From 34434fe228a6734060e8d841a242d5c7ed01380a Mon Sep 17 00:00:00 2001 From: dimitris Date: Wed, 13 May 2026 22:50:29 +0200 Subject: [PATCH] Disable setAllowFileAccess in NewsblurWebview NewsblurWebview already serves bundled assets through WebViewAssetLoader (see NewsblurWebViewClient.shouldInterceptRequest and setAssetLoader). The reading WebView is loaded with READING_BASE_URL = "https://appassets.androidplatform.net/assets/", which is the standard virtual host that WebViewAssetLoader uses to serve android_asset over https. The page never has a file:// URL in its address bar or as the main frame. setAllowFileAccess(true) is therefore not load-bearing here. Flip it to false. The asset loader pathway is unaffected because shouldInterceptRequest serves resources directly from the AssetManager and does not consult this flag. Assisted-by: Claude (Anthropic) --- .../src/main/java/com/newsblur/web/NewsblurWebview.java | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/clients/android/NewsBlur/app/src/main/java/com/newsblur/web/NewsblurWebview.java b/clients/android/NewsBlur/app/src/main/java/com/newsblur/web/NewsblurWebview.java index 4c8aced07e..de080686b2 100644 --- a/clients/android/NewsBlur/app/src/main/java/com/newsblur/web/NewsblurWebview.java +++ b/clients/android/NewsBlur/app/src/main/java/com/newsblur/web/NewsblurWebview.java @@ -56,7 +56,12 @@ public NewsblurWebview(Context context, AttributeSet attrs) { getSettings().setCacheMode(WebSettings.LOAD_CACHE_ELSE_NETWORK); getSettings().setDomStorageEnabled(true); getSettings().setSupportZoom(true); - getSettings().setAllowFileAccess(true); + // Reading WebView is loaded with the https appassets virtual host + // (READING_BASE_URL = https://appassets.androidplatform.net/assets/) + // and serves all bundled resources through + // WebViewAssetLoader.shouldInterceptRequest. It never loads a file:// + // URL, so setAllowFileAccess(true) is not load-bearing here. + getSettings().setAllowFileAccess(false); // Remove default web search and share to accommodate the custom contextual menu getSettings().setDisabledActionModeMenuItems(WebSettings.MENU_ITEM_WEB_SEARCH);