feature/cp-10963-add-bridge-function-in-mobile-sdk-to-send-subscription by unnaticleverpush · Pull Request #331 · cleverpush/cleverpush-android-sdk

unnaticleverpush · 2026-02-24T13:33:06Z

Added getSubscriptionContextRequest() in the JS bridge; injected Promise-based getSubscriptionContext in both HTML-block and fullscreen banner scripts in AppBannerCarouselAdapter and InboxDetailBannerCarouselAdapter.

Note

Medium Risk
Touches WebView JS injection and @JavascriptInterface surfaces; mistakes in JSON escaping or bridge wiring could break HTML banners or expose unexpected JS-bridge behavior.

Overview
Adds a new JS-bridge API for banner WebViews to retrieve the current subscription context (subscriptionId, channelId). Both AppBannerCarouselAdapter and InboxDetailBannerCarouselAdapter now inject CleverPush.subscriptionContext on load and provide a Promise-based CleverPush.getSubscriptionContext() that is resolved via a new @JavascriptInterface method getSubscriptionContextRequest().

To support async callbacks, CleverpushInterface now receives the owning WebView, and subscription context JSON generation is centralized in getSubscriptionContextJson() (null-safe, iOS-compatible).

^{Written by Cursor Bugbot for commit a75daae. This will update automatically on new commits. Configure here.}

Summary by cubic

Adds a JS bridge to send subscription context (subscriptionId, channelId) to banner WebViews and exposes a Promise-based CleverPush.getSubscriptionContext, with subscriptionContext preloaded. Fulfills CP-10963 and mirrors iOS behavior.

New Features
- Added @JavascriptInterface getSubscriptionContextRequest() to resolve the Promise with JSON { subscriptionId, channelId } (null when missing), with safe JSON escaping.
- Injected CleverPush.getSubscriptionContext and prefilled CleverPush.subscriptionContext in both AppBannerCarouselAdapter and InboxDetailBannerCarouselAdapter (HTML-block and fullscreen banners).
Refactors
- CleverpushInterface now holds a WebView for UI-thread callbacks; moved copyToClipboard into the bridge and centralized context JSON via getSubscriptionContextJson; removed an unused import.

^{Written for commit a75daae. Summary will update on new commits.}

Added getSubscriptionContextRequest() in the JS bridge; injected Promise-based getSubscriptionContext in both HTML-block and fullscreen banner scripts in AppBannerCarouselAdapter and InboxDetailBannerCarouselAdapter.

cleverpush/src/main/java/com/cleverpush/banner/AppBannerCarouselAdapter.java

cubic-dev-ai

No issues found across 2 files

Removed unused import

cleverpush/src/main/java/com/cleverpush/banner/AppBannerCarouselAdapter.java

cursor · 2026-02-24T13:50:40Z

cleverpush/src/main/java/com/cleverpush/banner/AppBannerCarouselAdapter.java

        );
+        String contextJson = getSubscriptionContextJson();
+        webView.evaluateJavascript(
+            "if (typeof CleverPush !== 'undefined') { CleverPush.subscriptionContext = " + contextJson + "; }",


XSS vulnerability from unescaped JSON in JavaScript

High Severity

The raw JSON from getSubscriptionContextJson() is directly concatenated into JavaScript code without proper escaping. If subscription IDs or channel IDs contain characters like </script>, <, >, or /, they could break out of the JavaScript context and enable XSS attacks. While Gson.toJson() handles basic JSON escaping, it doesn't prevent script injection when the JSON is embedded directly in JavaScript code.

Additional Locations (2)

cleverpush/src/main/java/com/cleverpush/banner/AppBannerCarouselAdapter.java#L756-L757

cleverpush/src/main/java/com/cleverpush/inbox/InboxDetailBannerCarouselAdapter.java#L419-L420

cursor · 2026-02-24T13:50:40Z

cleverpush/src/main/java/com/cleverpush/banner/AppBannerCarouselAdapter.java

+        if (webView == null) return;
+        String contextJson = getSubscriptionContextJson();
+        String escaped = contextJson.replace("\\", "\\\\").replace("\"", "\\\"")
+            .replace("\r", "\\r").replace("\n", "\\n");


Incomplete character escaping for JavaScript injection

Medium Severity

The manual escaping only handles backslash, quote, carriage return, and newline characters, but omits tab (\t) and other control characters. If the JSON contains unescaped tabs or control characters, they could cause JavaScript syntax errors when the string is parsed by JSON.parse(), breaking the Promise resolution and preventing subscription context from being delivered.

