B4A Library FlingableWebView

NJDude · Oct 9, 2013

Cool.

If it's a replacement, it would be nice if becomes part of the B4A "core".

Also, if you could, add more descriptive prompts for the arguments, for example "arg0" is not really useful as opposed to "Left" for example.

freedom2000 · Feb 13, 2016

HI,

I am using this lib in some of my Apps to display static html pages for "help" menu.

Today I have got a warning on the GooglePlay developper console that basically says :

You have a security flaw in your code allowing "man in the middle attack" due to the fact that you do not test WebViewClient.onReceivedSslError

@warwound, I have checked the events rized in your App and I can't find any _onReceivedSslError...
Is there a way to add the code requested by Google ? I am afraid that most of my Apps will be blacklisted sooner or later if I don't correct the problem (even though there is probably no issue with my usecase..) ?

Here is (sorry in french) the full message I got from Google

Alerte de sécurité

Votre application présente une mise en œuvre non sécurisée du gestionnaire WebViewClient.onReceivedSslError. Plus précisément, toutes les erreurs de validation du certificat SSL sont ignorées, ce qui rend l'application vulnérable en cas d'attaques dites "de l'homme du milieu". Un pirate informatique pourrait modifier le contenu WebView affecté, lire les données transmises (telles que les identifiants de connexion) et exécuter du code au sein de l'application à l'aide de JavaScript.

Pour traiter correctement la validation des certificats SSL, modifiez votre code de sorte à invoquerSslErrorHandler.proceed() dans les cas où le certificat présenté par le serveur correspond à vos critères, et à invoquer SslErrorHandler.cancel() dans les autres cas. Une alerte indiquant les classes et les applications concernées a été envoyée à l'adresse e-mail de votre compte de développeur.

Veuillez corriger cette faille au plus vite et modifier en conséquence le numéro de version du fichier APK mis à jour. Pour en savoir plus sur le gestionnaire d'erreur SSL, consultez notre documentation dans le Centre d'aide pour les développeurs. Si vous avez d'autres questions techniques, publiez un message sur le sitehttps://www.stackoverflow.com/questions en utilisant les tgas "android-security" et "SslErrorHandler". Si vous utilisez une bibliothèque tierce responsable de cette faille, veuillez prendre contact avec le tiers concerné pour résoudre le problème.

Pour confirmer que vous avez correctement effectué la mise à jour, importez la nouvelle version dans la console développeur et vérifiez dans cinq heures. Un avertissement est affiché si l'application n'a pas été mise à jour correctement.

Thank you in advance

warwound · Feb 14, 2016

@freedom2000

I'll take a look at the problem over the next day or two.

freedom2000 · Feb 14, 2016

warwound said:
@freedom2000

I'll take a look at the problem over the next day or two.

Thank you for that !

By the way, i did googled a little into your posts and found the excellent AJWebkit library.
Using this lib I have modified my code. It now looks like this

B4X:

Sub Process_Globals

End Sub

Sub Globals
    Dim FlingableWebView1 As FlingableWebView
    Dim DefaultWebViewClient1 As DefaultWebViewClient
End Sub

Sub Activity_Create(FirstTime As Boolean)
    FlingableWebView1.Initialize2("FlingableWebView1","MyIf")
    DefaultWebViewClient1.Initialize("DefaultWV")
    Activity.AddView(FlingableWebView1, 32dip, 32dip, 100%x-64dip, 100%y-64dip)
    FlingableWebView1.SetWebViewClient(DefaultWebViewClient1)
    FlingableWebView1.LoadUrl("http://www.b4x.com/android/forum/threads/get-left-or-right-swipe-from-panel-over-webview.32611/")
End Sub

Sub Activity_Resume

End Sub

Sub Activity_Pause (UserClosed As Boolean)

End Sub

Sub FlingableWebView1_DoubleTap(X As Float, Y As Float) As Boolean
    Log("FlingableWebView1_DoubleTap "&X&", "&Y)
  
    '    this Sub must return a Boolean value
  
    '    return False to indicate that you have not handled the event
    '    the WebView will take it's default action
  
    '    return True to indicate that you have handled the event
    '    the WebView will take no action
  
    Return False
End Sub

Sub FlingableWebView1_Fling(MovementX As Float, VelocityX As Float, MovementY As Float, VelocityY As Float) As Boolean
    Log("FlingableWebView1_Fling "&MovementX&" "&VelocityX&" | "&MovementY&" "&VelocityY)
  
