@capgo/capacitor-inappbrowser 8.21.0 → 8.21.1

package/android/build.gradle

@@ -3,7 +3,45 @@ ext {
     androidxAppCompatVersion = project.hasProperty('androidxAppCompatVersion') ? rootProject.ext.androidxAppCompatVersion : '1.7.1'
     androidxJunitVersion = project.hasProperty('androidxJunitVersion') ? rootProject.ext.androidxJunitVersion : '1.3.0'
     androidxEspressoCoreVersion = project.hasProperty('androidxEspressoCoreVersion') ? rootProject.ext.androidxEspressoCoreVersion : '3.7.0'
-    androidxBrowserVersion = project.hasProperty('androidxBrowserVersion') ? rootProject.ext.androidxBrowserVersion : '1.9.0'
+    androidxBrowserVersion = {
+        def requested = project.hasProperty('androidxBrowserVersion') ? rootProject.ext.androidxBrowserVersion : '1.9.0'
+        def minimum = '1.9.0'
+        def parseVersionParts = { String version ->
+            version.tokenize('.').collect { part ->
+                def match = (part =~ /^(\d+)/)
+                match.find() ? match.group(1).toInteger() : 0
+            }
+        }
+        def stripPrerelease = { String version ->
+            def dashIndex = version.indexOf('-')
+            dashIndex > 0 ? version.substring(0, dashIndex) : version
+        }
+        def isAtLeast = { String version, String baseline ->
+            def versionParts = parseVersionParts(version)
+            def baselineParts = parseVersionParts(baseline)
+            def length = Math.max(versionParts.size(), baselineParts.size())
+            for (int index = 0; index < length; index++) {
+                int versionPart = index < versionParts.size() ? versionParts[index] : 0
+                int baselinePart = index < baselineParts.size() ? baselineParts[index] : 0
+                if (versionPart != baselinePart) {
+                    return versionPart >= baselinePart
+                }
+            }
+            return true
+        }
+        def requestedBase = stripPrerelease(requested)
+        if (!isAtLeast(requestedBase, minimum)) {
+            throw new GradleException(
+                "androidxBrowserVersion must be >= ${minimum} (required for Custom Tabs APIs such as setUrlBarHidingEnabled and setEphemeralBrowsingEnabled), got: ${requested}"
+            )
+        }
+        if (requested.contains('-') && isAtLeast(requestedBase, minimum) && isAtLeast(minimum, requestedBase)) {
+            throw new GradleException(
+                "androidxBrowserVersion must be >= ${minimum} stable (prerelease not accepted at the minimum version), got: ${requested}"
+            )
+        }
+        return requested
+    }()
 }
 
 buildscript {

package/android/src/main/java/ee/forgr/capacitor_inappbrowser/BundledAssetSupport.java

@@ -9,6 +9,9 @@ import com.getcapacitor.Bridge;
 import java.io.IOException;
 import java.io.InputStream;
 import java.net.URI;
+import java.net.URLDecoder;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.HashSet;
@@ -81,10 +84,123 @@ final class BundledAssetSupport {
         return resolve(url, localConfig);
     }
 