Additional Locations (1)

cleverpush/src/main/java/com/cleverpush/inbox/InboxDetailBannerCarouselAdapter.java#L725-L727

cleverpush/src/main/java/com/cleverpush/banner/AppBannerCarouselAdapter.java

cursor · 2026-02-24T13:50:40Z

cleverpush/src/main/java/com/cleverpush/banner/AppBannerCarouselAdapter.java

+
+    public CleverpushInterface(WebView webView) {
+      this.webView = webView;
+    }


Memory leak from circular WebView reference

Medium Severity

The CleverpushInterface stores a reference to the WebView that it's added to via addJavascriptInterface. This creates a circular reference: WebView holds the interface, and the interface holds the WebView. This prevents garbage collection and causes memory leaks when WebViews are destroyed, particularly in RecyclerView scenarios where views are recycled.

Additional Locations (1)

cleverpush/src/main/java/com/cleverpush/inbox/InboxDetailBannerCarouselAdapter.java#L563-L568

cursor · 2026-02-24T13:50:40Z

cleverpush/src/main/java/com/cleverpush/banner/AppBannerCarouselAdapter.java

    });

    webView.loadUrl(block.getUrl());
-    webView.addJavascriptInterface(new CleverpushInterface(), "CleverPush");


Promise never rejects leading to unhandled hangs

Medium Severity

The CleverPush.getSubscriptionContext Promise only accepts a resolve callback, never a reject. If getSubscriptionContextRequest returns early due to null webView (line 996) or if any other error prevents resolution, the Promise hangs indefinitely. JavaScript callers using await or .then() will never receive a response, blocking execution.

Additional Locations (1)

cleverpush/src/main/java/com/cleverpush/banner/AppBannerCarouselAdapter.java#L757-L763

cursor · 2026-02-24T13:50:40Z

cleverpush/src/main/java/com/cleverpush/banner/AppBannerCarouselAdapter.java


    webView.loadUrl(block.getUrl());
-    webView.addJavascriptInterface(new CleverpushInterface(), "CleverPush");
+    webView.addJavascriptInterface(new CleverpushInterface(webView), "CleverPush");


JavaScript interface added after URL load

High Severity

The addJavascriptInterface is called after loadUrl, but according to Android WebView documentation, adding an interface is not reflected on the JavaScript side until the next page load. This means the CleverPush object won't be available when the page loads or in onPageFinished, causing JavaScript errors when code tries to call CleverPush.getSubscriptionContextRequest() and other interface methods.

Additional Locations (1)

cleverpush/src/main/java/com/cleverpush/inbox/InboxDetailBannerCarouselAdapter.java#L425-L427

cursor · 2026-02-24T13:50:40Z

cleverpush/src/main/java/com/cleverpush/banner/AppBannerCarouselAdapter.java

+                "  return new Promise(function(resolve) {\n" +
+                "    window.CleverPush._resolveSubscriptionContext = resolve;\n" +
+                "    CleverPush.getSubscriptionContextRequest();\n" +
+                "  });\n" +


Concurrent Promise calls overwrite resolver

Medium Severity

If JavaScript calls CleverPush.getSubscriptionContext() multiple times concurrently, the second call overwrites window.CleverPush._resolveSubscriptionContext, causing the first Promise to never resolve. Only the most recent call's Promise will resolve; all previous Promises hang indefinitely, leaking memory and blocking any code waiting on those Promises.