    '    this Sub must return a Boolean value
  
    '    return False to indicate that you have not handled the event
    '    the WebView will take it's default action
  
    '    return True to indicate that you have handled the event
    '    the WebView will take no action
  
    Return False
End Sub

Sub FlingableWebView1_LongPress(X As Float, Y As Float)
    Log("FlingableWebView1_LongPress "&X&", "&Y)
    '    note this event has no return value
End Sub

Sub FlingableWebView1_PageFinished (FlingableWebView As FlingableWebView, Url As String)
    Log("FlingableWebView1_PageFinished Url="&Url)
End Sub

Sub FlingableWebView1_SingleTap(X As Float, Y As Float) As Boolean
    Log("FlingableWebView1_SingleTap "&X&", "&Y)
  
    '    this Sub must return a Boolean value
  
    '    return False to indicate that you have not handled the event
    '    the WebView will take it's default action
  
    '    return True to indicate that you have handled the event
    '    the WebView will take no action
  
    Return False
End Sub
Sub DefaultWV_ReceivedError (FlingableWebView As FlingableWebView, ErrorCode As Int, Description As String, FailingUrl As String)
    Log("error" & Description)
End Sub
Sub DefaultWV_ReceivedSslError (FlingableWebView As FlingableWebView, SslErrorHandler1 As SslErrorHandler, SslError1 As SslError)
    Log("error" )
End Sub

I have trapped the ReceivedError event as well as the ReceivedSSLError
I pushed the Apk to the google Play and this morning the Security warning had disappeared !

The notification is now : Il semble que tout fonctionne correctement.Vous n'avez reçu aucune alerte récente.

So far so good !
I must admit that I did nothing more than trapping the error, but it seems that it is enough for Google !

Please tell me if what I did is the right way to handle the problem ?
Thanks again

warwound · Feb 14, 2016

Hi.

Google's complaint was that if an SSL error occurred then the code would blindly ignore the error - creating a wide open back door into the WebView.
They want your code to instead do something in the ReceivedSslError event - look at the error and make an intelligent decision whether to proceed or not.

So as long as your code doesn't blindly call the SslErrorHandler Proceed method you should be ok.

freedom2000 · Feb 14, 2016

warwound said:
Hi.

Google's complaint was that if an SSL error occurred then the code would blindly ignore the error - creating a wide open back door into the WebView.
They want your code to instead do something in the ReceivedSslError event - look at the error and make an intelligent decision whether to proceed or not.

So as long as your code doesn't blindly call the SslErrorHandler Proceed method you should be ok.

Thank you !

elgransipe · Feb 15, 2016

freedom2000 said:
Thank you for that !

By the way, i did googled a little into your posts and found the excellent AJWebkit library.
Using this lib I have modified my code. It now looks like this

B4X:

. . . Sub DefaultWV_ReceivedError (FlingableWebView As FlingableWebView, ErrorCode As Int, Description As String, FailingUrl As String) Log("error" & Description) End Sub Sub DefaultWV_ReceivedSslError (FlingableWebView As FlingableWebView, SslErrorHandler1 As SslErrorHandler, SslError1 As SslError) Log("error" ) End Sub

Hi.

I have the same problem. I understand that you solved changing the FringableWebView with the AJWebkit library and adding Sub DefaultWV_ReceivedError and Sub DefaultWV_ReceivedSslError to your code, wasn't it?

Did you delete the FringableWebView library too?

My webView load html that it's into the code (no internet conection is needed) so I understand that google is only watching that RecivedSslError is handled.

freedom2000 · Feb 15, 2016

yes right !

Same issue as you ...

- suppress the ref "flingablevebview" lib in the IDE and add AJWebkit
- add these lines :

B4X:

Sub Globals
    Dim FlingableWebView1 As FlingableWebView
    Dim DefaultWebViewClient1 As DefaultWebViewClient
End Sub

Sub Activity_Create(FirstTime As Boolean)
    FlingableWebView1.Initialize2("FlingableWebView1","MyIf")
    DefaultWebViewClient1.Initialize("DefaultWV")

- add the two subs to "handle" the errors

B4X:

Sub DefaultWV_ReceivedError (FlingableWebView As FlingableWebView, ErrorCode As Int, Description As String, FailingUrl As String)
End Sub
Sub DefaultWV_ReceivedSslError (FlingableWebView As FlingableWebView, SslErrorHandler1 As SslErrorHandler, SslError1 As SslError)
End Sub

It should work, google will suppress the security warning within less than a day.

elgransipe · Feb 15, 2016

freedom2000 said:
yes right !

