Androidwebview拦截图片,Android拦截并获取WebView内部POST请求参数

Android拦截并获取WebView内部POST请求参数

起因

有些时候自家APP中嵌入的H5页面并不是自家的。但是很多时候又想在H5不知情的情况下获取H5内部请求的参数&＃xff0c;这应该怎么做到呢&＃xff1f;

带着这个疑问&＃xff0c;就有了这篇博客。

实现过程

方案一

最开始想到的方案是直接拦截H5中所有的请求&＃xff1a;

webView.setWebViewClient(new WebViewClient() {

&＃64;Override

public WebResourceResponse shouldInterceptRequest(WebView view, WebResourceRequest request){

try {

URL url &＃61; new URL(request.getUrl());

} catch (MalformedURLException e) {

e.printStackTrace();

}

Log.e("InternetActivity", request &＃43; "");

return super.shouldInterceptRequest(view, request);

}

});

但是通过此方法只能获取get请求的参数(因为参数直接拼在了url链接中)&＃xff0c;对于post请求的参数无可奈何。

方案二

后来参考了request_data_webviewclient&＃xff0c;有了新的实现方式&＃xff0c;具体原理为&＃xff1a;给H5注入一段js代码&＃xff0c;目的是在每次Ajax请求都会调用Android原生的方法&＃xff0c;将请求参数传给客户端。

具体流程如下&＃xff1a;

其中&＃xff0c;

js注入代码&＃xff1a;

function generateRandom(){

return Math.floor((1 &＃43; Math.random()) * 0x10000)

.toString(16)

.substring(1);

}

// This only works if &＃96;open&＃96; and &＃96;send&＃96; are called in a synchronous way

// That is, after calling &＃96;open&＃96;, there must be no other call to &＃96;open&＃96; or

// &＃96;send&＃96; from another place of the code until the matching &＃96;send&＃96; is called.

requestID &＃61; null;

XMLHttpRequest.prototype.reallyOpen &＃61; XMLHttpRequest.prototype.open;

XMLHttpRequest.prototype.open &＃61; function(method, url, async, user, password){

requestID &＃61; generateRandom()

var signed_url &＃61; url &＃43; "AJAXINTERCEPT" &＃43; requestID;

this.reallyOpen(method, signed_url , async, user, password);

};

XMLHttpRequest.prototype.reallySend &＃61; XMLHttpRequest.prototype.send;

XMLHttpRequest.prototype.send &＃61; function(body){

interception.customAjax(requestID, body);

this.reallySend(body);

};

客户端拦截请求&＃xff1a;

&＃64;Override

public final WebResourceResponse shouldInterceptRequest(final WebView view, WebResourceRequest request){

String requestBody &＃61; null;

Uri uri &＃61; request.getUrl();

// 判断是否为Ajax请求(只要链接中包含AJAXINTERCEPT即是)

if (isAjaxRequest(request)) {

// 获取post请求参数

requestBody &＃61; getRequestBody(request);

// 获取原链接

uri &＃61; getOriginalRequestUri(request, MARKER);

}

// 重新构造请求&＃xff0c;并获取response

WebResourceResponse webResourceResponse &＃61; shouldInterceptRequest(view, new WriteHandlingWebResourceRequest(request, requestBody, uri));

if (webResourceResponse &＃61;&＃61; null) {

return webResourceResponse;

} else {

return injectIntercept(webResourceResponse, view.getContext());

}

}

客户端注入js代码&＃xff1a;

private WebResourceResponse injectIntercept(WebResourceResponse response, Context context){

String encoding &＃61; response.getEncoding();

String mime &＃61; response.getMimeType();

// WebResourceResponse的mime必须为"text/html",不能是"text/html; charset&＃61;utf-8"

if (mime.contains("text/html")) {

mime &＃61; "text/html";

}

InputStream responseData &＃61; response.getData();

InputStream injectedResponseData &＃61; injectInterceptToStream(

context,

responseData,

mime,

encoding

);

return new WebResourceResponse(mime, encoding, injectedResponseData);

}

注&＃xff1a;根据谷歌官方文档&＃xff0c;mime必须为"text/html"。

反思

开发过程中遇到了页面一直显示不了的问题&＃xff0c;实际上就是因为获取到的mime是text/html; charset&＃61;utf-8&＃xff0c;得改成text/html&＃xff1b;

通过此方法也可篡改response与request&＃xff0c;但不要滥用&＃xff1b;

所以说&＃xff0c;Android确实不安全&＃xff01;