brenno/Hiero
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Tighten WebView JS policy and normalize HTTP airport websites #25

Merged
brenno merged 1 commit from security/s4-webview-and-https-links into main 2026-07-01 00:17:15 +00:00
Conversation 0 Commits 1 Files changed 9 +131 -16
brenno commented 2026-07-01 00:09:00 +00:00
Owner
Copy link

Summary

  • Document the AIP chart WebView JavaScript allowlist (DFS, NATS eAIP, FAA, SIA) and match hosts by suffix instead of loose substring checks.
  • Add preferHttpsUri / normalizeExternalUri so OurAirports home_link values and curated airport websites open under the HTTPS-only external-link policy.
  • Show the existing localized “could not open link” snackbar when a contact website launch fails.

Test plan

  • flutter test (422 tests)
  • Open an aerodrome with an old http:// OurAirports website (e.g. ENBR) and confirm the link opens in the browser
  • Spot-check a DE DFS chart still renders in the embedded WebView

Part of the security hardening track (S4).

## Summary - Document the AIP chart WebView JavaScript allowlist (DFS, NATS eAIP, FAA, SIA) and match hosts by suffix instead of loose substring checks. - Add `preferHttpsUri` / `normalizeExternalUri` so OurAirports `home_link` values and curated airport websites open under the HTTPS-only external-link policy. - Show the existing localized “could not open link” snackbar when a contact website launch fails. ## Test plan - [x] `flutter test` (422 tests) - [ ] Open an aerodrome with an old `http://` OurAirports website (e.g. ENBR) and confirm the link opens in the browser - [ ] Spot-check a DE DFS chart still renders in the embedded WebView Part of the security hardening track (S4).
Tighten WebView JS policy and normalize HTTP airport websites to HTTPS.
Some checks failed
Flutter CI / analyze-and-test (pull_request) Has been cancelled
Details
679c1f562e 
Document the AIP chart host allowlist with suffix matching instead of loose
substring checks, upgrade OurAirports home links at parse time, and surface a
localized snackbar when a contact website cannot be opened.

Co-authored-by: Cursor <cursoragent@cursor.com>
brenno merged commit 72d400c483 into main 2026-07-01 00:17:15 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
brenno/Hiero!25
No description provided.