Description
WebView class has debuggingEnabled parameter, but it's not used in Android webview_flutter_android module. In file webview_android_widget.dart there is a function which takes parameter enabled, but it's not used, true value is used instead:
Future<void> setWebContentsDebuggingEnabled(bool enabled) {
return android_webview.WebView.setWebContentsDebuggingEnabled(true);
}
Link to the webview_android_widget.dart
As a result, regardless of the passed value, WebView always allows to debug its content even if apk is build in release mode. It can be dangerous in production app due to possible JavaScript injection attack by other applications installed on device.
Steps to reproduce
- Run the example app on Android device
- Open Chrome DevTools inspector - chrome://inspect/#devices
Expected results: WebView debugging shouldn't be enabled
Actual results: WebView debugging in enabled - app webview is visible in Chrome DevTools inspector
Description
WebView class has
debuggingEnabledparameter, but it's not used in Android webview_flutter_android module. In filewebview_android_widget.dartthere is a function which takes parameterenabled, but it's not used, true value is used instead:Link to the webview_android_widget.dart
As a result, regardless of the passed value, WebView always allows to debug its content even if apk is build in release mode. It can be dangerous in production app due to possible JavaScript injection attack by other applications installed on device.
Steps to reproduce
Expected results: WebView debugging shouldn't be enabled
Actual results: WebView debugging in enabled - app webview is visible in Chrome DevTools inspector