+    static boolean isFileUrl(String url) {
+        if (isBlank(url)) {
+            return false;
+        }
+
+        try {
+            return "file".equalsIgnoreCase(URI.create(url.trim()).getScheme());
+        } catch (IllegalArgumentException error) {
+            return url.trim().regionMatches(true, 0, "file:", 0, "file:".length());
+        }
+    }
+
+    static boolean isTrustedBundledFileUrl(String url) {
+        if (!isFileUrl(url)) {
+            return false;
+        }
+
+        String path = fileUrlPath(url.trim());
+        if (path == null || path.isEmpty()) {
+            return false;
+        }
+
+        String decoded = percentDecodePath(path);
+        if (decoded == null) {
+            return false;
+        }
+
+        String canonical = canonicalizeAbsolutePath(decoded);
+        if (canonical == null) {
+            return false;
+        }
+
+        return "/android_asset".equals(canonical) || canonical.startsWith("/android_asset/");
+    }
+
+    private static String percentDecodePath(String path) {
+        String decoded = path;
+        for (int iteration = 0; iteration < 3; iteration++) {
+            try {
+                String next = URLDecoder.decode(decoded, StandardCharsets.UTF_8);
+                if (next.equals(decoded)) {
+                    break;
+                }
+                decoded = next;
+            } catch (IllegalArgumentException error) {
+                return null;
+            }
+        }
+        return decoded;
+    }
+
+    private static String canonicalizeAbsolutePath(String path) {
+        if (path == null || path.isEmpty()) {
+            return null;
+        }
+
+        String normalized = path.startsWith("/") ? path : "/" + path;
+        if (normalized.indexOf('\\') >= 0) {
+            return null;
+        }
+        String[] rawSegments = normalized.split("/", -1);
+        ArrayList<String> segments = new ArrayList<>();
+        for (String segment : rawSegments) {
+            if (segment.isEmpty() || ".".equals(segment)) {
+                continue;
+            }
+            if ("..".equals(segment)) {
+                if (segments.isEmpty()) {
+                    return null;
+                }
+                segments.remove(segments.size() - 1);
+                continue;
+            }
+            segments.add(segment);
+        }
+
+        if (segments.isEmpty()) {
+            return "/";
+        }
+
+        StringBuilder builder = new StringBuilder();
+        for (String segment : segments) {
+            builder.append('/').append(segment);
+        }
+        return builder.toString();
+    }
+
+    private static String fileUrlPath(String url) {
+        try {
+            return URI.create(url).getPath();
+        } catch (IllegalArgumentException error) {
+            if (!url.regionMatches(true, 0, "file:", 0, "file:".length())) {
+                return null;
+            }
+
+            String remainder = url.substring("file:".length());
+            if (remainder.startsWith("//")) {
+                remainder = remainder.substring(2);
+                if (remainder.startsWith("/")) {
+                    return remainder;
+                }
+                int slash = remainder.indexOf('/');
+                return slash >= 0 ? remainder.substring(slash) : "/" + remainder;
+            }
+
+            return remainder.startsWith("/") ? remainder : "/" + remainder;
+        }
+    }
+
     static Resolution resolve(String url, LocalConfig localConfig) {
         String trimmed = url == null ? "" : url.trim();
         String navigationScheme = assetLoaderScheme(localConfig);
 
+        if (isFileUrl(trimmed) && !isTrustedBundledFileUrl(trimmed)) {
+            return null;
+        }
+
         if (isRelativeBundledPath(trimmed)) {
             String path = normalizeBundledPath(trimmed);
             if (path == null) {

package/android/src/main/java/ee/forgr/capacitor_inappbrowser/CapgoInAppBrowserPlugin.java

@@ -2152,7 +2152,7 @@ public class CapgoInAppBrowserPlugin extends Plugin implements WebViewDialog.Per
         openSecureWindowRedirectUri = redirectUri;
 
         CustomTabsIntent.Builder builder = new CustomTabsIntent.Builder();
-        builder.enableUrlBarHiding();
+        builder.setUrlBarHidingEnabled(true);
         builder.setShareState(CustomTabsIntent.SHARE_STATE_OFF);
         builder.setEphemeralBrowsingEnabled(Boolean.TRUE.equals(call.getBoolean("prefersEphemeralWebBrowserSession", false)));
         CustomTabsIntent customTabsIntent = builder.build();

package/android/src/main/java/ee/forgr/capacitor_inappbrowser/WebViewDialog.java

@@ -81,6 +81,7 @@ import androidx.coordinatorlayout.widget.CoordinatorLayout;
 import androidx.core.content.FileProvider;
 import androidx.core.content.res.ResourcesCompat;
 import androidx.core.graphics.Insets;
+import androidx.core.graphics.drawable.DrawableCompat;
 import androidx.core.view.ViewCompat;
 import androidx.core.view.WindowInsetsCompat;
 import androidx.core.view.WindowInsetsControllerCompat;
@@ -539,7 +540,10 @@ public class WebViewDialog extends ComponentDialog implements ProxyResponseRouti
         }
 
         @Override
-        public void onLowMemory() {}
+        @SuppressWarnings("deprecation")
+        public void onLowMemory() {
+            onTrimMemory(ComponentCallbacks2.TRIM_MEMORY_COMPLETE);
+        }
 
         @Override
         public void onTrimMemory(int level) {}
@@ -2451,11 +2455,10 @@ public class WebViewDialog extends ComponentDialog implements ProxyResponseRouti
         _webView.getSettings().setAllowFileAccess(true);
         _webView.getSettings().setLoadWithOverviewMode(true);
         _webView.getSettings().setUseWideViewPort(true);
-        _webView.getSettings().setAllowFileAccessFromFileURLs(true);
-        _webView.getSettings().setAllowUniversalAccessFromFileURLs(true);
+        applyTrustedBundledFileCrossOriginSettings(_options != null ? _options.getUrl() : null);
         if (!_options.getPersistWebViewData()) {
-            _webView.getSettings().setCacheMode(WebSettings.LOAD_NO_CACHE);
             _webView.getSettings().setDatabaseEnabled(false);
+            _webView.getSettings().setCacheMode(WebSettings.LOAD_NO_CACHE);
             _webView.clearCache(true);
             _webView.clearHistory();
             _webView.clearFormData();
@@ -3378,8 +3381,19 @@ public class WebViewDialog extends ComponentDialog implements ProxyResponseRouti
             mediaFullscreenWindow.restore();
             mediaFullscreenWindow = null;
         }
-        if (nativeFullscreenWindow != null) nativeFullscreenWindow.enter();
-        else reapplyInsetsFromWindowRoot();
+        if (nativeFullscreenWindow != null) {
+            nativeFullscreenWindow.enter();
+        } else {
+            reapplyInsetsFromWindowRoot();
+            if (SystemUiChromeSupport.requiresEdgeToEdgeChrome(Build.VERSION.SDK_INT)) {
+                boolean isBlankToolbar = _options != null && TextUtils.equals(_options.getToolbarType(), "blank");
+                if (isBlankToolbar) {
+                    configureBlankToolbarLayout();
+                } else {
+                    refreshEdgeToEdgeChrome();
+                }
+            }
+        }
 
         unregisterCustomFullscreenBackHandler();
 
@@ -4984,6 +4998,16 @@ public class WebViewDialog extends ComponentDialog implements ProxyResponseRouti
         }
     }
 
+    private void applyTrustedBundledFileCrossOriginSettings(String url) {
+        if (_webView == null) {
+            return;
+        }
+
+        boolean trustedBundledFile = BundledAssetSupport.isTrustedBundledFileUrl(url);
+        _webView.getSettings().setAllowFileAccessFromFileURLs(trustedBundledFile);
+        _webView.getSettings().setAllowUniversalAccessFromFileURLs(trustedBundledFile);
+    }
+
     private WebResourceResponse interceptBundledAssetRequest(WebResourceRequest request) {
         final WebViewAssetLoader loader;
         synchronized (bundledAssetLoaderLock) {
@@ -5012,6 +5036,13 @@ public class WebViewDialog extends ComponentDialog implements ProxyResponseRouti
             return;
         }
 
+        if (BundledAssetSupport.isFileUrl(url) && !BundledAssetSupport.isTrustedBundledFileUrl(url)) {
+            Log.e("InAppBrowser", "Rejected untrusted file URL");
+            return;
+        }
+
+        applyTrustedBundledFileCrossOriginSettings(url);
+
         try {
             if (loadHtmlDataUrlIfNeeded(url)) {
                 return;
@@ -5156,7 +5187,7 @@ public class WebViewDialog extends ComponentDialog implements ProxyResponseRouti
                     return null;
                 }
                 drawable = drawable.mutate();
-                drawable.setColorFilter(iconColor, PorterDuff.Mode.SRC_IN);
+                DrawableCompat.setTint(drawable, iconColor);
                 drawable.setBounds(0, 0, width, height);
                 return drawable;
             } catch (Exception e) {
@@ -6586,6 +6617,7 @@ public class WebViewDialog extends ComponentDialog implements ProxyResponseRouti
                     if (view == null || _webView == null) {
                         return;
                     }
+                    applyTrustedBundledFileCrossOriginSettings(url);
                     if (!isReload) {
                         _options.getCallbacks().urlChangeEvent(url);
                     }

package/ios/Sources/InAppBrowserPlugin/InAppBrowserPlugin.swift

@@ -446,7 +446,7 @@ public class CapgoInAppBrowserPlugin: CAPPlugin, CAPBridgedPlugin {
         case aware = "AWARE"
         case fakeVisible = "FAKE_VISIBLE"
     }
-    private let pluginVersion: String = "8.21.0"
+    private let pluginVersion: String = "8.21.1"
     public let identifier = "CapgoInAppBrowserPlugin"
     public let jsName = "CapgoInAppBrowser"
     public let pluginMethods: [CAPPluginMethod] = [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capgo/capacitor-inappbrowser",
-  "version": "8.21.0",
+  "version": "8.21.1",
   "description": "Capacitor plugin in app browser",
   "main": "dist/plugin.cjs.js",
   "module": "dist/esm/index.js",