fix: remove do you want to download file.bin alert on iOS cp-7.61.0

[weitingsun]

Description

Remove "do you want to download file.bin" alert on iOS
PR for react-native-webview-mm: MetaMask/react-native-webview-mm#74

Changelog

CHANGELOG entry: Fixed a bug where we prompt do you want to download file.bin alert

Related issues

Fixes: #20359

Manual testing steps

Feature: remove do you want to download file.bin alert 

  Scenario: user not seeing the alert
    Given user navigates to browser tab

    When user navigates to sites like https://adtech.org/metamask-iframe-example/
    Then user should not see an alert that says "do you want to download file.bin"

Screenshots/Recordings

Before

After

Not showing the alert

Can still download files

Pre-merge author checklist

• I’ve followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I’ve included tests if applicable
• I’ve documented my code using JSDoc format if applicable
• I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

---

Note

Suppresses the iOS "download File.bin" alert for data URLs and consolidates Android WebView permission handling into a single dialog with safer granting/cleanup.

• iOS (RNCWebViewImpl):
  • Suppress downloads for application/octet-stream data URLs by inferring extension early and ignoring .bin, preventing the "Do you want to download File.bin" alert.
  • Minor refactor: compute fileExtension before decoding and reuse it.
• Android (RNCWebChromeClient):
  • Rework permission flow: reset state, aggregate multiple permissions into a single user prompt, map OS permissions to WebView resources, and grant immediately when possible.
  • Add robust state cleanup and try/catch around grant to avoid IllegalStateException; handle negative responses and pending system permission requests correctly.

^{Written by Cursor Bugbot for commit 59d75e8. This will update automatically on new commits. Configure here.}

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[MarioAslau]

LGTM

[github-actions]

🔍 Smart E2E Test Selection

• Selected E2E tags: SmokeCore, SmokeRamps, SmokePerps, SmokeCard, SmokeWalletUX
• Risk Level: medium
• AI Confidence: 80%

click to see 🤖 AI reasoning details

The changes update the @metamask/react-native-webview patch file with two main modifications:

1. Android (Java): Refactored permission request handling to show a single dialog for multiple permissions instead of sequential dialogs, improved state management, and added error handling for IllegalStateException to prevent crashes.

2. iOS (Objective-C): Added filtering to suppress automatic download prompts for generic binary files (File.bin) from data URLs, which are typically iframe-driven noise rather than user-initiated downloads.

WebView Usage Analysis:
WebView is used across multiple features:

• Browser tab functionality (general web browsing)
• Ramps/Buy-Sell (checkout flows via WebviewModal)
• Snaps execution environment (SnapsExecutionWebView)
• Card/KYC flows (KYCWebview)
• Perps trading charts (TradingViewChart)
• Simple webviews for external links
• Modal content display

Risk Assessment:

• Medium risk: These are bug fixes and UX improvements in a foundational component
• The permission handling changes could affect features that request camera/microphone permissions (like snaps)
• The download suppression improves UX but changes behavior around file handling
• Changes are defensive (error handling, filtering unwanted behavior) rather than introducing new features
• No changes to core wallet logic, controllers, or Engine

Selected Test Tags:

• SmokeCore: WebView is a core framework component affecting app stability and navigation
• SmokeRamps: Ramp flows use WebView extensively for checkout and payment flows
• SmokePerps: Perps feature uses WebView for TradingViewChart rendering
• SmokeCard: Card/KYC flows depend on WebView for onboarding processes
• SmokeWalletUX: WebView affects overall UX with modals, simple webviews, and external links

Not Selected:

• SmokeAccounts, SmokeIdentity: Not directly using WebView for core functionality
• SmokeSwaps, SmokeStake: Don't appear to use WebView based on codebase search
• SmokeConfirmationsRedesigned: Confirmations use WebView minimally (ShowBlockExplorer only)
• Network-related tags: WebView changes don't affect network layer
• Other feature-specific tags: No evidence of WebView usage in those areas

View GitHub Actions results

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud