Skip to content

fix(android): honor media capture deny policy#47

Merged
alexz-phantom merged 2 commits into
masterfrom
security/android-media-capture-deny
Jul 23, 2026
Merged

fix(android): honor media capture deny policy#47
alexz-phantom merged 2 commits into
masterfrom
security/android-media-capture-deny

Conversation

@alexz-phantom

@alexz-phantom alexz-phantom commented Jul 23, 2026

Copy link
Copy Markdown

Honor mediaCapturePermissionGrantType="deny" on Android.

  • Remove camera and microphone resources before existing permission handling.
  • Preserve protected-media requests and all other policy values.
  • Wire both native architectures and add focused unit coverage.

Tests: yarn lint, existing Jest suite, focused Java policy harness.

Summary by CodeRabbit

  • New Features
    • Added Android support for the mediaCapturePermissionGrantType WebView prop.
    • When set to deny, camera and microphone capture requests are blocked without showing permission prompts.
    • Other grant-type values keep existing permission behavior.
  • Documentation
    • Updated reference docs and TypeScript prop definitions to include Android behavior and the new option.
  • Bug Fixes
    • Hardened Android handling so denied media-capture requests don’t reach the permission prompt flow.
  • Tests
    • Added unit tests covering deny vs non-deny behavior for media-capture resources.
  • Chores
    • Added JUnit test dependency for Android tests.

@coderabbitai

coderabbitai Bot commented Jul 23, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: df1fd3e8-ae6c-46d9-854d-ce4cd74fbeb8

📥 Commits

Reviewing files that changed from the base of the PR and between 78dc86f and a45df1f.

📒 Files selected for processing (1)
  • android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java
🚧 Files skipped from review as they are similar to previous changes (1)
  • android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java

📝 Walkthrough

Walkthrough

Adds an Android mediaCapturePermissionGrantType prop, stores it on the WebView, filters camera and microphone permission resources when set to deny, and documents and tests the behavior.

Changes

Android media capture permission

Layer / File(s) Summary
Grant type prop wiring
src/WebViewTypes.ts, android/src/.../RNCWebViewManager.java, android/src/.../RNCWebViewManagerImpl.kt, android/src/.../RNCWebView.java
Adds the Android prop and forwards its nullable value through both architectures into WebView state.
Permission resource filtering
android/src/main/java/com/reactnativecommunity/webview/RNCMediaCapturePermission.java, android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java
Filters audio and video capture resources when the grant type is deny before existing permission handling runs.
Behavior validation and release documentation
android/src/test/.../RNCMediaCapturePermissionTest.java, android/build.gradle, docs/Reference.md, .changeset/harden-android-media-capture.md
Tests deny and non-deny behavior, adds the JUnit dependency, and documents the Android behavior with a patch changeset.

Sequence Diagram(s)

sequenceDiagram
  participant ReactProp
  participant RNCWebView
  participant RNCWebChromeClient
  participant PermissionRequest
  ReactProp->>RNCWebView: Set mediaCapturePermissionGrantType
  PermissionRequest->>RNCWebChromeClient: Submit requested resources
  RNCWebChromeClient->>RNCWebView: Read grant type
  RNCWebChromeClient->>RNCWebChromeClient: Filter media capture resources
  RNCWebChromeClient->>PermissionRequest: Deny filtered request
Loading
🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the Android media capture deny-policy behavior change.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch security/android-media-capture-deny

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java`:
- Around line 165-170: Update the empty-request branch in the media permission
handling around RNCMediaCapturePermission.filterRequestedResources and
request.deny() to clear permissionRequest and grantedPermissions after the
synchronous deny/grant decision. Ensure any later OS permission callback cannot
reuse stale state to grant a request that was already denied.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 8818baf6-4cdf-4e6b-83b4-98cab84b3bfd

📥 Commits

Reviewing files that changed from the base of the PR and between 413d5ea and 78dc86f.

📒 Files selected for processing (11)
  • .changeset/harden-android-media-capture.md
  • android/build.gradle
  • android/src/main/java/com/reactnativecommunity/webview/RNCMediaCapturePermission.java
  • android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java
  • android/src/main/java/com/reactnativecommunity/webview/RNCWebView.java
  • android/src/main/java/com/reactnativecommunity/webview/RNCWebViewManagerImpl.kt
  • android/src/newarch/com/reactnativecommunity/webview/RNCWebViewManager.java
  • android/src/oldarch/com/reactnativecommunity/webview/RNCWebViewManager.java
  • android/src/test/java/com/reactnativecommunity/webview/RNCMediaCapturePermissionTest.java
  • docs/Reference.md
  • src/WebViewTypes.ts

@alexz-phantom
alexz-phantom merged commit 862ba18 into master Jul 23, 2026
10 of 12 checks passed
@alexz-phantom
alexz-phantom deleted the security/android-media-capture-deny branch July 23, 2026 03:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants