如何针对易受攻击的意图方案劫持对WebView使用正确的意图

Question

我有这个WebView，在其中打开一个页面，该页面具有打开whatsapp，Messenger和电话的链接，如果不在浏览器中，则无法打开。

Google显然不喜欢它，并说我必须跳过这一部分。

有什么办法摆脱这个？

原始代码带有注释，因为我的应用程序已在网络导航器上打开，但我不想要它。因此我使用了意图方案来打开页面上的任何链接。

public class MainActivity extends AppCompatActivity {

WebView wv;


@Override
protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.activity_main);

     wv = findViewById(R.id.web);
    wv.setWebViewClient(new WebViewClient(){

        @Override
        public boolean shouldOverrideUrlLoading(WebView view, String url){

           /* if (url.startsWith("tel:") || url.startsWith("whatsapp:") || url.startsWith("intent")){
                Intent intent = new Intent(Intent.ACTION_VIEW, Uri.parse(url));
                startActivity(intent);
                //view.reload();
                return true;
            }

            view.loadUrl(url);
            return true;*/
           /* if (url.startsWith("http:") || url.startsWith("https:")) {

                return  false;
            }
            //agregar validacion para email, telefono y whatsapp
            if(url.startsWith("tel://")|| url.startsWith("mailto://")|| url.startsWith("whatsapp://")){
                Intent intent = new Intent(Intent.ACTION_VIEW, Uri.parse(url));


            }*/

            if (url.startsWith("http")) return false;//open web links as usual
            //try to find browse activity to handle uri
            Uri parsedUri = Uri.parse(url);
            PackageManager packageManager = getApplicationContext().getPackageManager();
            Intent browseIntent = new Intent(Intent.ACTION_VIEW).setData(parsedUri);
            if (browseIntent.resolveActivity(packageManager) != null) {
                getApplicationContext().startActivity(browseIntent);
                return true;
            }
            //if not activity found, try to parse intent://
            if (url.startsWith("intent:")) {
                try {
                    Intent intent = Intent.parseUri(url, Intent.URI_INTENT_SCHEME);
                    if (intent.resolveActivity(getApplicationContext().getPackageManager()) != null) {
                        getApplicationContext().startActivity(intent);
                        return true;
                    }
                    //try to find fallback url
                    String fallbackUrl = intent.getStringExtra("browser_fallback_url");
                    if (fallbackUrl != null) {
                        wv.loadUrl(fallbackUrl);
                        return true;
                    }
                    //invite to install
                    Intent marketIntent = new Intent(Intent.ACTION_VIEW).setData(
                            Uri.parse("market://details?id=" + intent.getPackage()));
                    if (marketIntent.resolveActivity(packageManager) != null) {
                        getApplicationContext().startActivity(marketIntent);
                        return true;
                    }
                } catch (URISyntaxException e) {
                    //not an intent uri
                }
            }
            return true;
        }

    });

    wv.getSettings().setJavaScriptEnabled(true);
    // wv.getSettings().setLoadWithOverviewMode(true);

    wv.loadUrl("http://www.saborasonoyta.com");

}


protected void showAppExitDialog(){
    AlertDialog.Builder builder = new AlertDialog.Builder(MainActivity.this);

    builder.setTitle("POR FAVOR, CONFIRME");
    builder.setMessage("desea salir de la aplicación?");
    builder.setCancelable(true);

    builder.setPositiveButton("Si", new DialogInterface.OnClickListener() {
        @Override
        public void onClick(DialogInterface dialogInterface, int i) {
            // Do something when user want to exit the app
            // Let allow the system to handle the event, such as exit the app
            MainActivity.super.onBackPressed();
        }
    });

    builder.setNegativeButton("No", new DialogInterface.OnClickListener() {
        @Override
        public void onClick(DialogInterface dialogInterface, int i) {
            // Do something when want to stay in the app
            Toast.makeText(getApplicationContext(),"Gracias",Toast.LENGTH_LONG).show();
        }
    });

    // Create the alert dialog using alert dialog builder
    AlertDialog dialog = builder.create();

    // Finally, display the dialog when user press back button
    dialog.show();
}

@Override
public void onBackPressed(){
    if(wv.canGoBack()){
        // If web view have back history, then go to the web view back history
        wv.goBack();
    }else {
        // Ask the user to exit the app or stay in here
        showAppExitDialog();
    }
  }
}

Answer 1

请检查此文档：https://support.google.com/faqs/answer/9101196?hl=ml

它告诉您如何摆脱Intent Scheme Hijacking Vulnerability。