Mailing-List: contact dev-help@cordova.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cordova.apache.org
From: "Sergey Shakhnazarov (Akvelon)" <v-seshak@microsoft.com>
To: "dev@cordova.apache.org" <dev@cordova.apache.org>
Subject: Android cdvfile: whitelisting
Thread-Topic: Android cdvfile: whitelisting
Thread-Index: AdG6ezlaAwF87pd7SB2zA73AG2mYoQ==
Date: Mon, 30 May 2016 13:58:44 +0000
Message-ID: <BL2PR03MB579510E356EA4E39F0181CE9D450@BL2PR03MB579.namprd03.prod.outlook.com>
Accept-Language: ru-RU, en-US
Content-Language: en-US
spamdiagnosticoutput: 1:23
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative;
	boundary="_000_BL2PR03MB579510E356EA4E39F0181CE9D450BL2PR03MB579namprd_"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-originalarrivaltime: 30 May 2016 13:58:44.0635
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL2PR03MB580
archived-at: Mon, 30 May 2016 13:58:57 -0000

--_000_BL2PR03MB579510E356EA4E39F0181CE9D450BL2PR03MB579namprd_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hello dev list,


I would like to discuss cdvfile: protocol whitelisting - whether it should =
be allowed by default.

Looking into the issue CB-11305 [1] I've patched the file plugin Android co=
de to enable cdvfile: in DOM requests and added a corresponding test.

The test was failing in paramedic on Android because the default template d=
oes not allow cdvfile: access, so we need to add it to config.xml as an all=
ow-navigation tag (or as an access tag + CSP rule).


Mobilespec test app used custom config.xml [2].


There is also an old PR to the whitelist plugin allowing cdvfile: and conte=
nt: schemes [3].


An alternative can be to include the allow-navigation tag to Android sectio=
n of the File plugin.xml [4] (it's the way the PR for CB-11305 is done now)=
.


So what do you think about these 2 options?

1.      Allow cdvfile: in Android whitelist by default,

2.      Allow cdvfile: in Android section of File plugin.xml by default usi=
ng allow-navigation tag.


[1]: https://issues.apache.org/jira/browse/CB-11305

[2]: https://github.com/apache/cordova-mobile-spec/blob/ff9f2fa3acce67ccdb2=
11d46ebb3a6d4213a7c5d/config.xml#L48

[3]: https://github.com/apache/cordova-plugin-whitelist/pull/9

[4]: https://github.com/apache/cordova-plugin-file/pull/182/commits/287158f=
c844e3825ff43080ef19f94f3e585ba00#diff-53f390d375398624afe1cfe1125f42bfR126


Best regards,

Sergey Shakhnazarov.

--_000_BL2PR03MB579510E356EA4E39F0181CE9D450BL2PR03MB579namprd_--