From abe4085d34b9d736be9757bd335f04cc17ea7ac4 Mon Sep 17 00:00:00 2001
From: Lorenzo Sciandra <notkelset@kelset.dev>
Date: Tue, 17 Nov 2020 16:20:15 +0000
Subject: [PATCH 1/6] adding a basic test with the webpage to ensure everything
 will still work

---
 example/App.tsx                    | 14 ++++++++++++++
 example/examples/NativeWebpage.tsx | 22 ++++++++++++++++++++++
 2 files changed, 36 insertions(+)
 create mode 100644 example/examples/NativeWebpage.tsx

diff --git a/example/App.tsx b/example/App.tsx
index d269439d6..b2d563465 100644
--- a/example/App.tsx
+++ b/example/App.tsx
@@ -18,6 +18,7 @@ import Uploads from './examples/Uploads';
 import Injection from './examples/Injection';
 import LocalPageLoad from './examples/LocalPageLoad';
 import Messaging from './examples/Messaging';
+import NativeWebpage from './examples/NativeWebpage';
 
 const TESTS = {
   Messaging: {
@@ -84,6 +85,14 @@ const TESTS = {
       return <LocalPageLoad />;
     },
   },
+  NativeWebpage: {
+    title: 'NativeWebpage',
+    testId: 'NativeWebpage',
+    description: 'Test to open a new webview with a link',
+    render() {
+      return <NativeWebpage />;
+    },
+  },
 };
 
 type Props = {};
@@ -166,6 +175,11 @@ export default class App extends Component<Props, State> {
             title="Messaging"
             onPress={() => this._changeTest('Messaging')}
           />
+          <Button
+            testID="testType_nativeWebpage"
+            title="NativeWebpage"
+            onPress={() => this._changeTest('NativeWebpage')}
+          />
         </View>
 
         {restarting ? null : (
diff --git a/example/examples/NativeWebpage.tsx b/example/examples/NativeWebpage.tsx
new file mode 100644
index 000000000..bb3437b6c
--- /dev/null
+++ b/example/examples/NativeWebpage.tsx
@@ -0,0 +1,22 @@
+import React, {Component} from 'react';
+import {View} from 'react-native';
+
+import WebView from 'react-native-webview';
+
+type Props = {};
+type State = {};
+
+export default class NativeWebpage extends Component<Props, State> {
+  state = {};
+
+  render() {
+    return (
+      <View style={{height: 400}}>
+        <WebView
+          source={{uri: 'https://infinite.red'}}
+          style={{width: '100%', height: '100%'}}
+        />
+      </View>
+    );
+  }
+}

From f308ae128331500f87c8518ed61972edbf1946e3 Mon Sep 17 00:00:00 2001
From: Lorenzo Sciandra <notkelset@kelset.dev>
Date: Tue, 17 Nov 2020 16:33:05 +0000
Subject: [PATCH 2/6] add basic multiple windows support

---
 .../reactnativecommunity/webview/RNCWebViewManager.java   | 5 +++++
 src/WebView.android.tsx                                   | 1 +
 src/WebViewTypes.ts                                       | 8 ++++++++
 3 files changed, 14 insertions(+)

diff --git a/android/src/main/java/com/reactnativecommunity/webview/RNCWebViewManager.java b/android/src/main/java/com/reactnativecommunity/webview/RNCWebViewManager.java
index 1ad2a567e..f61ca3163 100644
--- a/android/src/main/java/com/reactnativecommunity/webview/RNCWebViewManager.java
+++ b/android/src/main/java/com/reactnativecommunity/webview/RNCWebViewManager.java
@@ -252,6 +252,11 @@ public void setJavaScriptEnabled(WebView view, boolean enabled) {
     view.getSettings().setJavaScriptEnabled(enabled);
   }
 
