Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Switch to WebView version that doesn't silently grant camera permission #11028

Merged
merged 1 commit into from
Aug 3, 2020
Merged

Switch to WebView version that doesn't silently grant camera permission #11028

merged 1 commit into from
Aug 3, 2020

Conversation

vkjr
Copy link
Contributor

@vkjr vkjr commented Aug 3, 2020 •
edited
Loading

fixes #... TBD

Summary

When page requests for permission to use camera on Android react-native-webview checks whether Status app has that permission and if yes - allows access. But this is wrong behaviour because if user has granted camera access to Status app that doesn't mean 3rd-party site also should get access.
Fix for such a problem described here - https://github.com/googlesamples/android-PermissionRequest and implemented in latest WebView changes.

This pr switches status-react to update WebView version.

Review notes

Switching to WebView will result in silent not granting camera\mic access. To speedup fix the UI that explicitly asks user will be added in an additional pr.

Platforms

  • Android

Areas that maybe impacted

Functional
  • web browsing

Steps to test

  • Open Status
  • allow camera access (for example by initiating qr code scanning and allowing permission request)
  • send link https://fatal0.netlify.com/android/webviewvideo.html to some chat.
  • click on that link and open in Status browser
  • make sure that image from camera didn't appear on the page

status: ready

@vkjr vkjr requested a review from a team as a code owner August 3, 2020 09:05
@status-im-auto
Copy link
Member

status-im-auto commented Aug 3, 2020 •
edited
Loading

Jenkins Builds

❔ Commit #️⃣ Finished (UTC) Duration Platform Result
✔️ 9a5e0b6 #1 2020-08-03 09:16:39 ~11 min android 📦apk 📲
✔️ 9a5e0b6 #1 2020-08-03 09:18:06 ~12 min android-e2e 📦apk 📲
✔️ 9a5e0b6 #1 2020-08-03 09:25:38 ~19 min ios 📦ipa 📲

@vkjr vkjr self-assigned this Aug 3, 2020
@status-im-auto
Copy link
Member

100% of end-end tests have passed

Total executed tests: 97
Failed tests: 0
Passed tests: 97

Passed tests (97)

