Switching to external without permission [Follow up to #551]

[srirambv]

Description:

Switching to external without permission [Follow up to #551]

Steps to Reproduce

1. Install blick app from app store
2. Upgrade to 1.14.1 via appstore
3. Search for blick.ch and click on search result, automatically opens the installed app

Actual result:
No user permission asked before switching to external app

Expected result:
Should have asked persmission which was the fix on #551

Reproduces how often: [Easily reproduced, Intermittent Issue]
Easy

Brave Version:
1.14.1

Device details:
iPhone and iPad

Website problems only:

• did you check with Brave Shields down?
• did you check in Safari/Firefox (WkWebView-based browsers)?

Additional Information

Reported on community https://community.brave.com/t/ask-before-open-app-instead-of-website/97970 and reproduced on iPhone
Adding same security labels as #551
cc: @jumde

[Brandon-T]

This one may involve Private-APIs in order to fix. I researched it many many times. There used to be a solution to this with decidePolicyForNavigation but it no longer works after iOS 10.

Problem: Universal Links (Deep-Linking) via apple-app-site-association.json.

If you go to google or any search engine, and you type in a URL of the search result belongs to some app installed on your phone, the moment you tap on the link, it will open in WKWebView and therefore open the app automatically. It does NOT have a callback for this and it does not hit decidePolicyForNavigation either.

Therefore, the only way to fix this is to use private-apis in order to determine if the WebView is going to open a deep-link.

Option: 2, pull down the deep-link config for EVERY single request the WKWebView makes. IE: If we visit reddit.com, we'd have to pull down: https://www.reddit.com/apple-app-site-association to and parse it first..

Both of these options are not worth it. Option 1 can get us rejected from the store by Apple for use of Private-APIs. Option 2 will involve a LOT of parsing (especially for websites like facebook).. Option 2 will mean that every site we visit will be slower as we have to parse the config if it exists..

[Brandon-T]

cc: @jhreis ^

Not sure what we should do if anything.

[jumde]

@Brandon-T @srirambv @jhreis - I don't think we can do anything right away. May be we can reach out to our friends at Apple and see if they are willing to expose these APIs?

[kylehickinson]

@jumde @jhreis

FYI the private API needed to accomplish this: https://stackoverflow.com/questions/38450586/prevent-universal-links-from-opening-in-wkwebview-uiwebview

(https://github.com/WebKit/webkit/blob/371119ce88f4e1e3c7945e7860fbb3a4d5fc7402/Source/WebKit/UIProcess/API/Cocoa/WKNavigationDelegatePrivate.h#L63)

We should however also ask Apple to make this a public API. (either filing our own rdar or duping an existing one)

[alanhoyle]

Chrome for iOS suppresses external app loading if in a private browser window. I feel like it should be fine to load external apps in regular windows, but in private windows, it should be suppressed.

I started a discussion about this here:

https://community.brave.com/t/suppress-app-loading-in-private-browser-on-ios/97382

[jamesmudgett]

Focus uses method mentioned above https://github.com/mozilla-mobile/focus-ios/blob/464b65ff9e3568ae3dc2f2d95184e33625db202b/Blockzilla/Modules/WebView/WebViewController.swift#L369

[kylehickinson]

@srirambv The solution to this problem cannot be solved by adding a permission prompt (as we do with known schemes such as maps/tel/etc.) because we do not know that Brave will launch another app when a user taps a link. Therefore the original issue has been solved a different way as seen in the PR: #3329

[srirambv]

Verification passed on iPhone 7+ with iOS 14.4 running 1.24 (21.3.25.18)

• Verified test plan from Fix #2119: Add preference around opening external apps #3329

Normal tab

iPhone.7+.Normal.Tab.mp4

Private tab

iPhone.7+.Private.Tab.MP4

---

Verification passed on iPhone XR with iOS 13.5 running 1.24 (21.3.25.18)

• Verified test plan from Fix #2119: Add preference around opening external apps #3329

Normal tab

iPhone.XR.Normal.Tab.MP4

Private tab

iPhone.XR.Private.Tab.MP4

---

Verification passed on iPad Pro with iOS 12.4.1 running 1.24 (21.3.25.18)

• Verified test plan from Fix #2119: Add preference around opening external apps #3329

Normal tab

iPad.Normal.Tab.MP4

Private tab

iPad.Private.Tab.MP4