+  @ReactProp(name = "setSupportMultipleWindows")
+  public void setSupportMultipleWindows(WebView view, boolean enabled){
+    view.getSettings().setSupportMultipleWindows(enabled);
+  }
+
   @ReactProp(name = "showsHorizontalScrollIndicator")
   public void setShowsHorizontalScrollIndicator(WebView view, boolean enabled) {
     view.setHorizontalScrollBarEnabled(enabled);
diff --git a/src/WebView.android.tsx b/src/WebView.android.tsx
index bdc802769..6e25b4498 100644
--- a/src/WebView.android.tsx
+++ b/src/WebView.android.tsx
@@ -63,6 +63,7 @@ class WebView extends React.Component<AndroidWebViewProps, State> {
     androidHardwareAccelerationDisabled: false,
     androidLayerType: 'none',
     originWhitelist: defaultOriginWhitelist,
+    setSupportMultipleWindows: true,
   };
 
   static isFileUploadSupported = async () => {
diff --git a/src/WebViewTypes.ts b/src/WebViewTypes.ts
index 516cfd804..4ed6ac051 100644
--- a/src/WebViewTypes.ts
+++ b/src/WebViewTypes.ts
@@ -295,6 +295,7 @@ export interface AndroidNativeWebViewProps extends CommonNativeWebViewProps {
   onRenderProcessGone?: (event: WebViewRenderProcessGoneEvent) => void;
   overScrollMode?: OverScrollModeType;
   saveFormDataDisabled?: boolean;
+  setSupportMultipleWindows?: boolean;
   textZoom?: number;
   thirdPartyCookiesEnabled?: boolean;
   messagingModuleName?: string;
@@ -799,6 +800,13 @@ export interface AndroidWebViewProps extends WebViewSharedProps {
    */
   saveFormDataDisabled?: boolean;
 
+  /**
+   * Boolean value to set whether the WebView supports multiple windows. Used on Android only
+   * The default value is `true`.
+   * @platform android
+   */
+  setSupportMultipleWindows?: boolean;
+
   /**
    * Used on Android only, controls whether the given list of URL prefixes should
    * make {@link com.facebook.react.views.webview.ReactWebViewClient} to launch a

From 2b13dce28bf25e6dfa95a064ebd059091935d2c0 Mon Sep 17 00:00:00 2001
From: Lorenzo Sciandra <notkelset@kelset.dev>
Date: Tue, 17 Nov 2020 17:51:59 +0000
Subject: [PATCH 3/6] add onCreateWindow override

---
 .../webview/RNCWebViewManager.java                   | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/android/src/main/java/com/reactnativecommunity/webview/RNCWebViewManager.java b/android/src/main/java/com/reactnativecommunity/webview/RNCWebViewManager.java
index f61ca3163..082cb472f 100644
--- a/android/src/main/java/com/reactnativecommunity/webview/RNCWebViewManager.java
+++ b/android/src/main/java/com/reactnativecommunity/webview/RNCWebViewManager.java
@@ -13,6 +13,7 @@
 import android.net.Uri;
 import android.os.Build;
 import android.os.Environment;
+import android.os.Message;
 import android.os.SystemClock;
 import android.text.TextUtils;
 import android.util.Log;
@@ -1078,6 +1079,17 @@ public RNCWebChromeClient(ReactContext reactContext, WebView webView) {
       this.mWebView = webView;
     }
 
+    @Override
+    public boolean onCreateWindow(WebView view, boolean isDialog, boolean isUserGesture, Message resultMsg) {
+
+      final WebView newWebView = new WebView(view.getContext());
+      final WebView.WebViewTransport transport = (WebView.WebViewTransport) resultMsg.obj;
+      transport.setWebView(newWebView);
+      resultMsg.sendToTarget();
+
+      return true;
+    }
+
     @Override
     public boolean onConsoleMessage(ConsoleMessage message) {
       if (ReactBuildConfig.DEBUG) {

From b0136d1f15dcc792638a286cff87cf1a6b3c77fe Mon Sep 17 00:00:00 2001
From: Lorenzo Sciandra <notkelset@kelset.dev>
Date: Tue, 17 Nov 2020 17:52:21 +0000
Subject: [PATCH 4/6] add the prop as commented so that it's easy to test

---
 example/examples/NativeWebpage.tsx | 1 +
 1 file changed, 1 insertion(+)

diff --git a/example/examples/NativeWebpage.tsx b/example/examples/NativeWebpage.tsx
index bb3437b6c..7ec9da0c5 100644
--- a/example/examples/NativeWebpage.tsx
+++ b/example/examples/NativeWebpage.tsx
@@ -15,6 +15,7 @@ export default class NativeWebpage extends Component<Props, State> {
         <WebView
           source={{uri: 'https://infinite.red'}}
           style={{width: '100%', height: '100%'}}
+          // setSupportMultipleWindows={false}
         />
       </View>
     );

