[Android] Set filterTouchesWhenObscured on view to mitigate tapjacking

Not sure if this is within the scope of this plugin but another security concern in Android is 'Tapjacking'. An easy fix for this is to set the filterTouchesWhenObscured property on the view object. This could be done in the plugins initialise method, like so:

  @Override
  public void initialize(CordovaInterface cordova, CordovaWebView webView) {
    webView.getView().setFilterTouchesWhenObscured(true);
    super.initialize(cordova, webView);
    Activity activity = this.cordova.getActivity();
    activity.getWindow().addFlags(WindowManager.LayoutParams.FLAG_SECURE);
  }

I could create a separate plugin for this, but I think it fits pretty well in here and adding it to this plugin would be slightly more convenient. Happy to create a pull request if you think this make sense.

Let me know what you think!

Certainly looks on the surface like it's in the scope.

Send me a PR and I'll look into it some more. That'd be fantastic!

Set filterTouchesWhenObscured on view object to mitigate 'Tapjacking'. …

Hrm, is this only on GingerBread and below though?

What, the vulnerability? Nope. Had a pentester verify it on Android 6.0.1 recently.

Ah, the linked article said something about <= 2.3, must have just been an old article.

I'll take a look at the PR, thanks a lot.

No worries. Thanks for the prompt response!

Sorry I have taken so long to look at this, hoping to look at it asap and get it merged in.

Just some clarification, this used to only affect <=2.3 until Google made changes in Android. 2.4 - 6.0 was secure from this due to backend changes to the system. Until of course Google being Google reversed these changes on 6.0.1, hence the comment above that a pentester verified it.

<= 2.3 - Vulnerable
2.4 - 6.0 - Secure

= 6.0.1 - Vulnerable

Hi All, do we have a plan to fix this issue as part of this plugin?

Navigation Menu

[Android] Set filterTouchesWhenObscured on view to mitigate tapjacking #22

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

[Android] Set filterTouchesWhenObscured on view to mitigate tapjacking #22

Description

Activity

devgeeks commented on May 15, 2016

devgeeks commented on May 15, 2016

MaKleSoft commented on May 15, 2016

devgeeks commented on May 15, 2016

MaKleSoft commented on May 15, 2016

devgeeks commented on Jul 26, 2016

bensh commented on May 10, 2018

mr-rajeshrathod commented on Nov 10, 2020

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions