WebView requests "Use camera"

[ltguillaume]

For example:

1. Open Race Hub
2. Click the race, which opens planetf1.com's On-Track Race Watchalong in a WebView

This requests "Use Camera" (as XPrivacyLUA shows me).

I believe WebViews can be further restricted from behavior like this.

[BrightDV]

Thanks for the report! I will have to investigate a bit.
However, the app itself can't have the permission to the Camera, as you can see in the AndroidManifest.xml file (internet access is the only permission of the app).
So, is it really a concern?

[ltguillaume]

Yeah, I'm not sure how this works. In theory, shouldn't be able to, but I was surprised it could still cause this warning, which is triggered if any of the methods getCameraInfo, getNumberOfCameras, open, openLegacy from the class android.hardware.Camera are called, or openCamera from android.hardware.camera2.CameraManager (source: https://github.com/M66B/XPrivacyLua/blob/master/app/src/main/assets/hooks.json)

[BrightDV]

Sorry for the late reply, I was really busy...
I refactored a bit the webview, so now it blocks all script/content requests that go not to the same domain, and blocks all the permission requests.

Can you try to see it happens again? You can download the .apk from the latest Github action: https://github.com/BrightDV/BoxBox/actions/runs/7150510342.

(Enable experimental features in the settings and then open the article test screen from the drawer in order to open the webview).

Thanks!

[ltguillaume]

Thanks for looking into this! I think I only found this out during a race weekend with the On-Track Race Watchalong, so is there another way to open a similar site right now?

Either way, I think that if b618617 doesn't interfere with any sources from CDNs, it would surely be a nicer way to restrict the website.

[BrightDV]

You can open the webview by enabling the Experimental Features from the settings, and then tap on Article Test Screen in the left drawer.

[ltguillaume]

I went to planetf1.com via the Article Test Screen and cannot reproduce the issue with this new version, so I think this can be closed 🙂 As soon as the new season starts, I'll do some additional tests during sessions.

Thanks again!