GitToTheHub commented on code in PR #1698:
URL: https://github.com/apache/cordova-ios/pull/1698#discussion_r4083532143
##########
CordovaLib/Classes/Private/Plugins/CDVWebViewEngine/CDVWebViewUIDelegate.m:
##########
@@ -31,6 +35,42 @@ @implementation CDVWebViewUIDelegate
NSMutableArray<UIViewController *> *windows;
}
+#if __IPHONE_OS_VERSION_MIN_REQUIRED < 270000
++ (void)load {
+ // iOS 27 makes public a delegate method for determining whether
+ // geolocation should be allowed for a given origin:
+ //
+ // -
webView:requestGeolocationPermissionForOrigin:initiatedByFrame:decisionHandler:
+ //
+ // This removes one of the main reasons for apps to need the geolocation
+ // plugin.
+ //
+ // The same API exists as private API (prefixed with an underscore) as far
+ // back as iOS 15, but we're not allowed to implement it directly. Since
+ // it's solifidied now into public API, we can be assured that the private
+ // API signature won't change in future iOS versions, so we can grab the
+ // implementation of the public API and dynamically inject it with the
+ // private API method signature.
+ //
+ // Is this best practice? No.
+ // Is this safe? Probably.
+ // Is this useful for apps that use geolocation? Definitely.
+ if (@available(iOS 27.0, *)) {
+ /* Do nothing - iOS 27 supports the public API delegate method */
+ } else if (@available(iOS 15.0, *)) {
+ /* Alias the public API delegate method to the private API */
+ Class class = [self class];
+
+ SEL publicSelector =
@selector(webView:requestGeolocationPermissionForOrigin:initiatedByFrame:decisionHandler:);
+ SEL privateSelector = NSSelectorFromString([NSString
stringWithFormat:@"_%@", NSStringFromSelector(publicSelector)]);
+
+ Method publicMethod = class_getInstanceMethod(class, publicSelector);
+
+ class_addMethod(class, privateSelector,
method_getImplementation(publicMethod), method_getTypeEncoding(publicMethod));
Review Comment:
AI noted here:
> High priority: remove the private API fallback. [CDVWebViewUIDelegate.m,
lines
60–69](https://github.com/apache/cordova-ios/blob/2fcedd29798d3fae11e326d22eb69c849c4a6363/CordovaLib/Classes/Private/Plugins/CDVWebViewEngine/CDVWebViewUIDelegate.m#L60)
dynamically registers the private selector on iOS 15–26. Constructing its name
at runtime does not make it public API, and publishing an equivalent in iOS 27
does not retroactively authorize the older API. This exposes consuming apps to
rejection under [Apple’s guideline
2.5.1](https://developer.apple.com/app-store/review/guidelines/#software-requirements).
Passing an automated scan would not resolve that concern. Keep the public iOS
27 implementation and retain the plugin approach for older versions.
##########
CordovaLib/Classes/Private/Plugins/CDVWebViewEngine/CDVWebViewEngine.m:
##########
@@ -278,6 +278,7 @@ - (void)pluginInitialize
uiDelegate.title = [[NSBundle mainBundle]
objectForInfoDictionaryKey:@"CFBundleDisplayName"];
uiDelegate.mediaPermissionGrantType = [self
parsePermissionGrantType:[settings
cordovaSettingForKey:@"MediaPermissionGrantType"]];
+ uiDelegate.geolocationPermissionGrantType = [self
parsePermissionGrantType:[settings
cordovaSettingForKey:@"GeolocationPermissionGrantType"]];
Review Comment:
AI noted here:
> Medium priority: reconcile the default permission behavior with the stated
intent.
>
> The new preference assignment uses a parser that defaults to
`grantIfSameHostElsePrompt`. Consequently, other hosts can obtain permission
through a prompt, whereas the PR description says only the app scheme gets
access by default. The comparison also checks only the hostname, ignoring
scheme and port. Either implement the intended restriction or explicitly
document the broader policy.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
