ionic-team / cordova-plugin-ionic-webview

Web View plugin for Cordova, specialized for Ionic apps.
Apache License 2.0
486 stars 394 forks source link

Android - hostname converted to IP #625

Open leolio86400 opened 4 years ago

leolio86400 commented 4 years ago

Problem

On Android using a number in HostName makes a weird behaviour where the domain name is converted to an IP address and crash the application.

What is expected to happen?

It should keep using the domain name (It is part of the http standard to be able to use numbers)

What does actually happen?

The number is converted to an ip e.g. 90000 -> http://0.1.95.144/

Using https://www.browserling.com/tools/dec-to-ip you can see that 90000 converts to 0.1.95.144

Reproduce

Set the Hostname to a number in config.xml-> 90000

<preference name="HostName" value="90000" />

Add a breakpoint in src/main/java/com/ionicframework/cordova/webview/IonicWebViewEngine.java -> onPageStarted() Method.

First breakpoint hit will be ok, second will show an IP instead of the correct hostname.

First hit:

Screen Shot 2020-11-10 at 6 20 04 pm

Second hit:

Screen Shot 2020-11-10 at 6 20 17 pm

Help wanted

I do not expect to have the problem fix instantly but if someone has an idea where it could come from (even if it is vague), that would be great 👍

leolio86400 commented 4 years ago

Ok so after investigation this seems to be an Android Webview bug not related to this plugin @nfischer I guess this is for your team ;)

nfischer commented 4 years ago

Could you please file this in the chromium bug tracker? It sounds like the chromium networking team might be better suited to understand what's going on. If you paste the chromium bug number here, I can make sure this gets routed to the right folks.

leolio86400 commented 4 years ago

Thanks @nfischer, here is the ticket https://bugs.chromium.org/p/chromium/issues/detail?id=1147655 I'll try on more device and check if it is not working either, but my guess is that it has been here for a while and still is.

Could potentially be a security issue if someone is using a number string to hide an IP