From 607c17f99cb7f8e214a2faaf18c9913c827aa0a4 Mon Sep 17 00:00:00 2001
From: Scott Rowe <scottrowe@google.com>
Date: Thu, 7 Aug 2014 11:42:09 -0700
Subject: cherrypick from klp-docs docs: security consideration for Android
 <4.2 Change-Id: I5fe51641539f7ffe7abcdb0618371dd3f4b62ab5

Change-Id: I9838519ad3e0c2fb3957829fc448b1ae6bd1d62b
---
 core/java/android/webkit/WebView.java | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/core/java/android/webkit/WebView.java b/core/java/android/webkit/WebView.java
index 93bf051967e7..d307256fe256 100644
--- a/core/java/android/webkit/WebView.java
+++ b/core/java/android/webkit/WebView.java
@@ -1637,9 +1637,12 @@ public class WebView extends AbsoluteLayout
      * <ul>
      * <li> This method can be used to allow JavaScript to control the host
      * application. This is a powerful feature, but also presents a security
-     * risk for applications targeted to API level
-     * {@link android.os.Build.VERSION_CODES#JELLY_BEAN} or below, because
-     * JavaScript could use reflection to access an
+     * risk for apps targeting {@link android.os.Build.VERSION_CODES#JELLY_BEAN} or earlier.
+     * Apps that target a version later than {@link android.os.Build.VERSION_CODES#JELLY_BEAN}
+     * are still vulnerable if the app runs on a device running Android earlier than 4.2.
+     * The most secure way to use this method is to target {@link android.os.Build.VERSION_CODES#JELLY_BEAN_MR1}
+     * and to ensure the method is called only when running on Android 4.2 or later.
+     * With these older versions, JavaScript could use reflection to access an
      * injected object's public fields. Use of this method in a WebView
      * containing untrusted content could allow an attacker to manipulate the
      * host application in unintended ways, executing Java code with the
@@ -1647,7 +1650,8 @@ public class WebView extends AbsoluteLayout
      * method in a WebView which could contain untrusted content.</li>
      * <li> JavaScript interacts with Java object on a private, background
      * thread of this WebView. Care is therefore required to maintain thread
-     * safety.</li>
+     * safety.
+     * </li>
      * <li> The Java object's fields are not accessible.</li>
      * </ul>
      *
-- 
cgit v1.2.3-59-g8ed1b