问题描述

在系统进程中使用 WebView 时，会抛出 AndroidRuntime: Caused by: java.lang.UnsupportedOperationException: For security reasons, WebView is not allowed in privileged processes

特权进程包括sharedUserId为ROOT_UID和SYSTEM_UID的进程

错误日志

 Process: com.android.androidx, PID: 5044
    java.lang.RuntimeException: Unable to start activity ComponentInfo{com.android.androidx/com.android.activityx.ChargeActivity}: android.view.InflateException: Binary XML file line #7 in com.android.androidx:layout/layout_charge: Binary XML file line #7 in com.android.androidx:layout/layout_charge: Error inflating class android.webkit.WebView
        at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:3298)
        at android.app.ActivityThread.handleLaunchActivity(ActivityThread.java:3437)
        at android.app.servertransaction.LaunchActivityItem.execute(LaunchActivityItem.java:83)
        at android.app.servertransaction.TransactionExecutor.executeCallbacks(TransactionExecutor.java:135)
        at android.app.servertransaction.TransactionExecutor.execute(TransactionExecutor.java:95)
        at android.app.ActivityThread$H.handleMessage(ActivityThread.java:2041)
        at android.os.Handler.dispatchMessage(Handler.java:107)
        at android.os.Looper.loop(Looper.java:214)
        at android.app.ActivityThread.main(ActivityThread.java:7386)
        at java.lang.reflect.Method.invoke(Native Method)
        at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:492)
        at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:980)
     Caused by: android.view.InflateException: Binary XML file line #7 in com.android.androidx:layout/layout_charge: Binary XML file line #7 in com.android.androidx:layout/layout_charge: Error inflating class android.webkit.WebView
     Caused by: android.view.InflateException: Binary XML file line #7 in com.android.androidx:layout/layout_charge: Error inflating class android.webkit.WebView
     Caused by: java.lang.reflect.InvocationTargetException
        at java.lang.reflect.Constructor.newInstance0(Native Method)
        at java.lang.reflect.Constructor.newInstance(Constructor.java:343)
        at android.view.LayoutInflater.createView(LayoutInflater.java:854)
        at android.view.LayoutInflater.createView(LayoutInflater.java:776)
        at com.android.internal.policy.PhoneLayoutInflater.onCreateView(PhoneLayoutInflater.java:58)
        at android.view.LayoutInflater.onCreateView(LayoutInflater.java:930)
        at android.view.LayoutInflater.onCreateView(LayoutInflater.java:950)
        at android.view.LayoutInflater.createViewFromTag(LayoutInflater.java:1006)
        at android.view.LayoutInflater.createViewFromTag(LayoutInflater.java:961)
        at android.view.LayoutInflater.rInflate(LayoutInflater.java:1140)
        at android.view.LayoutInflater.rInflateChildren(LayoutInflater.java:1101)
        at android.view.LayoutInflater.inflate(LayoutInflater.java:682)
        at android.view.LayoutInflater.inflate(LayoutInflater.java:534)
        at android.view.LayoutInflater.inflate(LayoutInflater.java:481)
        at com.android.internal.policy.PhoneWindow.setContentView(PhoneWindow.java:438)
        at android.app.Activity.setContentView(Activity.java:3324)
        at com.android.activityx.ChargeActivity.onCreate(ChargeActivity.java:40)
        at android.app.Activity.performCreate(Activity.java:7802)
        at android.app.Activity.performCreate(Activity.java:7791)
        at android.app.Instrumentation.callActivityOnCreate(Instrumentation.java:1306)
        at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:3273)
        at android.app.ActivityThread.handleLaunchActivity(ActivityThread.java:3437)
        at android.app.servertransaction.LaunchActivityItem.execute(LaunchActivityItem.java:83)
        at android.app.servertransaction.TransactionExecutor.executeCallbacks(TransactionExecutor.java:135)
        at android.app.servertransaction.TransactionExecutor.execute(TransactionExecutor.java:95)
        at android.app.ActivityThread$H.handleMessage(ActivityThread.java:2041)
        at android.os.Handler.dispatchMessage(Handler.java:107)
        at android.os.Looper.loop(Looper.java:214)
        at android.app.ActivityThread.main(ActivityThread.java:7386)
        at java.lang.reflect.Method.invoke(Native Method)
        at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:492)
        at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:980)
2020-10-05 14:50:47.621 5044-5044/? E/AndroidRuntime: Caused by: java.lang.UnsupportedOperationException: For security reasons, WebView is not allowed in privileged processes
        at android.webkit.WebViewFactory.getProvider(WebViewFactory.java:236)
        at android.webkit.WebView.getFactory(WebView.java:2551)
        at android.webkit.WebView.ensureProviderCreated(WebView.java:2545)
        at android.webkit.WebView.setOverScrollMode(WebView.java:2613)
        at android.view.View.<init>(View.java:5062)
        at android.view.View.<init>(View.java:5203)
        at android.view.ViewGroup.<init>(ViewGroup.java:676)
        at android.widget.AbsoluteLayout.<init>(AbsoluteLayout.java:56)
        at android.webkit.WebView.<init>(WebView.java:410)
        at android.webkit.WebView.<init>(WebView.java:353)
        at android.webkit.WebView.<init>(WebView.java:336)
        at android.webkit.WebView.<init>(WebView.java:323)
         ... 32 more

