[webview_flutter_android] Expose allowFileAccessFromFileURLs and allowUniversalAccessFromFileURLs

[jackxuechen]

This PR exposes Android WebView file URL access settings through AndroidWebViewController.

The following Android WebSettings APIs are added:

• setAllowFileAccessFromFileURLs
• setAllowUniversalAccessFromFileURLs

These settings allow applications loading local web content using file:// URLs to explicitly configure whether local resources and resources from other origins can be accessed.

This is useful for applications embedding local HTML assets that need to load additional local files or communicate with remote web services.

The APIs are only available on Android and do not affect other WebView implementations.

Issues

N/A

This is an API enhancement request to expose existing Android WebSettings functionality.

Pre-Review Checklist

• I read the Contributor Guide and followed the process outlined there for submitting PRs.
• I read the AI contribution guidelines and understand my responsibilities, or I am not using AI tools.
• I read the Tree Hygiene page, which explains my responsibilities.
• I read and followed the relevant style guides and ran the auto-formatter.
• I signed the CLA.
• The title of the PR starts with the name of the package surrounded by square brackets, e.g. [shared_preferences]
• I linked to at least one issue that this PR fixes in the description above.
• I followed the version and CHANGELOG instructions, using semantic versioning and the repository CHANGELOG style, or I have commented below to indicate which documented exception this PR falls under¹.
• I updated/added any relevant documentation (doc comments with ///).
• I added new tests to check the change I am making, or I have commented below to indicate which test exemption this PR falls under¹.
• All existing and new tests are passing.

If you need help, consider asking for advice on the #hackers-new channel on Discord.

Note: The Flutter team is currently trialing the use of Gemini Code Assist for GitHub. Comments from the gemini-code-assist bot should not be taken as authoritative feedback from the Flutter team. If you find its comments useful you can update your code accordingly, but if you are unsure or disagree with the feedback, please feel free to wait for a Flutter team member's review for guidance on which automated comments should be addressed.

Footnotes

1. Regular contributors who have demonstrated familiarity with the repository guidelines only need to comment if the PR is not auto-exempted by repo tooling. ↩ ↩²

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gemini-code-assist]

Code Review

This pull request adds support for configuring file URL access permissions (setAllowFileAccessFromFileURLs and setAllowUniversalAccessFromFileURLs) in the Android WebView plugin. This includes updates to Pigeon definitions, generated Kotlin and Dart bindings, the controller implementation, and corresponding unit tests. The review feedback suggests replacing @NotNull with @NonNull in WebSettingsProxyApi.java to maintain consistency with the rest of the codebase.

[stuartmorgan-g]

• I linked to at least one issue that this PR fixes in the description above.
• I followed the version and CHANGELOG instructions, using semantic versioning and the repository CHANGELOG style, or I have commented below to indicate which documented exception this PR falls under1.

Thanks for the contribution! You’ve checked boxes in the PR checklist above that are not reflected in this PR, so I’m assuming this is a work in progress and am marking it as a Draft. Please review the checklist, updating the PR as appropriate, and when the state of the PR as posted reflects the checklist please feel free to mark it as ready for review.

[jackxuechen]

I have updated the PR checklist and made the necessary changes to CHANGELOG.md and pubspec.yaml.

[gemini-code-assist]

Code Review

This pull request adds support for configuring file URL access permissions in webview_flutter_android by introducing setAllowFileAccessFromFileURLs and setAllowUniversalAccessFromFileURLs to AndroidWebViewController and its underlying Pigeon bindings. The review feedback suggests documenting that these settings are deprecated and have no effect starting from Android API level 30 (Android 11) in the Dart doc comments, and adding @SuppressWarnings("deprecation") to the Java implementation to suppress compiler warnings.

[gemini-code-assist]

This setting is deprecated starting from Android API level 30 (Android 11) and has no effect on those versions. It is highly recommended to document this limitation in the Dart doc comments so that developers are aware of it.

Suggested change

	/// Sets the file URL access to other file URLs permission for the web view.
	///
	/// The default value is true for apps targeting API 15 and below, and false
	/// when targeting API 16 and above.
	Future<void> setAllowFileAccessFromFileURLs(bool enabled) =>
	_webView.settings.setAllowFileAccessFromFileURLs(enabled);
	/// Sets the file URL access to other file URLs permission for the web view.
	///
	/// The default value is true for apps targeting API 15 and below, and false
	/// when targeting API 16 and above.
	///
	/// Note that starting from Android API level 30 (Android 11), this setting is
	/// not supported and has no effect.
	Future<void> setAllowFileAccessFromFileURLs(bool enabled) =>
	_webView.settings.setAllowFileAccessFromFileURLs(enabled);

[gemini-code-assist]

This setting is deprecated starting from Android API level 30 (Android 11) and has no effect on those versions. It is highly recommended to document this limitation in the Dart doc comments so that developers are aware of it.

Suggested change

	/// Sets the universal cross-origin access from file URLs permission for the web view.
	///
	/// The default value is true for apps targeting API 15 and below, and false
	/// when targeting API 16 and above.
	Future<void> setAllowUniversalAccessFromFileURLs(bool enabled) =>
	_webView.settings.setAllowUniversalAccessFromFileURLs(enabled);
	/// Sets the universal cross-origin access from file URLs permission for the web view.
	///
	/// The default value is true for apps targeting API 15 and below, and false
	/// when targeting API 16 and above.
	///
	/// Note that starting from Android API level 30 (Android 11), this setting is
	/// not supported and has no effect.
	Future<void> setAllowUniversalAccessFromFileURLs(bool enabled) =>
	_webView.settings.setAllowUniversalAccessFromFileURLs(enabled);

[gemini-code-assist]

Since setAllowFileAccessFromFileURLs and setAllowUniversalAccessFromFileURLs are deprecated in Android (since API level 30), calling them can trigger compiler warnings. Adding @SuppressWarnings("deprecation") prevents these warnings from cluttering the build output or causing build failures if warnings are treated as errors.

Suggested change

	@Override
	public void setAllowFileAccessFromFileURLs(
	@NonNull WebSettings pigeon_instance, boolean enabled) {
	pigeon_instance.setAllowFileAccessFromFileURLs(enabled);
	}
	@Override
	public void setAllowUniversalAccessFromFileURLs(
	@NonNull WebSettings pigeon_instance, boolean enabled) {
	pigeon_instance.setAllowUniversalAccessFromFileURLs(enabled);
	}
	@SuppressWarnings("deprecation")
	@Override
	public void setAllowFileAccessFromFileURLs(
	@NonNull WebSettings pigeon_instance, boolean enabled) {
	pigeon_instance.setAllowFileAccessFromFileURLs(enabled);
	}
	@SuppressWarnings("deprecation")
	@Override
	public void setAllowUniversalAccessFromFileURLs(
	@NonNull WebSettings pigeon_instance, boolean enabled) {
	pigeon_instance.setAllowUniversalAccessFromFileURLs(enabled);
	}