10

Most of the places I see, file upload feature in WebView is implemented using openFileChooser() method. Is it legal/safe to use this method? If I use this in code, will my code break anywhere? Any security issues if I use this method?

Why android hides this API in older versions? Only on/above 5.0 they have introduced onShowFileChooser() method, that means officially they don't support file upload in webviews below 5.0?

2 Answers 2

16

Using the old openFileChooser(...) callbacks does not have any security implications. It's just fine. The only downside is that it will not be called on some platform levels and therefore not work.

  • void openFileChooser(ValueCallback<Uri> uploadMsg) works on Android 2.2 (API level 8) up to Android 2.3 (API level 10)
  • openFileChooser(ValueCallback<Uri> uploadMsg, String acceptType) works on Android 3.0 (API level 11) up to Android 4.0 (API level 15)
  • openFileChooser(ValueCallback<Uri> uploadMsg, String acceptType, String capture) works on Android 4.1 (API level 16) up to Android 4.3 (API level 18)
  • onShowFileChooser(WebView webView, ValueCallback<Uri[]> filePathCallback, WebChromeClient.FileChooserParams fileChooserParams) works on Android 5.0 (API level 21) and above

You can use a library that abstracts this away and takes care of all these callbacks on different platform levels so that it just works. Example:

https://github.com/delight-im/Android-AdvancedWebView

You can also check out how it's done in the source:

https://github.com/delight-im/Android-AdvancedWebView/blob/0f06e73ecee13ebc4552ac00bc0848e18662a25d/Source/src/im/delight/android/webview/AdvancedWebView.java#L597

https://github.com/delight-im/Android-AdvancedWebView/blob/0f06e73ecee13ebc4552ac00bc0848e18662a25d/Source/src/im/delight/android/webview/AdvancedWebView.java#L1044

The fact that it's undocumented just means that you can't rely on it. When it was introduced in Android 2.2, nobody could know that it would stop working in Android 4.4, but you had to accept it.

2
  • 1
    What about 4.4? Mar 1, 2017 at 17:19
  • @AntonDuzenko No chance to get anything working there, unfortunately.
    – caw
    Mar 1, 2017 at 17:30
0

Since this is not documented in WebChromeClient, no it is not a safe API, but yes it is legal.

But you can still use it. Make sure to catch any error. But the process cannot be guaranteed to work.

4
  • 1
    Do you have any idea why android hides this API in older versions? Only on 5.0 they have introduced onShowFileChooser() method. that means officially they don't support file upload in webviews below 5.0 ?. I updated the question too.
    – Ponsuyambu
    May 6, 2015 at 15:08
  • I don't know why. But yes, officially that upload feature is available since API-21 and more. Have you tried using onShowFileChooser() on lower APIs? May 6, 2015 at 15:10
  • I dont think onShowFileChooser() will be called on lower versions. However I tried and the result is same. Any security issues if I use openFileChooser() method?
    – Ponsuyambu
    May 6, 2015 at 15:14
  • That is mostly undocumented. Only available for API-21 and more. I can't tell you much more sorry. May 6, 2015 at 15:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.