解决办法

通过 hook 加载过程避免

在项目的 Application OnCreate() 或者要加载的 Activity setContentView() 前调用 hookWebView()

再次运行问题解决

public static void hookWebView(){
    int sdkInt = Build.VERSION.SDK_INT;
    try {
        Class<?> factoryClass = Class.forName("android.webkit.WebViewFactory");
        Field field = factoryClass.getDeclaredField("sProviderInstance");
        field.setAccessible(true);
        Object sProviderInstance = field.get(null);
        if (sProviderInstance != null) {
            Log.i("hook","sProviderInstance isn't null");
            return;
        }

        Method getProviderClassMethod;
        if (sdkInt > 22) {
            getProviderClassMethod = factoryClass.getDeclaredMethod("getProviderClass");
        } else if (sdkInt == 22) {
            getProviderClassMethod = factoryClass.getDeclaredMethod("getFactoryClass");
        } else {
            Log.i("hook","Don't need to Hook WebView");
            return;
        }
        getProviderClassMethod.setAccessible(true);
        Class<?> factoryProviderClass = (Class<?>) getProviderClassMethod.invoke(factoryClass);
        Class<?> delegateClass = Class.forName("android.webkit.WebViewDelegate");
        Constructor<?> delegateConstructor = delegateClass.getDeclaredConstructor();
        delegateConstructor.setAccessible(true);
        if(sdkInt < 26){//低于Android O版本
            Constructor<?> providerConstructor = factoryProviderClass.getConstructor(delegateClass);
            if (providerConstructor != null) {
                providerConstructor.setAccessible(true);
                sProviderInstance = providerConstructor.newInstance(delegateConstructor.newInstance());
            }
        } else {
            Field chromiumMethodName = factoryClass.getDeclaredField("CHROMIUM_WEBVIEW_FACTORY_METHOD");
            chromiumMethodName.setAccessible(true);
            String chromiumMethodNameStr = (String)chromiumMethodName.get(null);
            if (chromiumMethodNameStr == null) {
                chromiumMethodNameStr = "create";
            }
            Method staticFactory = factoryProviderClass.getMethod(chromiumMethodNameStr, delegateClass);
            if (staticFactory!=null){
                sProviderInstance = staticFactory.invoke(null, delegateConstructor.newInstance());
            }
        }

        if (sProviderInstance != null){
            field.set("sProviderInstance", sProviderInstance);
            Log.i("hook","Hook success!");
        } else {
            Log.i("hook","Hook failed!");
        }
    } catch (Throwable e) {
        Log.w("hook",e);
        e.printStackTrace();
    }
}