@capacitor/android 8.3.5-nightly-20260601T165419.0 → 8.3.5

package/capacitor/src/main/java/com/getcapacitor/Bridge.java

@@ -387,6 +387,12 @@ public class Bridge {
     }
 
     public boolean launchIntent(Uri url) {
+        // The proxy returns a remote body at the app origin, so block it before plugins can allow it.
+        String path = url.getPath();
+        if (path != null && path.startsWith(CAPACITOR_HTTP_INTERCEPTOR_START)) {
+            return true;
+        }
+
         /*
          * Give plugins the chance to handle the url
          */

package/capacitor/src/main/java/com/getcapacitor/Plugin.java

@@ -1003,7 +1003,8 @@ public class Plugin {
      * Give the plugins a chance to take control when a URL is about to be loaded in the WebView.
      * Returning true causes the WebView to abort loading the URL.
      * Returning false causes the WebView to continue loading the URL.
-     * Returning null will defer to the default Capacitor policy
+     * Returning null will defer to the default Capacitor policy.
+     * Not called for Capacitor's internal HTTP proxy path, which is always blocked.
      */
     @SuppressWarnings("unused")
     public Boolean shouldOverrideLoad(Uri url) {

package/capacitor/src/main/java/com/getcapacitor/PluginConfig.java

@@ -65,17 +65,6 @@ public class PluginConfig {
         return JSONUtils.getInt(config, configKey, defaultValue);
     }
 
-    /**
-     * Get a double value for a plugin in the Capacitor config.
-     *
-     * @param configKey The key of the value to retrieve
-     * @param defaultValue A default value to return if the key does not exist in the config
-     * @return The value from the config, if key exists. Default value returned if not
-     */
-    public double getDouble(String configKey, double defaultValue) {
-        return JSONUtils.getDouble(config, configKey, defaultValue);
-    }
-
     /**
      * Get a string array value for a plugin in the Capacitor config.
      *

package/capacitor/src/main/java/com/getcapacitor/WebViewLocalServer.java

@@ -185,6 +185,11 @@ public class WebViewLocalServer {
         Uri loadingUrl = request.getUrl();
 
         if (null != loadingUrl.getPath() && loadingUrl.getPath().startsWith(Bridge.CAPACITOR_HTTP_INTERCEPTOR_START)) {
+            // Only fetch/XHR should reach the proxy; a document would run remote content at the app origin.
+            boolean httpEnabled = bridge.getConfig().getPluginConfiguration("CapacitorHttp").getBoolean("enabled", false);
+            if (!httpEnabled || isDocumentRequest(request)) {
+                return null;
+            }
             Logger.debug("Handling CapacitorHttp request: " + loadingUrl);
             try {
                 return handleCapacitorHttpRequest(request);
@@ -210,6 +215,24 @@ public class WebViewLocalServer {
         }
     }
 
+    /** isForMainFrame() is false for an iframe and a fetch alike; only navigations send this header. */
+    private boolean isDocumentRequest(WebResourceRequest request) {
+        if (request.isForMainFrame()) {
+            return true;
+        }
+        Map<String, String> headers = request.getRequestHeaders();
+        if (headers == null) {
+            // The proxy needs the headers too, so the request fails there anyway.
+            return false;
+        }
+        for (String header : headers.keySet()) {
+            if ("Upgrade-Insecure-Requests".equalsIgnoreCase(header)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
     private boolean isLocalFile(Uri uri) {
         String path = uri.getPath();
         return path.startsWith(capacitorContentStart) || path.startsWith(capacitorFileStart);
@@ -333,6 +356,9 @@ public class WebViewLocalServer {
         int responseCode = connection.getResponseCode();
         String reasonPhrase = getReasonPhraseFromResponseCode(responseCode);
 
+        // Nothing should render this. If anything does, sandbox keeps it inert and off the app origin.
+        responseHeaders.put("Content-Security-Policy", "sandbox; frame-ancestors 'none'");
+
         return new WebResourceResponse(mimeType, encoding, responseCode, reasonPhrase, responseHeaders, inputStream);
     }
 

package/capacitor/src/main/java/com/getcapacitor/cordova/MockCordovaWebViewImpl.java

@@ -70,12 +70,14 @@ public class MockCordovaWebViewImpl implements CordovaWebView {
 
