From 0f2f34f26a32c026c085ca92e3aaa779e1778aa8 Mon Sep 17 00:00:00 2001 From: dimitris Date: Fri, 15 May 2026 10:57:45 +0200 Subject: [PATCH] fix(android): drop AllowFileAccess and AllowUniversalAccessFromFileURLs on BitBox webview The hidden WebView used to host the BitBox JS bridge is created with source={{ html: "" }} and never navigates to a file:// URL. Setting AllowUniversalAccessFromFileURLs(true) and AllowFileAccess(true) only matters once the WebView lands on a file scheme, so neither flag does anything useful for the BitBox handshake. Both stay disabled by default on API 30+ but are still true on older devices unless toggled, so we drop the toggle to keep posture tight on those devices while behaviour on modern Android is unchanged. --- .../java/ch/swissbitcoinpay/checkout/BitBoxBridgeModule.java | 2 -- 1 file changed, 2 deletions(-) diff --git a/android/app/src/main/java/ch/swissbitcoinpay/checkout/BitBoxBridgeModule.java b/android/app/src/main/java/ch/swissbitcoinpay/checkout/BitBoxBridgeModule.java index 4b2c0af9..2c05f9b0 100644 --- a/android/app/src/main/java/ch/swissbitcoinpay/checkout/BitBoxBridgeModule.java +++ b/android/app/src/main/java/ch/swissbitcoinpay/checkout/BitBoxBridgeModule.java @@ -194,8 +194,6 @@ public void handleMessage(final Message msg) { vw.clearCache(true); vw.clearHistory(); vw.getSettings().setJavaScriptEnabled(true); - vw.getSettings().setAllowUniversalAccessFromFileURLs(true); - vw.getSettings().setAllowFileAccess(true); var url = vw.getUrl();