@capacitor/android 7.6.7 → 7.6.9

package/capacitor/src/main/java/com/getcapacitor/Bridge.java

@@ -391,6 +391,12 @@ public class Bridge {
     }
 
     public boolean launchIntent(Uri url) {
+        // The proxy returns a remote body at the app origin, so block it before plugins can allow it.
+        String path = url.getPath();
+        if (path != null && path.startsWith(CAPACITOR_HTTP_INTERCEPTOR_START)) {
+            return true;
+        }
+
         /*
          * Give plugins the chance to handle the url
          */

package/capacitor/src/main/java/com/getcapacitor/BridgeWebChromeClient.java

@@ -345,6 +345,7 @@ public class BridgeWebChromeClient extends WebChromeClient {
             return false;
         }
         takePictureIntent.putExtra(MediaStore.EXTRA_OUTPUT, imageFileUri);
+        takePictureIntent.addFlags(Intent.FLAG_GRANT_WRITE_URI_PERMISSION | Intent.FLAG_GRANT_READ_URI_PERMISSION);
         activityListener = (activityResult) -> {
             Uri[] result = null;
             if (activityResult.getResultCode() == Activity.RESULT_OK) {

package/capacitor/src/main/java/com/getcapacitor/Plugin.java

@@ -1003,7 +1003,8 @@ public class Plugin {
      * Give the plugins a chance to take control when a URL is about to be loaded in the WebView.
      * Returning true causes the WebView to abort loading the URL.
      * Returning false causes the WebView to continue loading the URL.
-     * Returning null will defer to the default Capacitor policy
+     * Returning null will defer to the default Capacitor policy.
+     * Not called for Capacitor's internal HTTP proxy path, which is always blocked.
      */
     @SuppressWarnings("unused")
     public Boolean shouldOverrideLoad(Uri url) {

package/capacitor/src/main/java/com/getcapacitor/WebViewLocalServer.java

@@ -185,6 +185,11 @@ public class WebViewLocalServer {
         Uri loadingUrl = request.getUrl();
 
         if (null != loadingUrl.getPath() && loadingUrl.getPath().startsWith(Bridge.CAPACITOR_HTTP_INTERCEPTOR_START)) {
+            // Only fetch/XHR should reach the proxy; a document would run remote content at the app origin.
+            boolean httpEnabled = bridge.getConfig().getPluginConfiguration("CapacitorHttp").getBoolean("enabled", false);
+            if (!httpEnabled || isDocumentRequest(request)) {
+                return null;
+            }
             Logger.debug("Handling CapacitorHttp request: " + loadingUrl);
             try {
                 return handleCapacitorHttpRequest(request);
@@ -210,6 +215,24 @@ public class WebViewLocalServer {
         }
     }
 
+    /** isForMainFrame() is false for an iframe and a fetch alike; only navigations send this header. */
+    private boolean isDocumentRequest(WebResourceRequest request) {
+        if (request.isForMainFrame()) {
+            return true;
+        }
+        Map<String, String> headers = request.getRequestHeaders();
+        if (headers == null) {
+            // The proxy needs the headers too, so the request fails there anyway.
+            return false;
+        }
+        for (String header : headers.keySet()) {
+            if ("Upgrade-Insecure-Requests".equalsIgnoreCase(header)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
     private boolean isLocalFile(Uri uri) {
         String path = uri.getPath();
         return path.startsWith(capacitorContentStart) || path.startsWith(capacitorFileStart);
@@ -333,6 +356,9 @@ public class WebViewLocalServer {
         int responseCode = connection.getResponseCode();
         String reasonPhrase = getReasonPhraseFromResponseCode(responseCode);
 
+        // Nothing should render this. If anything does, sandbox keeps it inert and off the app origin.
+        responseHeaders.put("Content-Security-Policy", "sandbox; frame-ancestors 'none'");
+
         return new WebResourceResponse(mimeType, encoding, responseCode, reasonPhrase, responseHeaders, inputStream);
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capacitor/android",
-  "version": "7.6.7",
+  "version": "7.6.9",
   "description": "Capacitor: Cross-platform apps with JavaScript and the web",
   "homepage": "https://capacitorjs.com",
   "author": "Ionic Team <hi@ionic.io> (https://ionic.io)",