package org.ccci.gto.android.thekey;

import android.annotation.SuppressLint;
import android.content.Context;
import android.view.View;
import android.view.ViewGroup;
import android.view.ViewGroup.LayoutParams;
import android.webkit.WebView;

public final class DisplayUtil {
    @SuppressLint("SetJavaScriptEnabled")
    public final static WebView createLoginWebView(final Context context, final TheKey thekey,
            final LoginWebViewClient webViewClient) {
        final WebView webView = new WebView(context);
        webView.setVisibility(View.GONE);
        webView.setLayoutParams(new ViewGroup.LayoutParams(LayoutParams.MATCH_PARENT, LayoutParams.MATCH_PARENT));
        webView.setScrollBarStyle(WebView.SCROLLBARS_OUTSIDE_OVERLAY);
        webView.setScrollbarFadingEnabled(true);
        webView.getSettings().setJavaScriptEnabled(true);
        webView.getSettings().setLoadsImagesAutomatically(true);
        webView.setWebViewClient(webViewClient);
        webView.loadUrl(thekey.getAuthorizeUri().toString());
        return webView;
    }
}

@@ -90,23 +90,85 @@
 oid.
-content.Context
+annotation.TargetApi;%0Aimport android.content.Context;%0Aimport android.os.Build
 ;%0Aim
@@ -266,16 +266,51 @@
 Params;%0A
+import android.webkit.WebSettings;%0A
 import a
@@ -408,16 +408,63 @@
 abled%22)%0A
+    @TargetApi(Build.VERSION_CODES.JELLY_BEAN)%0A
     publ
@@ -931,32 +931,33 @@
 bled(true);%0A
+%0A
         
 webView.getS
@@ -944,37 +944,125 @@
         
-webView.getSettings()
+final WebSettings settings = webView.getSettings();%0A        settings.setSavePassword(false);%0A        settings
 .setJava
@@ -1090,37 +1090,24 @@
         
-webView.getS
+s
 ettings
-()
 .setLoad
@@ -1126,32 +1126,430 @@
 atically(true);%0A
+        settings.setAllowFileAccess(false);%0A        if (Build.VERSION.SDK_INT %3E= Build.VERSION_CODES.HONEYCOMB) %7B%0A            settings.setAllowContentAccess(false);%0A            if (Build.VERSION.SDK_INT %3E= Build.VERSION_CODES.JELLY_BEAN) %7B%0A                settings.setAllowFileAccessFromFileURLs(false);%0A                settings.setAllowUniversalAccessFromFileURLs(false);%0A            %7D%0A        %7D%0A%0A
         webView.

add some more restrictions to the generated WebView to prevent some potential attack vectors