解决Android11系统应用打开webView报错

由于webView存在安全漏洞,谷歌从5.1开始全面禁止系统应用使用webview,使用会导致应用崩溃错误提示:Caused by: java.lang.UnsupportedOperationException: For security reasons, WebView is not allowed in privileged processes 异常信息可以看出 是在 WebViewFactory.java 的getProvider 方法 抛出的。源码路径为 frameworks/base/core/java/android/webkit/WebViewFactory.java

  @UnsupportedAppUsage
    static WebViewFactoryProvider getProvider() {
        synchronized (sProviderLock) {
            // For now the main purpose of this function (and the factory abstraction) is to keep
            // us honest and minimize usage of WebView internals when binding the proxy.
            if (sProviderInstance != null) return sProviderInstance;

            final int uid = android.os.Process.myUid();
            if (uid == android.os.Process.ROOT_UID || uid == android.os.Process.SYSTEM_UID
                    || uid == android.os.Process.PHONE_UID || uid == android.os.Process.NFC_UID
                    || uid == android.os.Process.BLUETOOTH_UID) {
                throw new UnsupportedOperationException(
                        "For security reasons, WebView is not allowed in privileged processes");
            }

            if (!isWebViewSupported()) {
                // Device doesn't support WebView; don't try to load it, just throw.
                throw new UnsupportedOperationException();
            }

            if (sWebViewDisabled) {
                throw new IllegalStateException(
                        "WebView.disableWebView() was called: WebView is disabled");
            }

            Trace.traceBegin(Trace.TRACE_TAG_WEBVIEW, "WebViewFactory.getProvider()");
            try {
                Class<WebViewFactoryProvider> providerClass = getProviderClass();
                Method staticFactory = null;
                try {
                    staticFactory = providerClass.getMethod(
                        CHROMIUM_WEBVIEW_FACTORY_METHOD, WebViewDelegate.class);
                } catch (Exception e) {
                    if (DEBUG) {
                        Log.w(LOGTAG, "error instantiating provider with static factory method", e);
                    }
                }

                Trace.traceBegin(Trace.TRACE_TAG_WEBVIEW, "WebViewFactoryProvider invocation");
                try {
                    sProviderInstance = (WebViewFactoryProvider)
                            staticFactory.invoke(null, new WebViewDelegate());
                    if (DEBUG) Log.v(LOGTAG, "Loaded provider: " + sProviderInstance);
                    return sProviderInstance;
                } catch (Exception e) {
                    Log.e(LOGTAG, "error instantiating provider", e);
                    throw new AndroidRuntimeException(e);
                } finally {
                    Trace.traceEnd(Trace.TRACE_TAG_WEBVIEW);
                }
            } finally {
                Trace.traceEnd(Trace.TRACE_TAG_WEBVIEW);
            }
        }
    }

可以看出，首次使用时，系统会进行检查，如果 UID 是 root 进程或者系统进程，直接抛出异常。sProviderInstance 是 WebViewFactoryProvider 的对象，主要提供创建 WebView 内核的机制。WebView在 Android 4.4 之前使用的是 Webkit 内核，在 Android 4.4 以后切换到了 Chromium 内核。Google 使用了工厂方法模式，优雅地切换 WebView 内核的实现方式。我们注意到只有 sProviderInstance 为空的时候系统才去检查进程，然后创建 sProviderInstance对象。所以这给了我们一个启发 ---- 能不能一开始就主动创建 sProviderInstance 对象，把她塞到 WebViewFactory 类里面，从而欺骗 API 绕过系统检查呢？
下面就要用到 Hook 的思想了，首先要找到一个合适的点，静态变量、单例是最佳选择，刚刚好 sProviderInstance 是静态的。那就开始拿它开刀，看看系统是怎么创建 sProviderInstance 的，我们自己也模仿它这么做。其实系统也是通过反射来做的，

@SuppressLint("SoonBlockedPrivateApi")
    public  void hookWebView(){

        int sdkInt = Build.VERSION.SDK_INT;

        try {

            Class<?>  factoryClass = Class.forName("android.webkit.WebViewFactory");

            Field field = factoryClass.getDeclaredField("sProviderInstance");

            field.setAccessible(true);

            Object sProviderInstance = field.get(null);

            if (sProviderInstance != null) {

                Log.i(TAG,"sProviderInstance isn't null");

                return;

            }

            Method getProviderClassMethod;

            if (sdkInt > 22) {

                getProviderClassMethod = factoryClass.getDeclaredMethod("getProviderClass");

            } else if (sdkInt == 22) {

                getProviderClassMethod = factoryClass.getDeclaredMethod("getFactoryClass");

            } else {

                Log.i(TAG,"Don't need to Hook WebView");

                return;

            }

            getProviderClassMethod.setAccessible(true);

            Class<?>  factoryProviderClass = (Class<?> ) getProviderClassMethod.invoke(factoryClass);

            Class<?>  delegateClass = Class.forName("android.webkit.WebViewDelegate");

            Constructor delegateConstructor = delegateClass.getDeclaredConstructor();

            delegateConstructor.setAccessible(true);


                Field chromiumMethodName = factoryClass.getDeclaredField("CHROMIUM_WEBVIEW_FACTORY_METHOD");

                chromiumMethodName.setAccessible(true);

                String chromiumMethodNameStr = (String)chromiumMethodName.get(null);

                if (chromiumMethodNameStr == null) {

                    chromiumMethodNameStr = "create";

                }

                Method staticFactory = factoryProviderClass.getMethod(chromiumMethodNameStr, delegateClass);

                if (staticFactory!=null){

                    sProviderInstance = staticFactory.invoke(null, delegateConstructor.newInstance());

                }



            if (sProviderInstance != null){

                field.set("sProviderInstance", sProviderInstance);

                Log.i(TAG,"Hook success!");

            } else {

                Log.i(TAG,"Hook failed!");

            }

        } catch (Throwable e) {

            Log.w(TAG,e);

        }

    }

在加载webview之前调用即可

    @Override
    protected void onCreate(Bundle savedInstanceState) {

        super.onCreate(savedInstanceState);
        if (ContextCompat.checkSelfPermission(this, Manifest.permission.CAMERA) != PackageManager.PERMISSION_GRANTED) {
            ActivityCompat.requestPermissions(this, new String[]{Manifest.permission.CAMERA}, 1111);
        }
        hookWebView();
        setContentView(R.layout.activity_main);
        WebView webView = findViewById(R.id.webview);

        webView.getSettings().setJavaScriptEnabled(true);
        WebAppInterface webAppInterface = new WebAppInterface(this);
        webView.addJavascriptInterface(webAppInterface, "Android");

        webView.loadUrl("file:///android_asset/test.html");