         @Override
         public void onNativeToJsMessageAvailable(final NativeToJsMessageQueue queue) {
-            cordova.getActivity().runOnUiThread(() -> {
-                String js = queue.popAndEncodeAsJs();
-                if (js != null) {
-                    webView.evaluateJavascript(js, null);
-                }
-            });
+            cordova
+                .getActivity()
+                .runOnUiThread(() -> {
+                    String js = queue.popAndEncodeAsJs();
+                    if (js != null) {
+                        webView.evaluateJavascript(js, null);
+                    }
+                });
         }
     }
 

package/capacitor/src/main/java/com/getcapacitor/plugin/SystemBars.java

@@ -16,7 +16,6 @@ import androidx.core.view.WindowCompat;
 import androidx.core.view.WindowInsetsCompat;
 import androidx.core.view.WindowInsetsControllerCompat;
 import androidx.webkit.WebViewCompat;
-import com.getcapacitor.Logger;
 import com.getcapacitor.Plugin;
 import com.getcapacitor.PluginCall;
 import com.getcapacitor.PluginMethod;
@@ -33,7 +32,6 @@ public class SystemBars extends Plugin {
     static final String BAR_STATUS_BAR = "StatusBar";
     static final String BAR_GESTURE_BAR = "NavigationBar";
 
-    // TODO: In Cap 9, add an additional option "full"
     static final String INSETS_HANDLING_CSS = "css";
     static final String INSETS_HANDLING_DISABLE = "disable";
 
@@ -55,7 +53,7 @@ public class SystemBars extends Plugin {
         capacitorSystemBarsCheckMetaViewport();
         """;
 
-    private String insetsHandling = INSETS_HANDLING_CSS;
+    private boolean insetHandlingEnabled = true;
     private boolean hasViewportCover = false;
 
     private String currentStatusBarStyle = STYLE_DEFAULT;
@@ -96,15 +94,9 @@ public class SystemBars extends Plugin {
         String style = getConfig().getString("style", STYLE_DEFAULT).toUpperCase(Locale.US);
         boolean hidden = getConfig().getBoolean("hidden", false);
 
-        String configuredInsetsHandling = getConfig().getString("insetsHandling", INSETS_HANDLING_CSS);
-        if (INSETS_HANDLING_CSS.equals(configuredInsetsHandling) || INSETS_HANDLING_DISABLE.equals(configuredInsetsHandling)) {
-            insetsHandling = configuredInsetsHandling;
-        } else {
-            Logger.warn(
-                "SystemBars",
-                "Unknown insetsHandling value '" + configuredInsetsHandling + "'. Falling back to '" + INSETS_HANDLING_CSS + "'."
-            );
-            insetsHandling = INSETS_HANDLING_CSS;
+        String insetsHandling = getConfig().getString("insetsHandling", "css");
+        if (insetsHandling.equals(INSETS_HANDLING_DISABLE)) {
+            insetHandlingEnabled = false;
         }
 
         initWindowInsetsListener();
@@ -154,15 +146,13 @@ public class SystemBars extends Plugin {
 
     @JavascriptInterface
     public void onDOMReady() {
-        if (INSETS_HANDLING_CSS.equals(insetsHandling)) {
-            getActivity().runOnUiThread(() -> {
-                this.bridge.getWebView().evaluateJavascript(viewportMetaJSFunction, (res) -> {
-                    hasViewportCover = res.equals("true");
+        getActivity().runOnUiThread(() -> {
+            this.bridge.getWebView().evaluateJavascript(viewportMetaJSFunction, (res) -> {
+                hasViewportCover = res.equals("true");
 
-                    getBridge().getWebView().requestApplyInsets();
-                });
+                getBridge().getWebView().requestApplyInsets();
             });
-        }
+        });
     }
 
     private Insets calcSafeAreaInsets(WindowInsetsCompat insets) {
@@ -174,16 +164,9 @@ public class SystemBars extends Plugin {
     }
 
