cordova-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Jesse <purplecabb...@gmail.com>
Subject Re: Android: Deprecate WebView.sendJavascript()?
Date Mon, 26 May 2014 18:53:25 GMT
Is the webview method evaluateJavascript [1] still available, callable from
the context of a plugin? Or is this somehow hidden?

Personally I think is okay to remove the cordova implemented
sendJavascript() as long as there is still a way to accomplish the rare but
sometimes required bare metal pass through.

Do/will other pluggable webviews support a consistent interface for calling
javascript in their loaded pages? ie. Does crosswalk support
evaluateJavascript?



[1]
http://developer.android.com/reference/android/webkit/WebView.html#evaluateJavascript(java.lang.String,
android.webkit.ValueCallback<java.lang.String>)



@purplecabbage
risingj.com


On Mon, May 26, 2014 at 11:04 AM, Joe Bowser <bowserj@gmail.com> wrote:

> On Mon, May 26, 2014 at 9:59 AM, Andrew Grieve <agrieve@chromium.org>
> wrote:
> > From: https://issues.apache.org/jira/browse/CB-6746
> >
> > Given that you can implement sendJavascript via PluginResults by just
> > eval()ing the results, maybe we could just deprecate the function?
>
> And this comment just earned this proposal a -1.
>
> Just eval()ing the results is a completely awful idea because it
> assumes that we can trust the data being returned from the plugin,
> which security researchers have shown many, many times that you can't.
>  That reason alone makes me want to keep this, although it's also bad
> in it's current form.
>

Mime
  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message