Do not merge.

Cherry picked:

Add an api to toggle content url access.

By default, WebView allows access to content providers on the system.  This
setting allows applications to turn off content urls.

Bug: 1196879
Change-Id: I49eaea6d7b9ccc3b3a4443d712222556087568c0

3 files changed, 24 insertions, 3 deletions

diff --git a/core/java/android/webkit/BrowserFrame.java b/core/java/android/webkit/BrowserFrame.java
index de1faa2..e246717 100644
--- a/core/java/android/webkit/BrowserFrame.java
+++ b/core/java/android/webkit/BrowserFrame.java
@@ -738,7 +738,8 @@ class BrowserFrame extends Handler {
             }
 
         // content://
-        } else if (url.startsWith(ANDROID_CONTENT)) {
+        } else if (mSettings.getAllowContentAccess() &&
+                   url.startsWith(ANDROID_CONTENT)) {
             try {
                 // Strip off mimetype, for compatibility with ContentLoader.java
                 // If we don't do this, we can fail to load Gmail attachments,
diff --git a/core/java/android/webkit/FrameLoader.java b/core/java/android/webkit/FrameLoader.java
index 2b44775..0d80302 100644
--- a/core/java/android/webkit/FrameLoader.java
+++ b/core/java/android/webkit/FrameLoader.java
@@ -203,7 +203,8 @@ class FrameLoader {
                                 settings.getAllowFileAccess())).sendToTarget();
             }
             return true;
-        } else if (URLUtil.isContentUrl(url)) {
+        } else if (settings.getAllowContentAccess() &&
+                   URLUtil.isContentUrl(url)) {
             // Send the raw url to the ContentLoader because it will do a
             // permission check and the url has to match.
             if (loadListener.isSynchronous()) {
diff --git a/core/java/android/webkit/WebSettings.java b/core/java/android/webkit/WebSettings.java
index 6750422..0670c4e 100644
--- a/core/java/android/webkit/WebSettings.java
+++ b/core/java/android/webkit/WebSettings.java
@@ -215,6 +215,7 @@ public class WebSettings {
     private boolean         mBuiltInZoomControls = false;
     private boolean         mDisplayZoomControls = true;
     private boolean         mAllowFileAccess = true;
+    private boolean         mAllowContentAccess = true;
     private boolean         mLoadWithOverviewMode = false;
     private boolean         mEnableSmoothTransition = false;
 
@@ -587,7 +588,9 @@ public class WebSettings {
 
     /**
      * Enable or disable file access within WebView. File access is enabled by
-     * default.
+     * default.  Note that this enables or disables file system access only.
+     * Assets and resources are still accessible using file:///android_asset and
+     * file:///android_res.
      */
     public void setAllowFileAccess(boolean allow) {
         mAllowFileAccess = allow;
@@ -601,6 +604,22 @@ public class WebSettings {
     }
 
     /**
+     * Enable or disable content url access within WebView.  Content url access
+     * allows WebView to load content from a content provider installed in the
+     * system.  The default is enabled.
+     */
+    public void setAllowContentAccess(boolean allow) {
+        mAllowContentAccess = allow;
+    }
+
+    /**
+     * Returns true if this WebView supports content url access.
+     */
+    public boolean getAllowContentAccess() {
+        return mAllowContentAccess;
+    }
+
+    /**
      * Set whether the WebView loads a page with overview mode.
      */
     public void setLoadWithOverviewMode(boolean overview) {