CordovaWebViewImpl showWebPage can crash Android >= 7 devices

[akinzie]

I found out about the crash from the Google play console for my app, so I don't have all the information about reproducing it. However, I have inspected the code indicated by the stack trace and have noticed two potential issues with CordovaWebViewImpl's showWebPage method.

1. If openExternal is false, it will attempt to load the url in the internal webview and also will start an intent to view it externally (as long as it matches the whitelist). See this if block. Previously it returned inside that if block, but this commit removed the return statement - possibly by mistake I speculate.

2. Passing a file url outside an app is no longer allowed as of Android 7, but that is being done here.

2 is what actually causes the crash, although by inspecting the stack trace I'm pretty sure openExternal is false, so fixing 1 would avoid the crash in my case.

This is the stack trace:

android.os.FileUriExposedException: 
  at android.os.StrictMode.onFileUriExposed (StrictMode.java:1960)
  at android.net.Uri.checkFileUriExposed (Uri.java:2356)
  at android.content.Intent.prepareToLeaveProcess (Intent.java:9881)
  at android.content.Intent.prepareToLeaveProcess (Intent.java:9835)
  at android.app.Instrumentation.execStartActivity (Instrumentation.java:1612)
  at android.app.Activity.startActivityForResult (Activity.java:4501)
  at org.apache.cordova.CordovaActivity.startActivityForResult (CordovaActivity.java:343)
  at android.app.Activity.startActivityForResult (Activity.java:4459)
  at android.app.Activity.startActivity (Activity.java:4820)
  at android.app.Activity.startActivity (Activity.java:4788)
  at org.apache.cordova.CordovaWebViewImpl.showWebPage (CordovaWebViewImpl.java:239)
  at org.apache.cordova.CordovaActivity$2.run (CordovaActivity.java:379)
  at android.app.Activity.runOnUiThread (Activity.java:6188)
  at org.apache.cordova.CordovaActivity.onReceivedError (CordovaActivity.java:377)
  at org.apache.cordova.CordovaActivity.onMessage (CordovaActivity.java:465)
  at org.apache.cordova.CordovaActivity$1.onMessage (CordovaActivity.java:214)
  at org.apache.cordova.PluginManager.postMessage (PluginManager.java:318)
  at org.apache.cordova.CordovaWebViewImpl$1.run (CordovaWebViewImpl.java:164)
  at android.os.Handler.handleCallback (Handler.java:790)
  at android.os.Handler.dispatchMessage (Handler.java:99)
  at android.os.Looper.loop (Looper.java:164)
  at android.app.ActivityThread.main (ActivityThread.java:6518)
  at java.lang.reflect.Method.invoke (Native Method)
  at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run (RuntimeInit.java:438)
  at com.android.internal.os.ZygoteInit.main (ZygoteInit.java:807)

[joeljeske]

@akinzie, This is exactly what I am experiencing right now, and I have also just came to the same conclusion as yourself.

In my setup, this is crashing when the error url is attempted to be navigated to as that flow uses CordovaWebViewImpl.showWebPage instead of CordovaWebViewImpl.loadUrlIntoView

Reproduction Steps:

• Create a cordova project with cordova-android 7.1.1
• Install and run on a device with API Level 24 (probably 24+, but I am testing on 24)
• See that the index.html page loads correctly
• Change the config.xml <content> tag to a https:// address that is unreachable, and will trigger a timeout
• Change the config.xml and add the preference ErrorUrl to the index.html, using the proper file url: <preference name="ErrorUrl" value="file:///android_asset/www/index.html" />
• Rebuild, reinstall
• See that after the specified timeout or failure to contact the unavailable web address, the app crashes. The index page that should have loaded as an "error page" was not able to be loaded and the stack trace @akinzie mentioned is given in the logs.

If you add proper return;s in the same block that was linked to, the issue does not occur and the error url is able to navigated to.

[akinzie]

Thanks for fixing this!