package app;

import android.app.Activity;
import android.os.Bundle;
import android.webkit.WebSettings;
import android.webkit.WebView;
import android.webkit.WebViewClient;
import com.android.internal.R;

public class UnsafeAndroidAccess extends Activity {
	public void onCreate(Bundle savedInstanceState) {
		super.onCreate(savedInstanceState);
		setContentView(R.layout.webview);
		testJavaScriptEnabledWebView();
		testUniversalFileAccessEnabledWebView();
		testFileAccessEnabledWebView();
		testSafeWebView();
	}

	private void testJavaScriptEnabledWebView() {
		WebView wv = (WebView) findViewById(R.id.my_webview);
		WebSettings webSettings = wv.getSettings();
		webSettings.setJavaScriptEnabled(true);

		wv.setWebViewClient(new WebViewClient() {
			@Override
			public boolean shouldOverrideUrlLoading(WebView view, String url) {
				view.loadUrl(url);
				return true;
			}
		});

		String thisUrl = getIntent().getExtras().getString("url");
		wv.loadUrl(thisUrl); // $hasUnsafeAndroidAccess
		wv.loadUrl("https://www.mycorp.com/" + thisUrl); // Safe
		wv.loadUrl("https://www.mycorp.com"); // Safe
	}

	private void testUniversalFileAccessEnabledWebView() {
		WebView wv = (WebView) findViewById(R.id.my_webview);
		WebSettings webSettings = wv.getSettings();
		webSettings.setAllowUniversalAccessFromFileURLs(true);

		wv.setWebViewClient(new WebViewClient() {
			@Override
			public boolean shouldOverrideUrlLoading(WebView view, String url) {
				view.loadUrl(url);
				return true;
			}
		});

		String thisUrl = getIntent().getStringExtra("url");
		wv.loadUrl(thisUrl); // $hasUnsafeAndroidAccess
		wv.loadUrl("https://www.mycorp.com/" + thisUrl); // Safe
		wv.loadUrl("https://www.mycorp.com"); // Safe
	}

	private void testFileAccessEnabledWebView() {
		WebView wv = (WebView) findViewById(R.id.my_webview);
		WebSettings webSettings = wv.getSettings();
		webSettings.setAllowFileAccessFromFileURLs(true);

		wv.setWebViewClient(new WebViewClient() {
			@Override
			public boolean shouldOverrideUrlLoading(WebView view, String url) {
				view.loadUrl(url);
				return true;
			}
		});

		String thisUrl = getIntent().getStringExtra("url");
		wv.loadUrl(thisUrl); // $hasUnsafeAndroidAccess
		wv.loadUrl("https://www.mycorp.com/" + thisUrl); // Safe
		wv.loadUrl("https://www.mycorp.com"); // Safe
	}

	private void testSafeWebView() {
		WebView wv = (WebView) findViewById(-1);

		wv.setWebViewClient(new WebViewClient() {
			@Override
			public boolean shouldOverrideUrlLoading(WebView view, String url) {
				view.loadUrl(url);
				return true;
			}
		});

		String thisUrl = getIntent().getExtras().getString("url");
		wv.loadUrl(thisUrl); // Safe
		wv.loadUrl("https://www.mycorp.com/" + thisUrl); // Safe
		wv.loadUrl("https://www.mycorp.com"); // Safe
	}
}
@@ -1039,36 +1039,91 @@
  + thisUrl); // 
-Safe
+$ SPURIOUS: hasUnsafeAndroidAccess // Safe, needs sanitizer
 %0A%09%09wv.loadUrl(%22h
@@ -1705,36 +1705,91 @@
  + thisUrl); // 
-Safe
+$ SPURIOUS: hasUnsafeAndroidAccess // Safe, needs sanitizer
 %0A%09%09wv.loadUrl(%22h
@@ -2357,36 +2357,91 @@
  + thisUrl); // 
-Safe
+$ SPURIOUS: hasUnsafeAndroidAccess // Safe, needs sanitizer
 %0A%09%09wv.loadUrl(%22h

Mark spurious test results