Repository navigation
fix(webview): resolve relative urls against the article link - #1350
Open
TommyBacco wants to merge 2 commits into
Open
TommyBacco wants to merge 2 commits into
TommyBacco wants to merge 2 commits into
Conversation
Feed-controlled article links must not set a file: base, since allowFileAccess is enabled for external reading fonts and a file base would let article content resolve relative references to local files.
TommyBacco
marked this pull request as ready for review
November 2, 2026 08:24
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The WebView renderer composes the article HTML with a
<base href="%s">slot, but fills it withWebView.getUrl()— which isnullbefore the first load andabout:blankafterwards. Consequently every relative or protocol-relative URL in the article content resolves against an invalid base, producing broken images and dead links (and, for embeds,null/...style URLs that the WebView cannot load).Changes
RYWebViewgains abaseUrlparameter.Contentpasses the article link.WebViewHtml.resolveBaseUrl()normalizes the link (protocol-relative//host/...and scheme-less inputs gethttps://, reusing the existingformatUrl()), validates it throughjava.net.URIand only acceptshttp(s)/fileorigins, otherwise returning an empty base.WebViewHtml.escapeAttribute()) before being injected into<base href="...">, so links containing quotes or&cannot break out of the attribute.Notes
loadDataWithBaseURL(null, …)), so no regression for feeds without usable article links.Tests
WebViewHtmlTest.testResolveBaseUrl— null/blank, absolute, protocol-relative, scheme-less, invalid-URI (spacein path) and hostile-scheme (javascript:) inputs.WebViewHtmlTest.testEscapeAttribute—&,",<,>escaping../gradlew testGithubReleaseUnitTestStack
This is the first PR of a stack; the follow-ups are opened as drafts against the fork branches and will be retargeted here as this merges: