fix(android): better cleaning of allowedOrigin url (#7607)

ionic-team · Aug 7, 2024 · d123260 · d123260
1 parent 2e5fc4d
commit d123260
Showing 1 changed file with 6 additions and 10 deletions.
diff --git a/android/capacitor/src/main/java/com/getcapacitor/Bridge.java b/android/capacitor/src/main/java/com/getcapacitor/Bridge.java
@@ -259,17 +259,13 @@ private void loadWebView() {
         // Start the local web server
         JSInjector injector = getJSInjector();
         if (WebViewFeature.isFeatureSupported(WebViewFeature.DOCUMENT_START_SCRIPT)) {
-            String allowedOrigin = appUrl;
-            Uri appUri = Uri.parse(appUrl).buildUpon().clearQuery().build();
-            if (appUri.getPath() != null) {
-                if (appUri.getPath().equals("/")) {
-                    allowedOrigin = appUrl.substring(0, appUrl.length() - 1);
-                } else {
-                    allowedOrigin = appUri.toString().replace(appUri.getPath(), "");
-                }
+            String allowedOrigin = Uri.parse(appUrl).buildUpon().path(null).fragment(null).clearQuery().build().toString();
+            try {
+                WebViewCompat.addDocumentStartJavaScript(webView, injector.getScriptString(), Collections.singleton(allowedOrigin));
+                injector = null;
+            } catch (IllegalArgumentException ex) {
+                Logger.warn("Invalid url, using fallback");
             }
-            WebViewCompat.addDocumentStartJavaScript(webView, injector.getScriptString(), Collections.singleton(allowedOrigin));
-            injector = null;
         }
         localServer = new WebViewLocalServer(context, this, injector, authorities, html5mode);
         localServer.hostAssets(DEFAULT_WEB_ASSET_DIR);