Android: NewsblurWebview enables setAllowFileAccess while loading https appassets virtual host #2109

clients/android/NewsBlur/app/src/main/java/com/newsblur/web/NewsblurWebview.java configures the reading WebView like this:

getSettings().setJavaScriptEnabled(true);
getSettings().setLoadWithOverviewMode(true);
getSettings().setCacheMode(WebSettings.LOAD_CACHE_ELSE_NETWORK);
getSettings().setDomStorageEnabled(true);
getSettings().setSupportZoom(true);
getSettings().setAllowFileAccess(true);

The class already integrates WebViewAssetLoader for bundled resources:

class NewsblurWebViewClient extends WebViewClient {
    @Override
    public WebResourceResponse shouldInterceptRequest(WebView view, WebResourceRequest request) {
        return assetLoader.shouldInterceptRequest(request.getUrl());
    }
    ...
}

And ReadingItemFragment loads the article HTML with the https virtual host:

ensureReadingWebview().loadDataWithBaseURL(READING_BASE_URL, html, "text/html", "UTF-8", null)

AppConstants.READING_BASE_URL is "https://appassets.androidplatform.net/assets/", the standard virtual host WebViewAssetLoader uses. The reading WebView never loads a file:// URL, and shouldInterceptRequest serves assets directly from the AssetManager regardless of setAllowFileAccess.

setAllowFileAccess(true) is therefore not load-bearing here. CWE-200 is the closest mapping for the WebView posture.

Suggested fix

Flip setAllowFileAccess(true) to setAllowFileAccess(false). The asset loader pathway is unaffected.

A PR is open at #2110.