From c79a17fb4491001527e1ab71908d760886b1820f Mon Sep 17 00:00:00 2001
From: Dimitris Dafnis <68849116+jim-daf@users.noreply.github.com>
Date: Sun, 19 Apr 2026 21:54:03 +0200
Subject: [PATCH 1/2] fix: Fixed insecure SSL error handler: replaced
 handler.proceed() with handler.cancel() to reject invalid certificates by
 default

Addresses #2286
---
 .../main/java/com/alphawallet/app/web3/Web3TokenView.java   | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/app/src/main/java/com/alphawallet/app/web3/Web3TokenView.java b/app/src/main/java/com/alphawallet/app/web3/Web3TokenView.java
index 5dc7fdc952..7f18ff5500 100644
--- a/app/src/main/java/com/alphawallet/app/web3/Web3TokenView.java
+++ b/app/src/main/java/com/alphawallet/app/web3/Web3TokenView.java
@@ -379,7 +379,11 @@ public boolean shouldOverrideUrlLoading(WebView view, WebResourceRequest request
         public void onReceivedSslError(WebView view, SslErrorHandler handler, SslError error)
         {
             System.out.println("YOLESS: " + error.toString());
-            handler.proceed(); // Ignore SSL certificate errors
+            // Security fix: reject invalid SSL certificates by default.
+            // handler.proceed() was removed to prevent accepting untrusted certificates.
+            // For development/testing with self-signed certs, consider using
+            // network_security_config.xml instead.
+            handler.cancel(); // Ignore SSL certificate errors
         }
     }
 

From 5238cf07111c491d9646cad9f41a09ff3f2e5716 Mon Sep 17 00:00:00 2001
From: Dimitris Dafnis <68849116+jim-daf@users.noreply.github.com>
Date: Mon, 20 Apr 2026 01:30:25 +0200
Subject: [PATCH 2/2] fix: inject Web3 provider at document start to fix CSP
 timing issue

Use WebViewCompat.addDocumentStartJavaScript() to inject the
ethereum provider before any page scripts run. This ensures
window.ethereum is available when sites try to detect it,
fixing the @metamask/detect-provider failure on sites with
strict CSP like exchange.idex.io.

Addresses #2286
---
 .../java/com/alphawallet/app/web3/Web3View.java    | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/app/src/main/java/com/alphawallet/app/web3/Web3View.java b/app/src/main/java/com/alphawallet/app/web3/Web3View.java
index f2f6383435..bb34816f6e 100644
--- a/app/src/main/java/com/alphawallet/app/web3/Web3View.java
+++ b/app/src/main/java/com/alphawallet/app/web3/Web3View.java
@@ -15,6 +15,7 @@
 import androidx.annotation.NonNull;
 import androidx.annotation.Nullable;
 import androidx.webkit.WebSettingsCompat;
+import androidx.webkit.WebViewCompat;
 import androidx.webkit.WebViewFeature;
 
 import com.alphawallet.app.BuildConfig;
@@ -31,8 +32,11 @@
 import org.jetbrains.annotations.Contract;
 import org.jetbrains.annotations.NotNull;
 
+import java.util.Collections;
 import java.util.HashMap;
+import java.util.HashSet;
 import java.util.Map;
+import java.util.Set;
 
 import timber.log.Timber;
 
@@ -206,6 +210,16 @@ public void init()
         {
             WebSettingsCompat.setAlgorithmicDarkeningAllowed(getSettings(), true);
         }
+
+        // Inject Web3 provider at document start so window.ethereum is available
+        // before any page scripts run. This fixes CSP timing issues where sites
+        // like exchange.idex.io fail to detect the provider.
+        if (WebViewFeature.isFeatureSupported(WebViewFeature.DOCUMENT_START_SCRIPT))
+        {
+            String providerJs = webViewClient.getJsInjectorClient().providerJs(getContext());
+            Set<String> origins = new HashSet<>(Collections.singletonList("*"));
+            WebViewCompat.addDocumentStartJavaScript(this, providerJs, origins);
+        }
     }
 
     @Nullable