前往小程序,Get更优阅读体验!
立即前往
首页
学习
活动
专区
工具
TVP
发布
社区首页 >专栏 >android--WebView使用addJavascriptInterface在sdk 17的问题

android--WebView使用addJavascriptInterface在sdk 17的问题

作者头像
战神伽罗
发布2019-07-24 15:54:10
8250
发布2019-07-24 15:54:10
举报

当调用WebView 的addJavascriptInterface时,使用android:targetSdkVersion="10"时是没有问题的,能够触发事件,但是毕竟使用版本时一般都使用最新的,我在开发时为了追求新,然后使用了android:targetSdkVersion="17"的属性,开始使用时并没有什么问题,大多数手机是可以使用的,比如中兴的N986,小米的MIMU4.1的系统是没有问题的,系统为2.3的几个机型也没看出问题,后来三星Note3上出问题啦,调用不了这个事件,我也纠结了半天,后来在网上查找原因,是去年android的漏洞所致,

所以修改方法有两个:

1,修改android:targetSdkVersion="10",这个只能为一时的解决方案,

2. 查找官方文件:说在17以上需要添加一个接口JavascriptInterface才能用,后来仔细看了官方的Demo才找到,就是蓝色加粗部分。如果这个问题您也遇到过,希望能帮助你,谢谢

官方给的说明:

public void addJavascriptInterface (Object object, String name)

Added in API level 1

Injects the supplied Java object into this WebView. The object is injected into the JavaScript context of the main frame, using the supplied name. This allows the Java object's methods to be accessed from JavaScript. For applications targeted to API level JELLY_BEAN_MR1 and above, only public methods that are annotated with JavascriptInterface can be accessed from JavaScript. For applications targeted to API level JELLY_BEAN or below, all public methods (including the inherited ones) can be accessed, see the important security note below for implications.

Note that injected objects will not appear in JavaScript until the page is next (re)loaded. For example:

代码语言:javascript
复制
 class JsObject {    @JavascriptInterface    public String toString() { return "injectedObject"; } } webView.addJavascriptInterface(new JsObject(), "injectedObject"); webView.loadData("", "text/html", null); webView.loadUrl("javascript:alert(injectedObject.toString())");

IMPORTANT:

  • This method can be used to allow JavaScript to control the host application. This is a powerful feature, but also presents a security risk for applications targeted to API level JELLY_BEAN or below, because JavaScript could use reflection to access an injected object's public fields. Use of this method in a WebView containing untrusted content could allow an attacker to manipulate the host application in unintended ways, executing Java code with the permissions of the host application. Use extreme care when using this method in a WebView which could contain untrusted content.
  • JavaScript interacts with Java object on a private, background thread of this WebView. Care is therefore required to maintain thread safety.
  • The Java object's fields are not accessible.
Parameters

object

the Java object to inject into this WebView's JavaScript context. Null values are ignored.

name

the name used to expose the object in JavaScript

本文参与 腾讯云自媒体分享计划,分享自作者个人站点/博客。
如有侵权请联系 cloudcommunity@tencent.com 删除

本文分享自 作者个人站点/博客 前往查看

如有侵权,请联系 cloudcommunity@tencent.com 删除。

本文参与 腾讯云自媒体分享计划  ,欢迎热爱写作的你一起参与!

评论
登录后参与评论
0 条评论
热度
最新
推荐阅读
目录
  • public void addJavascriptInterface (Object object, String name)
    • Parameters
    领券
    问题归档专栏文章快讯文章归档关键词归档开发者手册归档开发者手册 Section 归档