Precautions for WebView injection of Java objects

Before android4.2, the injection steps are as follows:

webview.getSetting().setJavaScriptEnable(true);class JsObject {    public String toString() { return "injectedObject"; } } webView.addJavascriptInterface(new JsObject(), "injectedObject");

Android4.2 and later, the injection steps are as follows:

webview.getSetting().setJavaScriptEnable(true);class JsObject {    @JavascriptInterface    public String toString() { return "injectedObject"; } } webView.addJavascriptInterface(new JsObject(), "injectedObject");

Are there any differences? The toString interface exposed by the object injected to webview before 4.2 has no comment statement @ JavascriptInterface, and the comment statement @ JavascriptInterface is added to the interface 4.2 and later.

This interface allows JavaScript to control the Host application. This is a powerful feature, but at the same time, there is a major security risk before version 4.2, because JavaScript
You can use reflection to access the public fields of the java object injected with webview. Using this method in a WebView containing Untrusted Content allows attackers to tamper with the Host application, use the permissions of the Host application to execute java code. Therefore, any interface exposed for JS after 4.2 needs to be added

@JavascriptInterface

In this way, fields of this Java object cannot be accessed by JS.

Official documentation:

From the Android 4.2 documentation:

Caution: If you 've set your targetSdkVersion to 17 or higher, you must add the @ JavascriptInterface annotation to any method that you want available your web page code (the method must also be public ). if you do not provide
Annotation, then the method will not accessible by your web page when running on Android 4.2 or higher.

Note: If you set targetSdkVersion to 17 or higher but do not add @ JavascriptInterface annotation to the exposed js interface, logcat reports the following output:

E/Web Console: Uncaught TypeError: Object [object Object] has no method 'tostring'

Public void addJavascriptInterface (Object object, String name) Added in API level 1

Injects the supplied Java object into this WebView. The object is injected into the JavaScript context of the main frame, using the supplied name. This allows the Java
Object's methods to be accessed from JavaScript. For applications targeted to API levelJELLY_BEAN_MR1And
Above, only public methods that are annotatedJavascriptInterfaceCan
Be accessed from JavaScript. For applications targeted to API levelJELLY_BEANOr
Below, all public methods (including the inherited ones) can be accessed, see the important security note below for implications.

Note that injected objects will not appear in JavaScript until the page is next (re) loaded. For example:

 class JsObject {    @JavascriptInterface    public String toString() { return "injectedObject"; } } webView.addJavascriptInterface(new JsObject(), "injectedObject"); webView.loadData("", "text/html", null); webView.loadUrl("javascript:alert(injectedObject.toString())");

IMPORTANT:

• This method can be used to allow JavaScript to control the host application. This is a powerful feature, but also presents a security risk for applications targeted to API levelJELLY_BEANOr
  Below, because JavaScript cocould use reflection to access an injected object's public fields. use of this method in a WebView containing untrusted content cocould allow an attacker to manipulate the host application in unintended ways, executing Java code
  The permissions of the host application. Use extreme care when using this method in a WebView which cocould contain untrusted content.
• JavaScript interacts with Java object on a private, background thread of this WebView. Care is therefore required to maintain thread safety.
• The Java object's fields are not accessible.

Parameters

Object	The Java object to inject into this webview's JavaScript context. null values are ignored.
Name	The name used to expose the object in Javascript