Skip to content

fix: secure SSL handling and Web3 provider injection timing #3438

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jim-daf wants to merge 2 commits into
base: master
Choose a base branch
from
+19 −1
Open

fix: secure SSL handling and Web3 provider injection timing #3438

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c79a17f
fix: Fixed insecure SSL error handler: replaced handler.proceed() wit…
jim-daf Apr 19, 2026
5238cf0
fix: inject Web3 provider at document start to fix CSP timing issue
jim-daf Apr 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion app/src/main/java/com/alphawallet/app/web3/Web3TokenView.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -379,7 +379,11 @@ public boolean shouldOverrideUrlLoading(WebView view, WebResourceRequest request
public void onReceivedSslError(WebView view, SslErrorHandler handler, SslError error)
{
System.out.println("YOLESS: " + error.toString());
handler.proceed(); // Ignore SSL certificate errors
// Security fix: reject invalid SSL certificates by default.
// handler.proceed() was removed to prevent accepting untrusted certificates.
// For development/testing with self-signed certs, consider using
// network_security_config.xml instead.
handler.cancel(); // Ignore SSL certificate errors

Copilot AI Apr 19, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The inline comment is now inaccurate: handler.cancel() rejects the SSL certificate error rather than ignoring it. Update the comment to reflect the actual behavior (e.g., 'Reject SSL certificate errors').

Suggested change
handler.cancel(); // Ignore SSL certificate errors
handler.cancel(); // Reject SSL certificate errors

Copilot uses AI. Check for mistakes.
}
}

Expand Down
14 changes: 14 additions & 0 deletions app/src/main/java/com/alphawallet/app/web3/Web3View.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@
import androidx.annotation.NonNull;
import androidx.annotation.Nullable;
import androidx.webkit.WebSettingsCompat;
import androidx.webkit.WebViewCompat;
import androidx.webkit.WebViewFeature;

import com.alphawallet.app.BuildConfig;
Expand All @@ -31,8 +32,11 @@
import org.jetbrains.annotations.Contract;
import org.jetbrains.annotations.NotNull;

import java.util.Collections;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;

import timber.log.Timber;

Expand Down Expand Up @@ -206,6 +210,16 @@ public void init()
{
WebSettingsCompat.setAlgorithmicDarkeningAllowed(getSettings(), true);
}

// Inject Web3 provider at document start so window.ethereum is available
// before any page scripts run. This fixes CSP timing issues where sites
// like exchange.idex.io fail to detect the provider.
if (WebViewFeature.isFeatureSupported(WebViewFeature.DOCUMENT_START_SCRIPT))
{
String providerJs = webViewClient.getJsInjectorClient().providerJs(getContext());
Set<String> origins = new HashSet<>(Collections.singletonList("*"));

Copilot AI Apr 19, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This can be simplified to avoid the extra allocation and verbosity (e.g., use an immutable singleton set directly). That keeps the intent clearer and reduces unnecessary object creation.

Copilot uses AI. Check for mistakes.
WebViewCompat.addDocumentStartJavaScript(this, providerJs, origins);

Copilot AI Apr 19, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The origin rule set is currently wildcarded (*), which injects the provider into every loaded origin. If the intended security model is to expose wallet APIs only to specific dApp origins (or only when a user explicitly connects), consider restricting origins to an allowlist (or otherwise gating injection) to reduce the attack surface from arbitrary web content.

Copilot uses AI. Check for mistakes.
}
}

@Nullable
Expand Down
Loading