Same issue as you ...

- suppress the ref "flingablevebview" lib in the IDE and add AJWebkit
- add these lines :

B4X:

Sub Globals Dim FlingableWebView1 As FlingableWebView Dim DefaultWebViewClient1 As DefaultWebViewClient End Sub Sub Activity_Create(FirstTime As Boolean) FlingableWebView1.Initialize2("FlingableWebView1","MyIf") DefaultWebViewClient1.Initialize("DefaultWV")

- add the two subs to "handle" the errors

B4X:

Sub DefaultWV_ReceivedError (FlingableWebView As FlingableWebView, ErrorCode As Int, Description As String, FailingUrl As String) End Sub Sub DefaultWV_ReceivedSslError (FlingableWebView As FlingableWebView, SslErrorHandler1 As SslErrorHandler, SslError1 As SslError) End Sub

It should work, google will suppress the security warning within less than a day.

Thanks a lot!

warwound · Feb 20, 2016

Rick Harris said:
I am getting the same warning from Google regarding: WebViewClient.onReceivedSslError
Is it correct that this involves your flingable Webview version (which you originally made for me a couple of years ago)?

Yep.
Google must be looking at how your code handles an SSL error.
With the early version of the library an SSL error was silently ignored and loading of the webpage blindly allowed to continue - this was hardcoded into the library.
Google is complaining about this - it doesn't want your code to ignore the error and continue regardless.

AJWebKit allows you to take whatever action you like when an SSL error occurs.
So switch to AJWebKit and handle the SSL error event and you should find Google no longer complains.

freedom2000 · Feb 20, 2016

I confirm that using AJWebkit solves the problem.

freedom2000 · Feb 22, 2016

In post #5 I gave all the modified code to have a "flingablewebview" with error trackings.
It works for google, the security warning is no longer there !

Ydm · Apr 28, 2016

Hello.
'Flingablewebview' I want to ask you about two things.
1) How do I read the scroll position and change it?
2) When I zoom, scroll horizontally before they occur, how do I make the move to the bottom line of text located in the word? CSS in "word-wrap: break-word;" As the property ....

Ydm · May 4, 2016

Flingablewebview support for this much?

elgransipe · Jan 1, 2017

@warwound I'm having a problem with fringable webView. I try to contact U in a private convesation but i get an error.

I get this error while compiling:

B4A version: 5.50
Parsing code. (0.83s)
Compiling code. (0.47s)
Compiling layouts code. (0.02s)
Generating R file. (0.53s)
Compiling debugger engine code. (2.51s)
Compiling generated Java code. Error
B4A line: 81
FWebView1.SetWebViewClient(DefaultWebViewClient1)
javac 1.8.0_111
src\AppName\com\MyClass.java:442: error: cannot find symbol
mostCurrent._fwebview1.SetWebViewClient((android.webkit.WebViewClient)(mostCurrent._defaultwebviewclient1.getObject()));
^
symbol: method SetWebViewClient(WebViewClient)
location: variable _fwebview1 of type FlingableWebView
1 error

Something is happening with the fringable webView

Thanks!

Edit: I'm Using API 24

Erel · Jan 1, 2017

Can you upload your project?

elgransipe · Jan 1, 2017

Erel said:
Can you upload your project?

Including additional libraries? something private like ftp or similar?
Can I export the projet or just upload the folder project?

DonManfred · Jan 2, 2017

elgransipe said:
Can I export the projet or just upload the folder project?

without additional libs...
From the IDE:
File->Export as zip
Select zipname to save.

Upload this zip file.

elgransipe · Jan 2, 2017

DonManfred said:
without additional libs...
From the IDE:
File->Export as zip
Select zipname to save.

Upload this zip file.

Thanks a lot.

I think the problem is a corrupted file in my computer.

Y restore a project backup and now it's working. I use Dropbox to store my projects, maybe some file was corrupted 'cause now it's working.

I'll be checking the project in this week. Thanks.

B4A Library FlingableWebView

Attachments

NJDude

Expert

freedom2000

Well-Known Member

warwound

Expert

freedom2000

Well-Known Member

warwound

Expert

freedom2000

Well-Known Member

elgransipe

Member

freedom2000

Well-Known Member

elgransipe

Member

warwound

Expert

freedom2000

Well-Known Member

freedom2000

Well-Known Member

Ydm

Active Member

Ydm

Active Member

elgransipe

Member

Erel

B4X founder

elgransipe

Member

DonManfred

Expert

elgransipe

Member