cordova-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Frederico Galvão <>
Subject Re: Whitelist breakout update
Date Fri, 31 Oct 2014 17:45:03 GMT
Looks good to me.

As I understood it, updating cordova and installing the
cordova-plugin-whitelist will bring my project up to par with what I
already have regarding external urls that don't launch external
Now, regarding the ones that do (launch external applications), what
happens with urls like [tel:<>, sms:<>, mailto:<>, etc]? Are they blocked
by default?
And what about normal http urls that have custom listeners registered, like
'<>' or '<>'

2014-10-30 18:04 GMT-02:00 Ian Clelland <>:

> I've spent the majority of the week finishing up the whitelist-breakout
> code, and I'd invite the rest of the community to take a look, before we
> make anything official.
> In order to retain some kind of backward compatibility with existing apps
> (because it's a terrible situation for everyone when we break that), I've
> endeavoured to provide hooks so that all of the existing functionality can
> be moved to a plugin, and so that *something* useful still happens if you
> don't have any plugins at all.
> Policy decisions are made centrally (in Android, by CordovaUriHelper; in
> iOS, by CDVViewController), first by asking all installed plugins whether
> to allow or deny the request, and if no plugins reply, then by applying a
> default policy (which is sane, but more restrictive than Cordova 3.6)
> Without any plugins, Cordova will allow navigation within the app itself,
> to file urls, and will allow resource loads (XHRs) from that space as well.
> External applications are *not* launched. <access> tags in config.xml are
> completely ignored.
> I've also modified the config parsers so that they can be used by plugins.
> (For example, the sample cordova-plugin-whitelist plugin reads config.xml
> to extract <access> tags for building its own whitelist, but other plugins
> could use any other method they wanted)
> All of this is in git, on branches named "unplug-whitelist", on these
> repos:
> cordova-android
> cordova-ios
> cordova-plugin-inappbrowser
> cordova-plugin-file-transfer
> cordova-mobile-spec
> I wrote a sample plugin --
> -- which implements
> the Cordova 3.6 behaviour. With that plugin, <access> tags in config.xml
> are parsed, just as they are right now. Navigation and XHR access to
> external resources is controlled by <access origin=... > tags, and
> launching of other applications is controlled by <access origin=...
> launch-external="yes"> tags.
> Comments welcome  -- either here or on
> Ian


*Frederico Galvão*

Diretor de Tecnologia

PontoGet Inovação Web

( +55(62) 8131-5720

* <>

  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message