Obsolete
Status Update
No update yet.
Comments
tr...@gmail.com
[Comment deleted]
tr...@gmail.com
I met the same bug.
Use webview to load a webpage which includes a JS function urlAdded(url);
Call webview.loadUrl(
"javascript:urlAdded(\"http://redir.xxxxx.com/click.php?id=12345&originalUrlhttp%3A%2F%2Fm.ctrip.com%2Fhtml5%2F%3Fallianceid%3D1000%26sid%3D454555%26sourceid%3D1111\ "");
On android 4.4 device:
urlAdded(url) got a parameter
http://redir.xxxxx.com/click.php?id=12345&originalUrl=http://m.ctrip.com/html5/?allianceid=1000&sid=454555&sourceid=1111
originalUrl is miss unescaped.
pre-4.4 device: expected
urlAdded(url) got a parameter
http://redir.xxxxx.com/click.php?id=12345&originalUrlhttp%3A%2F%2Fm.ctrip.com%2Fhtml5%2F%3Fallianceid%3D1000%26sid%3D454555%26sourceid%3D1111
Use webview to load a webpage which includes a JS function urlAdded(url);
Call webview.loadUrl(
"javascript:urlAdded(\"
On android 4.4 device:
urlAdded(url) got a parameter
originalUrl is miss unescaped.
pre-4.4 device: expected
urlAdded(url) got a parameter
tf...@gmail.com
The same
Description
In Android 4.4 with the new WebView, loadUrl with "javascript:" URLs will URL-decode the string before execution. Where previously %-escapes where sent unchanged to the JavaScript, they will now be decoded first, which can result in an accidental re-encoding of e.g. ISO-8859-1-based %-escapes into Unicode characters. That means, if e.g. a pre-encoded URL containg encoded binary data or ISO-8859-1 is sent as argument to a JavaScript, this might then be sent re-encoded as UTF-8 to the server, breaking things.
The work-around is to use the new evaluateJavascript method of Android 4.4
Nevertheless, this is an incompatible, and so it seems, undocumented change of a public API which can introduce subtle bugs into existing applications. The change should be properly documented in the JavaDoc of the method.