WebView[Compat].startSafeBrowsing calls the callback with success=false

[PlasmaPower]

Despite Vanadium's WebView provider reporting WebViewFeature.isFeatureSupported(START_SAFE_BROWSING) = true, when WebView.startSafeBrowsing or WebViewCompat.startSafeBrowsing is called, the callback gives success=false as the actual safe browsing implementation is not present.

This issue breaks Schwab's Zelle support, and probably other Zelle implementations as well due to a shared SDK.

I believe Vanadium should add a patch so startSafeBrowsing runs the callback with success=true. I think a good central place to implement this patch would be AwContentsStatics.initSafeBrowsing, replacing the code after declaring wrapperCallback with simply wrapperCallback.onResult(true); to immediately return success without affecting the rest of the flow (e.g. keep the callback bound to the ui thread).

[quh4gko8]

Why does the said SDK rely on having safe browing enabled in the first place? Any reasons it cannot support having WebViewFeature.isFeatureSupported(START_SAFE_BROWSING) = false instead?

[quh4gko8]

The upstream code for Chromium always set the callback to return as false in any cases on the linked method on safe browsing.

[PlasmaPower]

I agree the app shouldn't require this, but banking apps are paranoid and often do require stuff like this. My guess is someone saw "safe browsing" and thought it would somehow improve the security of the app to require it.

In this case, the Fiserv (basically first party) Zelle SDK does indeed require it, and won't load anything if the feature isn't marked as supported or the callback returns success=false.

I don't think it hurts anything to return success=true here, and it would fix Zelle support on GrapheneOS for Schwab and any other banks without their own custom Zelle implementation.

[inthewaves]

Fixed in #1243

[PlasmaPower]

Thank you very much for making the improved patch! However, I've updated to Vanadium alpha 152.0.7977.54.1 (same version for the trichrome library) and Vanadium config 203, and I'm seeing the same behavior of the startSafeBrowsing callback returning false. I don't see an issue with the patch itself, but perhaps the build was made from an earlier commit? I can look into this myself further later tonight, but I suspect it's just the build.

[thestinger]

It wasn't built with an older revision.

[inthewaves]

Did you make sure to update WebView (GrapheneOS App Store > Top right > All packages > Vanadium System WebView)?

[PlasmaPower]

Oh that was it, sorry. It wasn't showing the update button for the trichrome library and I misread "available version" as "installed version". It's working now!

[thestinger]

The library just gets installed as a dependency for the browser and WebView. The browser and WebView get updated separately and multiple versions of the library can be installed at the same time if they're on different versions.