     private void initSafeAreaCSSVariables() {
-        if (INSETS_HANDLING_CSS.equals(insetsHandling)) {
-            WindowInsetsCompat insets;
-
-            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.VANILLA_ICE_CREAM) {
-                View v = (View) this.getBridge().getWebView().getParent();
-                insets = ViewCompat.getRootWindowInsets(v);
-            } else {
-                insets = WindowInsetsCompat.CONSUMED;
-            }
-
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.VANILLA_ICE_CREAM && insetHandlingEnabled) {
+            View v = (View) this.getBridge().getWebView().getParent();
+            WindowInsetsCompat insets = ViewCompat.getRootWindowInsets(v);
             if (insets != null) {
                 Insets safeAreaInsets = calcSafeAreaInsets(insets);
                 injectSafeAreaCSS(safeAreaInsets.top, safeAreaInsets.right, safeAreaInsets.bottom, safeAreaInsets.left);
@@ -192,10 +175,6 @@ public class SystemBars extends Plugin {
     }
 
     private void initWindowInsetsListener() {
-        if (INSETS_HANDLING_DISABLE.equals(insetsHandling)) {
-            return;
-        }
-
         ViewCompat.setOnApplyWindowInsetsListener((View) getBridge().getWebView().getParent(), (v, insets) -> {
             boolean shouldPassthroughInsets = getWebViewMajorVersion() >= WEBVIEW_VERSION_WITH_SAFE_AREA_FIX && hasViewportCover;
 
@@ -207,8 +186,10 @@ public class SystemBars extends Plugin {
                 // We need to correct for a possible shown IME
                 v.setPadding(0, 0, 0, keyboardVisible ? imeInsets.bottom : 0);
 
-                Insets safeAreaInsets = calcSafeAreaInsets(insets);
-                injectSafeAreaCSS(safeAreaInsets.top, safeAreaInsets.right, safeAreaInsets.bottom, safeAreaInsets.left);
+                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.VANILLA_ICE_CREAM && hasViewportCover && insetHandlingEnabled) {
+                    Insets safeAreaInsets = calcSafeAreaInsets(insets);
+                    injectSafeAreaCSS(safeAreaInsets.top, safeAreaInsets.right, safeAreaInsets.bottom, safeAreaInsets.left);
+                }
 
                 return new WindowInsetsCompat.Builder(insets)
                     .setInsets(
@@ -240,8 +221,10 @@ public class SystemBars extends Plugin {
                 .setInsets(WindowInsetsCompat.Type.systemBars() | WindowInsetsCompat.Type.displayCutout(), Insets.of(0, 0, 0, 0))
                 .build();
 
-            Insets safeAreaInsets = calcSafeAreaInsets(newInsets);
-            injectSafeAreaCSS(safeAreaInsets.top, safeAreaInsets.right, safeAreaInsets.bottom, safeAreaInsets.left);
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.VANILLA_ICE_CREAM && hasViewportCover && insetHandlingEnabled) {
+                Insets safeAreaInsets = calcSafeAreaInsets(newInsets);
+                injectSafeAreaCSS(safeAreaInsets.top, safeAreaInsets.right, safeAreaInsets.bottom, safeAreaInsets.left);
+            }
 
             return newInsets;
         });

package/capacitor/src/main/java/com/getcapacitor/util/JSONUtils.java

@@ -75,26 +75,6 @@ public class JSONUtils {
         return defaultValue;
     }
 
-    /**
-     * Get a double value from the given JSON object.
-     *
-     * @param jsonObject A JSON object to search
-     * @param key A key to fetch from the JSON object
-     * @param defaultValue A default value to return if the key cannot be found
-     * @return The value at the given key in the JSON object, or the default value
-     */
-    public static double getDouble(JSONObject jsonObject, String key, double defaultValue) {
-        String k = getDeepestKey(key);
-        try {
-            JSONObject o = getDeepestObject(jsonObject, key);
-            return o.getDouble(k);
-        } catch (JSONException ignore) {
-            // value was not found
-        }
-
-        return defaultValue;
-    }
-
     /**
      * Get a JSON object value from the given JSON object.
      *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capacitor/android",
-  "version": "8.3.5-nightly-20260601T165419.0",
+  "version": "8.3.5",
   "description": "Capacitor: Cross-platform apps with JavaScript and the web",
   "homepage": "https://capacitorjs.com",
   "author": "Ionic Team <hi@ionic.io> (https://ionic.io)",
@@ -23,7 +23,7 @@
     "verify": "./gradlew clean lint build test -b capacitor/build.gradle"
   },
   "peerDependencies": {
-    "@capacitor/core": "^8.3.0-nightly-20260601T165419.0"
+    "@capacitor/core": "^8.3.0"
   },
   "publishConfig": {
     "access": "public"