Question

is interface passed to javascript via

WebView.addJavascriptInterface()

restricted in some way?

I mean, what if i do

SmsManager sms = SmsManager.getDefault();
myWebView.addJavascriptInterface(sms,"SMSManager");

then in javascript

<input type="button" value="Send SMS" onClick="sendSMS()" />

<script type="text/javascript">
    function sendSMS() {
        sms.sendTextMessage(phoneNumber, null, message, sentPI, deliveredPI);
    }
</script>

will javascript trigger sending SMS?
Would that mean that javascript can use any application privileges, specified in application manifest, as long as passed object allows it?

Any help appreciated,

thanx Matej S.

Answer 1

That should work ok. Usually it’s better to create a custom object that exposes exactly what operations that you want the WebView to have access to. I have built one that exposed the phone’s vibration feature (which requires a permission) for example. Also be careful about what kind of objects are in the signature to the methods that you want to be able to invoke from JavaScript. You probably want to stick to primitives and arrays, and be careful with Booleans.