Click to expand
1. test_request_public_key_status_test_daap
Device sessions

2. test_open_public_chat_using_deep_link
Device sessions

3. test_ens_username_recipient
Device sessions

4. test_keycard_can_see_all_transactions_in_history
Device sessions

5. test_offline_status
Device sessions

6. test_open_transaction_on_etherscan
Device sessions

7. test_open_chat_by_pasting_public_key
Device sessions

8. test_back_forward_buttons_browsing_website
Device sessions

9. test_password_in_logcat_creating_account
Device sessions

10. test_can_use_purchased_stickers_on_recovered_account
Device sessions

11. test_insufficient_funds_wallet_positive_balance
Device sessions

12. test_mobile_data_usage_settings
Device sessions

13. test_open_google_com_via_open_dapp
Device sessions

14. test_logcat_backup_recovery_phrase
Device sessions

15. test_unread_messages_counter_public_chat
Device sessions

16. test_send_two_transactions_one_after_another_in_dapp
Device sessions

17. test_user_can_switch_network
Device sessions

18. test_public_chat_clear_history
Device sessions

19. test_wallet_set_up
Device sessions

20. test_timestamp_in_chats
Device sessions

21. test_delete_chats_via_delete_button
Device sessions

22. test_add_account_to_multiaccount_instance_seed_phrase
Device sessions

23. test_fetch_more_history_in_empty_chat
Device sessions

24. test_push_notification_1_1_chat
Device sessions

25. test_mobile_data_usage_popup_continue_syncing
Device sessions

26. test_keycard_fetching_balance_after_offline
Device sessions

27. test_add_to_contacts
Device sessions

28. test_dapps_permissions
Device sessions

29. test_long_press_delete_clear_all_dapps
Device sessions

30. test_need_help_section
Device sessions

31. test_transaction_wrong_password_wallet
Device sessions

32. test_offline_messaging_1_1_chat
Device sessions

33. test_add_account_to_multiaccount_instance_private_key
Device sessions

34. test_text_message_1_1_chat
Device sessions

35. test_install_pack_and_send_sticker
Device sessions

36. test_send_eth_in_1_1_chat
Device sessions

37. test_pair_devices_sync_one_to_one_contacts_public_chat
Device sessions

38. test_image_in_one_to_one_send_save_reply
Device sessions

39. test_send_emoji
Device sessions

40. test_copy_and_paste_messages
Device sessions

41. test_keycard_send_eth_in_1_1_chat
Device sessions

42. test_restore_account_from_mnemonic_to_keycard
Device sessions

43. test_add_account_to_multiaccount_instance_generate_new
Device sessions

44. test_send_eth_from_wallet_to_address
Device sessions

45. test_messaging_in_different_networks
Device sessions

46. test_start_chat_with_ens
Device sessions

47. test_logcat_recovering_account
Device sessions

48. test_offline_add_new_group_chat_member
Device sessions

49. test_connection_is_secure
Device sessions

50. test_keycard_send_transaction_from_daap
Device sessions

51. test_user_can_see_all_own_assets_after_account_recovering
Device sessions

52. test_send_eth_to_ens_in_chat
Device sessions

53. test_keycard_sign_message_from_daap
Device sessions

54. test_long_press_to_delete_chat
Device sessions

55. test_add_and_remove_contact_from_public_chat
Device sessions

56. test_send_transaction_from_daap
Device sessions

57. test_onboarding_screen_when_requesting_tokens_for_recovered_account
Device sessions

58. test_keycard_send_eth_from_wallet_to_address
Device sessions

59. test_keycard_send_two_transactions_one_after_another_in_dapp
Device sessions

60. test_add_and_delete_watch_only_account_to_multiaccount_instance
Device sessions

61. test_open_blocked_site
Device sessions

62. test_refresh_button_browsing_app_webview
Device sessions

63. test_public_chat_messaging
Device sessions

64. test_pass_phrase_validation
Device sessions

65. test_send_token_with_7_decimals
Device sessions

66. test_sign_message_from_daap
Device sessions

67. test_recover_account_from_new_user_seedphrase
Device sessions

68. test_add_new_keycard_account_and_login
Device sessions

69. test_decline_transactions_in_1_1_chat
Device sessions

70. test_send_and_open_links
Device sessions

71. test_manage_assets
Device sessions

72. test_share_contact_code_and_wallet_address
Device sessions

73. test_send_transaction_with_custom_token
Device sessions

74. test_keycard_send_eth_to_ens (TestRail link is not found)
Device sessions

75. test_can_recover_keycard_account_card_pairing
Device sessions

76. test_request_and_receive_stt_in_1_1_chat_offline
Device sessions

77. test_redirect_to_public_chat_tapping_tag_message
Device sessions

78. test_block_user_from_public_chat
Device sessions

79. test_ens_in_public_and_1_1_chats
Device sessions

80. test_create_new_group_chat
Device sessions

81. test_password_in_logcat_sign_in
Device sessions

82. test_account_recovery_with_uppercase_recovery_phrase
Device sessions

83. test_mobile_data_usage_popup_stop_syncing
Device sessions

84. test_send_non_english_message_to_newly_added_contact
Device sessions

85. test_collectible_from_wallet_opens_in_browser_view
Device sessions

86. test_contact_profile_view
Device sessions

87. test_keycard_send_two_transactions_in_batch_in_dapp
Device sessions

88. test_switch_users_and_add_new_account
Device sessions

89. test_send_two_transactions_in_batch_in_dapp
Device sessions

90. test_filters_from_daap
Device sessions

91. test_login_with_new_account
Device sessions

92. test_home_view
Device sessions

93. test_log_level_and_fleet
Device sessions

94. test_can_add_existing_ens
Device sessions

95. test_copy_contact_code_and_wallet_address
Device sessions

96. test_fetching_balance_after_offline
Device sessions

97. test_can_see_all_transactions_in_history
Device sessions

@churik churik added the 1.5 label Aug 3, 2020
@hesterbruikman
Copy link
Contributor

hesterbruikman commented Aug 3, 2020 •
edited
Loading

Tested on Galaxy S10e Android 10. Camera did not appear when navigating to https://fatal0.netlify.com/android/webviewvideo.html (expected ✅)

Note: Browser also did not request permission to use camera. I think this is a feature out of scope of this PR that addresses the security vulnerability

@churik
Copy link
Member

churik commented Aug 3, 2020

@vkjr
tested briefly on IOS13 and Andrid10:

  • browser history
  • dapp transacting
  • dapp access rights
  • issue is fixed.

@vkjr
Switched to updated version of WebView that asks for permissions
d5015e4 
Signed-off-by: Volodymyr Kozieiev <vkjr.sp@gmail.com>
@vkjr vkjr merged commit d5015e4 into develop Aug 3, 2020
@vkjr vkjr deleted the fix/webview_permission branch August 3, 2020 12:51
@vkjr vkjr mentioned this pull request Aug 4, 2020
Merged
@weekly-digest weekly-digest bot mentioned this pull request Aug 9, 2020
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@flexsurfer flexsurfer flexsurfer approved these changes

@vitvly vitvly Awaiting requested review from vitvly

@0kok0 0kok0 Awaiting requested review from 0kok0

Assignees

@vkjr vkjr

Labels
request-manual-qa Tested - OK
Projects
No open projects
Legacy QA Automation Project
Archived in project
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@vkjr @status-im-auto @hesterbruikman @churik @flexsurfer