Additional Locations (1)

cleverpush/src/main/java/com/cleverpush/banner/AppBannerCarouselAdapter.java#L757-L762

PR change

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

cursor · 2026-02-25T07:10:49Z

cleverpush/src/main/java/com/cleverpush/banner/AppBannerCarouselAdapter.java

+      Map<String, Object> empty = new LinkedHashMap<>();
+      empty.put("subscriptionId", (Object) null);
+      empty.put("channelId", (Object) null);
+      return new Gson().toJson(empty);


Gson silently drops null values from subscription context JSON

High Severity

new Gson().toJson(context) silently omits null map entries because Gson's default is serializeNulls = false. When getSubscriptionId or getChannelId returns null, the output becomes {} instead of the intended {"subscriptionId":null,"channelId":null}. The catch block is equally broken — it explicitly puts null values, but Gson strips them. This contradicts the stated goal of matching iOS behavior with null for missing values. Using new GsonBuilder().serializeNulls().create() instead of new Gson() would fix this.

Additional Locations (1)

cleverpush/src/main/java/com/cleverpush/inbox/InboxDetailBannerCarouselAdapter.java#L760-L767

unnaticleverpush self-assigned this Feb 24, 2026

cursor bot reviewed Feb 24, 2026

View reviewed changes

cleverpush/src/main/java/com/cleverpush/banner/AppBannerCarouselAdapter.java Show resolved Hide resolved

cleverpush/src/main/java/com/cleverpush/banner/AppBannerCarouselAdapter.java Outdated Show resolved Hide resolved

unnaticleverpush requested a review from gbhrdt-cp February 24, 2026 13:34

cubic-dev-ai bot reviewed Feb 24, 2026

View reviewed changes

feature/cp-10963-add-bridge-function-in-mobile-sdk-to-send-subscription

8703eea

Removed unused import

cursor bot reviewed Feb 24, 2026

View reviewed changes

feature/cp-10963-add-bridge-function-in-mobile-sdk-to-send-subscription

a75daae

PR change

cursor bot reviewed Feb 25, 2026

View reviewed changes

gbhrdt-cp merged commit 869648b into master Mar 11, 2026
4 of 6 checks passed

gbhrdt-cp deleted the feature/cp-10963-add-bridge-function-in-mobile-sdk-to-send-subscription branch March 11, 2026 08:43

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feature/cp-10963-add-bridge-function-in-mobile-sdk-to-send-subscription#331

feature/cp-10963-add-bridge-function-in-mobile-sdk-to-send-subscription#331
gbhrdt-cp merged 3 commits intomasterfrom
feature/cp-10963-add-bridge-function-in-mobile-sdk-to-send-subscription

unnaticleverpush commented Feb 24, 2026 •

edited by cubic-dev-ai bot

Loading

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai bot left a comment

Uh oh!

Uh oh!

cursor bot Feb 24, 2026

Uh oh!

cursor bot Feb 24, 2026

Uh oh!

Uh oh!

cursor bot Feb 24, 2026

Uh oh!

cursor bot Feb 24, 2026

Uh oh!

cursor bot Feb 24, 2026

Uh oh!

cursor bot Feb 24, 2026

Uh oh!

cursor bot left a comment

Uh oh!

cursor bot Feb 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

unnaticleverpush commented Feb 24, 2026 • edited by cubic-dev-ai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by cubic

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor bot Feb 24, 2026

Choose a reason for hiding this comment

XSS vulnerability from unescaped JSON in JavaScript

Uh oh!

cursor bot Feb 24, 2026

Choose a reason for hiding this comment

Incomplete character escaping for JavaScript injection

Uh oh!

Uh oh!

cursor bot Feb 24, 2026

Choose a reason for hiding this comment

Memory leak from circular WebView reference

Uh oh!

cursor bot Feb 24, 2026

Choose a reason for hiding this comment

Promise never rejects leading to unhandled hangs

Uh oh!

cursor bot Feb 24, 2026

Choose a reason for hiding this comment

JavaScript interface added after URL load

Uh oh!

cursor bot Feb 24, 2026

Choose a reason for hiding this comment

Concurrent Promise calls overwrite resolver

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor bot Feb 25, 2026

Choose a reason for hiding this comment

Gson silently drops null values from subscription context JSON

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

unnaticleverpush commented Feb 24, 2026 •

edited by cubic-dev-ai bot

Loading