From 966924dbb02a234f72e49461ca78a2f56348a106 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alex=20Me=C3=9Fmer?= Date: Fri, 3 Jul 2026 10:24:59 +0200 Subject: [PATCH] inject request inspector JS at document start to fix race condition MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The fetch interceptor was injected via evaluateJavascript() inside onPageStarted(), which queues the script asynchronously on the WebView JS thread. Because the bundled webapp is served synchronously from local assets (no network latency), it could execute and make API fetch calls before the injection ran. This meant window.fetch was not yet overridden: no UUID header was injected, recordFetch() was never called, and shouldInterceptRequest() could not match the recorded request — resulting in an empty request body being proxied. We could fix it by using WebViewCompat.addDocumentStartJavaScript(), registered once at WebView init time. This API guarantees the script runs at document creation before any page scripts execute, eliminating the race condition. The solution falls back to the evaluateJavascript approach on WebView versions that do not support DOCUMENT_START_SCRIPT. Another race condition for the GeneratedUuidInHeaderRequestMatcher is, that before the first request of the webapp is done, the origin needs to be set. Since onPageStarted is executed asynchronously, it could still happen that it is executed after the first request. That would lead to the additional header being not set, because the matcher believes to deal with a CORS request. This change also makes sure that the origin is set within "onLoadMainFrame", because it is called when the webapp itself is loaded. This leads to the origin being set before the first request of the webapp can be done. --- app/build.gradle.kts | 1 + .../assets/test_page_early_request.html | 18 ++++ .../EarlyRequestTest.kt | 90 +++++++++++++++++++ .../RequestInspectorJavaScriptInterface.kt | 13 +++ .../RequestInspectorWebViewClient.kt | 20 +++-- .../GeneratedUuidInHeaderRequestMatcher.kt | 8 +- .../matcher/GeneratedUuidRequestMatcher.kt | 2 +- .../matcher/RequestMatcher.kt | 11 +++ 8 files changed, 156 insertions(+), 7 deletions(-) create mode 100644 app/src/androidTest/assets/test_page_early_request.html create mode 100644 app/src/androidTest/java/com/acsbendi/requestinspectorwebview/EarlyRequestTest.kt diff --git a/app/build.gradle.kts b/app/build.gradle.kts index 1396ef8..969072f 100644 --- a/app/build.gradle.kts +++ b/app/build.gradle.kts @@ -67,6 +67,7 @@ configure { dependencies { implementation("androidx.core:core-ktx:1.17.0") + implementation("androidx.webkit:webkit:1.13.0") androidTestImplementation("androidx.test.ext:junit:1.1.5") androidTestImplementation("androidx.test:runner:1.5.2") diff --git a/app/src/androidTest/assets/test_page_early_request.html b/app/src/androidTest/assets/test_page_early_request.html new file mode 100644 index 0000000..0d102ad --- /dev/null +++ b/app/src/androidTest/assets/test_page_early_request.html @@ -0,0 +1,18 @@ + + + + + + + + diff --git a/app/src/androidTest/java/com/acsbendi/requestinspectorwebview/EarlyRequestTest.kt b/app/src/androidTest/java/com/acsbendi/requestinspectorwebview/EarlyRequestTest.kt new file mode 100644 index 0000000..12da4d0 --- /dev/null +++ b/app/src/androidTest/java/com/acsbendi/requestinspectorwebview/EarlyRequestTest.kt @@ -0,0 +1,90 @@ +package com.acsbendi.requestinspectorwebview + +import android.annotation.SuppressLint +import android.graphics.Bitmap +import android.os.Handler +import android.os.Looper +import android.webkit.WebView +import androidx.test.ext.junit.runners.AndroidJUnit4 +import androidx.test.platform.app.InstrumentationRegistry +import androidx.webkit.WebViewFeature +import org.junit.After +import org.junit.Assert.assertEquals +import org.junit.Assert.assertTrue +import org.junit.Assume.assumeTrue +import org.junit.Test +import org.junit.runner.RunWith +import java.util.concurrent.CountDownLatch +import java.util.concurrent.TimeUnit + +@RunWith(AndroidJUnit4::class) +class EarlyRequestTest { + + private lateinit var webView: WebView + private lateinit var matcher: CapturingRequestMatcher + + @After + fun tearDown() { + InstrumentationRegistry.getInstrumentation().runOnMainSync { webView.destroy() } + } + + /** + * Verifies that a fetch() fired by an inline