diff --git a/android/app/src/main/java/com/superproductivity/superproductivity/webview/JavaScriptInterface.kt b/android/app/src/main/java/com/superproductivity/superproductivity/webview/JavaScriptInterface.kt index 7ad51be23a..c3af4c3be2 100644 --- a/android/app/src/main/java/com/superproductivity/superproductivity/webview/JavaScriptInterface.kt +++ b/android/app/src/main/java/com/superproductivity/superproductivity/webview/JavaScriptInterface.kt @@ -100,8 +100,18 @@ class JavaScriptInterface( @JavascriptInterface fun loadFromDb(requestId: String, key: String) { val r = (activity.application as App).keyValStore.get(key, "") - // NOTE: ' are important as otherwise the json messes up - callJavaScriptFunction(FN_PREFIX + "loadFromDbCallback('" + requestId + "', '" + key + "', '" + r + "')") + // Use JSONObject.quote() so the stored value can contain ' / \ / newlines / + // without breaking out of the JS literal (#7925). The previous + // raw single-quote interpolation broke on any value with a literal ' + // (JSON.stringify does not escape apostrophes), so an apostrophe in a + // backup blob silently corrupted the load. quote() produces a properly + // escaped double-quoted JS string. + callJavaScriptFunction( + FN_PREFIX + "loadFromDbCallback(" + + JSONObject.quote(requestId) + ", " + + JSONObject.quote(key) + ", " + + JSONObject.quote(r) + ")" + ) } @Suppress("unused")