eclipsesource / eclipsesource/tabris-js
Support disabling view accessibility features
- Dominant language
- JavaScript
- Stars
- 1.4k
- Forks
- 171
- PR merge metrics
- No merged PRs in 30d
Description
### Problem description
Currently, some apps may spy on accessibility events emitted by the views of a Tabris.js app. This may compromise the security of a Tabris.js app, since sensitive user input may get unexpectedly stolen by an attacker service. See https://android.jlelse.eu/android-accessibility-75fdc5810025 (note: the article recommends using `setImportantForAccessibility()`, however using this setting is not sufficient, since an attacker accessibility service may use the flag `FLAG_INCLUDE_NOT_IMPORTANT_VIEWS`)
### Expected behavior
Provide an API to selectively disable those accessibility events on per view basis, e.g. by using an accessibility delegate overwriting `sendAccessibilityEvent()`, `sendAccessibilityEventUnchecked()` and `onRequestSendAccessibilityEvent()`.
### Environment
- Tabris.js version: 2.5.1
- OS: Android
Contributor guide
Assessment
This issue has not been assessed yet.