From 15f37f87951ef743691410496398fb936c201637 Mon Sep 17 00:00:00 2001
From: Lorenzo Sciandra <notkelset@kelset.dev>
Date: Tue, 17 Nov 2020 17:58:09 +0000
Subject: [PATCH 5/6] adding documentation

---
 docs/Reference.md | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/docs/Reference.md b/docs/Reference.md
index f3ac6c5e3..bcd1dc3e3 100644
--- a/docs/Reference.md
+++ b/docs/Reference.md
@@ -72,6 +72,7 @@ This document lays out the current public properties and methods for the React N
 - [`ignoreSilentHardwareSwitch`](Reference.md#ignoreSilentHardwareSwitch)
 - [`onFileDownload`](Reference.md#onFileDownload)
 - [`autoManageStatusBarEnabled`](Reference.md#autoManageStatusBarEnabled)
+- [`setSupportMultipleWindows`](Reference.md#setSupportMultipleWindows)
 
 ## Methods Index
 
@@ -782,7 +783,7 @@ A Boolean value indicating whether JavaScript can open windows without user inte
 
 ### `androidHardwareAccelerationDisabled`[⬆](#props-index)<!-- Link generated with jump2header -->
 
-**Deprecated.** Use the `androidLayerType` prop instead. 
+**Deprecated.** Use the `androidLayerType` prop instead.
 
 | Type | Required | Platform |
 | ---- | -------- | -------- |
@@ -792,7 +793,7 @@ A Boolean value indicating whether JavaScript can open windows without user inte
 
 ### `androidLayerType`[⬆](#props-index)<!-- Link generated with jump2header -->
 
-Specifies the layer type. 
+Specifies the layer type.
 
 Possible values for `androidLayerType` are:
 
@@ -1282,6 +1283,21 @@ Example:
 <WebView autoManageStatusBarEnabled={false} />
 ```
 
+### `setSupportMultipleWindows`
+
+Sets whether the WebView supports multiple windows. See [Android documentation]('https://developer.android.com/reference/android/webkit/WebSettings#setSupportMultipleWindows(boolean)') for more information.
+Setting this to false can expose the application to this [vulnerability](https://alesandroortiz.com/articles/uxss-android-webview-cve-2020-6506/) allowing a malicious iframe to escape into the top layer DOM.
+
+| Type    | Required | Default | Platform |
+| ------- | -------- | ------- | -------- |
+| boolean | No       | true    | Android  |
+
+Example:
+
+```javascript
+<WebView setSupportMultipleWindows={false} />
+```
+
 ## Methods
 
 ### `extraNativeComponentConfig()`[⬆](#methods-index)<!-- Link generated with jump2header -->

From 75b521542a5f70cd5df349a01d01c053731c392b Mon Sep 17 00:00:00 2001
From: Lorenzo Sciandra <notkelset@kelset.dev>
Date: Wed, 18 Nov 2020 15:27:46 +0000
Subject: [PATCH 6/6] fix - I removed the setup line by mistake

---
 .../com/reactnativecommunity/webview/RNCWebViewManager.java    | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/android/src/main/java/com/reactnativecommunity/webview/RNCWebViewManager.java b/android/src/main/java/com/reactnativecommunity/webview/RNCWebViewManager.java
index 082cb472f..2190ae714 100644
--- a/android/src/main/java/com/reactnativecommunity/webview/RNCWebViewManager.java
+++ b/android/src/main/java/com/reactnativecommunity/webview/RNCWebViewManager.java
@@ -188,6 +188,7 @@ protected WebView createViewInstance(ThemedReactContext reactContext) {
     settings.setBuiltInZoomControls(true);
     settings.setDisplayZoomControls(false);
     settings.setDomStorageEnabled(true);
+    settings.setSupportMultipleWindows(true);
 
     settings.setAllowFileAccess(false);
     settings.setAllowContentAccess(false);
@@ -881,7 +882,7 @@ public void onReceivedSslError(final WebView webView, final SslErrorHandler hand
         // This is desired behavior. We later use these values to determine whether the request is a top-level navigation or a subresource request.
         String topWindowUrl = webView.getUrl();
         String failingUrl = error.getUrl();
-        
+
         // Cancel request after obtaining top-level URL.
         // If request is cancelled before obtaining top-level URL, undesired behavior may occur.
         // Undesired behavior: Return value of WebView.getUrl() may be the current URL instead of the failing URL.