I have a same problem using JS after webview created by onCreateWindow.
After digging sources, I feel like it's impossible.
final WebView.WebViewTransport transport = (WebView.WebViewTransport) msg.obj;
if(transport!=null){
transport.setWebView(mCustomWebView);
}
msg.sendToTarget();
After we send a message to target, WebViewChromium do this
mUiThreadHandler = new Handler() {
@Override
public void handleMessage(Message msg) {
switch(msg.what) {
case NEW_WEBVIEW_CREATED:
WebView.WebViewTransport t = (WebView.WebViewTransport) msg.obj;
WebView newWebView = t.getWebView();
if (newWebView == mWebView) {
throw new IllegalArgumentException(
"Parent WebView cannot host it's own popup window. Please " +
"use WebSettings.setSupportMultipleWindows(false)");
}
if (newWebView != null && newWebView.copyBackForwardList().getSize() != 0) {
throw new IllegalArgumentException(
"New WebView for popup window must not have been previously " +
"navigated.");
}
**WebViewChromium.completeWindowCreation(mWebView, newWebView);**
break;
default:
throw new IllegalStateException();
}
}
Then, it reads to addPossiblyUnsafeJavascriptInterface.
public void addPossiblyUnsafeJavascriptInterface(Object object, String name,
Class<? extends Annotation> requiredAnnotation) {
if (mNativeContentViewCore != 0 && object != null) {
mJavaScriptInterfaces.put(name, object);
nativeAddJavascriptInterface(mNativeContentViewCore, object, name, requiredAnnotation,
mRetainedJavaScriptObjects);
}
}
It seems like adding JS on an webview by onCreateWindow is prevented for the security reasons.
The comment says
/**
* This method injects the supplied Java object into the ContentViewCore.
* The object is injected into the JavaScript context of the main frame,
* using the supplied name. This allows the Java object to be accessed from
* JavaScript. Note that that injected objects will not appear in
* JavaScript until the page is next (re)loaded. For example:
*
view.addJavascriptInterface(new Object(), "injectedObject");
* view.loadData("", "text/html", null);
* view.loadUrl("javascript:alert(injectedObject.toString())");
* IMPORTANT:
*
* - addJavascriptInterface() can be used to allow JavaScript to control
* the host application. This is a powerful feature, but also presents a
* security risk. Use of this method in a ContentViewCore containing
* untrusted content could allow an attacker to manipulate the host
* application in unintended ways, executing Java code with the permissions
* of the host application. Use extreme care when using this method in a
* ContentViewCore which could contain untrusted content. Particular care
* should be taken to avoid unintentional access to inherited methods, such
* as {@link Object#getClass()}. To prevent access to inherited methods,
* pass an annotation for {@code requiredAnnotation}. This will ensure
* that only methods with {@code requiredAnnotation} are exposed to the
* Javascript layer. {@code requiredAnnotation} will be passed to all
* subsequently injected Java objects if any methods return an object. This
* means the same restrictions (or lack thereof) will apply. Alternatively,
* {@link #addJavascriptInterface(Object, String)} can be called, which
* automatically uses the {@link JavascriptInterface} annotation.
*
- JavaScript interacts with Java objects on a private, background
* thread of the ContentViewCore. Care is therefore required to maintain
* thread safety.
*
There is a dilemma. You can use JS by getting an url from an webview created onCreateWindow and creating new webview with the url. I tried and it worked when link is simple Hyperlink. But with that way some pages, especially opened by javascript, won't work rightly.
So far I got this and I'm short of time. Please someone shares more. Thanks.