From 451f1c8af8aaf9f23a3d425fa1b3268ead4a9a0b Mon Sep 17 00:00:00 2001
From: Amir Khodak <amir.khodak@gmail.com>
Date: Fri, 10 Jul 2026 09:32:20 +0000
Subject: [PATCH] =?UTF-8?q?security:=20harden=20login=20WebView=20?=
 =?UTF-8?q?=E2=80=94=20block=20file/content=20access=20and=20geolocation?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The WebView holds the claude.ai session cookie; lock down every path a loaded
page could use to reach local files. No effect on the login/SSO flow.
---
 app/src/main/java/me/khodak/claudeusage/LoginActivity.kt | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/app/src/main/java/me/khodak/claudeusage/LoginActivity.kt b/app/src/main/java/me/khodak/claudeusage/LoginActivity.kt
index f223c17..450bdfc 100644
--- a/app/src/main/java/me/khodak/claudeusage/LoginActivity.kt
+++ b/app/src/main/java/me/khodak/claudeusage/LoginActivity.kt
@@ -75,6 +75,15 @@ class LoginActivity : AppCompatActivity() {
                 databaseEnabled = false
                 javaScriptCanOpenWindowsAutomatically = false
                 setSupportMultipleWindows(false)
+                // Hardening: this WebView holds the claude.ai session, so lock down every path a
+                // page could use to reach the device. None of these affect the login flow.
+                allowFileAccess = false
+                allowContentAccess = false
+                @Suppress("DEPRECATION")
+                allowFileAccessFromFileURLs = false
+                @Suppress("DEPRECATION")
+                allowUniversalAccessFromFileURLs = false
+                setGeolocationEnabled(false)
                 // Standard Android Chrome UA — less suspicious than desktop
                 userAgentString = "Mozilla/5.0 (Linux; Android 13; Pixel 7) " +
                     "AppleWebKit/537.36 (KHTML, like Gecko) " +