看來script injection也不算是啥旁門左道了, 在Android 4.0 ICS上的WebView也使用了同樣的技巧了(在Gingerbread上並未看到這樣的codes)
在ICS的Setting裡面"Accessiblity"裡有個設定叫"Install web script", 其實這東西應該沒使用者看的懂, 其實蠻怪的, 不過既然放了就有它的作用
ICS的WebView裡面有這樣一段codes:
int axsParameterValue = getAxsUrlParameterValue(url);
if (axsParameterValue == ACCESSIBILITY_SCRIPT_INJECTION_UNDEFINED) {
boolean onDeviceScriptInjectionEnabled = (Settings.Secure.getInt(mContext
.getContentResolver(), Settings.Secure.ACCESSIBILITY_SCRIPT_INJECTION, 0) == 1);
if (onDeviceScriptInjectionEnabled) {
ensureAccessibilityScriptInjectorInstance(false);
// neither script injected nor script injection opted out => we inject
loadUrl(ACCESSIBILITY_SCRIPT_CHOOSER_JAVASCRIPT);
// TODO: Set this flag after successfull script injection. Maybe upon injection
// the chooser should update the meta tag and we check it to declare success
mAccessibilityScriptInjected = true;
} else {
// injection disabled so we fallback to the basic built-in support
ensureAccessibilityScriptInjectorInstance(true);
}
} else if (axsParameterValue == ACCESSIBILITY_SCRIPT_INJECTION_OPTED_OUT) {
// injection opted out so we fallback to the basic buil-in support
ensureAccessibilityScriptInjectorInstance(true);
} else if (axsParameterValue == ACCESSIBILITY_SCRIPT_INJECTION_PROVIDED) {
ensureAccessibilityScriptInjectorInstance(false);
// the URL provides accessibility but we still need to add our generic script
loadUrl(ACCESSIBILITY_SCRIPT_CHOOSER_JAVASCRIPT);
} else {
Log.e(LOGTAG, “Unknown URL value for the "axs" URL parameter: ” + axsParameterValue);
}
loadUrl(ACCESSIBILITY_SCRIPT_CHOOSER_JAVASCRIPT);
這邊並不是強制去載入一個新的URL, 其實他做的就是script injection, ACCESSIBILITY_SCRIPT_CHOOSER_JAVASCRIPT的內容就是:
// JavaScript to inject the script chooser which will
// pick the right script for the current URL
private static final String ACCESSIBILITY_SCRIPT_CHOOSER_JAVASCRIPT =
“javascript:(function() {” +
“ var chooser = document.createElement(‘script’);” +
“ chooser.type = 'text/javascript’;” +
“ chooser.src = 'https://ssl.gstatic.com/accessibility/javascript/android/AndroidScriptChooser.user.js’;” +
“ document.getElementsByTagName('head’)[0].appendChild(chooser);” +
“ })();”;
它就是在最後把https://ssl.gstatic.com/accessibility/javascript/android/AndroidScriptChooser.user.js給inject到page
還沒去仔細看js裡面的內容, 似乎都是一些基本的東西的樣子, 還不太知道他的用意, 不過應該跟加速(?) Google本身的頁面有關係, 不然其他web site應該也沒用到這些東西