote content at the app origin.
+            boolean httpEnabled = bridge.getConfig().getPluginConfiguration("CapacitorHttp").getBoolean("enabled", false);
+            if (!httpEnabled || isDocumentRequest(request)) {
+                return null;
+            }
             Logger.debug("Handling CapacitorHttp request: " + loadingUrl);
             try {
                 return handleCapacitorHttpRequest(request);
@@ -197,6 +202,24 @@ public class WebViewLocalServer {
         }
     }
 
+    /** isForMainFrame() is false for an iframe and a fetch alike; only navigations send this header. */
+    private boolean isDocumentRequest(WebResourceRequest request) {
+        if (request.isForMainFrame()) {
+            return true;
+        }
+        Map<String, String> headers = request.getRequestHeaders();
+        if (headers == null) {
+            // The proxy needs the headers too, so the request fails there anyway.
+            return false;
+        }
+        for (String header : headers.keySet()) {
+            if ("Upgrade-Insecure-Requests".equalsIgnoreCase(header)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
     private boolean isLocalFile(Uri uri) {
         String path = uri.getPath();
         return path.startsWith(capacitorContentStart) || path.startsWith(capacitorFileStart);
@@ -311,6 +334,9 @@ public class WebViewLocalServer {
         int responseCode = connection.getResponseCode();
         String reasonPhrase = getReasonPhraseFromResponseCode(responseCode);
 
+        // Nothing should render this. If anything does, sandbox keeps it inert and off the app origin.
+        responseHeaders.put("Content-Security-Policy", "sandbox; frame-ancestors 'none'");
+
         return new WebResourceResponse(mimeType, encoding, responseCode, reasonPhrase, responseHeaders, inputStream);
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capacitor/android",
-  "version": "6.2.1",
+  "version": "6.2.2",
   "description": "Capacitor: Cross-platform apps with JavaScript and the web",
   "homepage": "https://capacitorjs.com",
   "author": "Ionic Team <hi@ionic.io> (https://ionic.io)",