Function HttpFetchText

test-app/runtime/src/main/cpp/HMRSupport.cpp:218–351

Minimal HTTP fetch using java.net.* via JNI. Returns true on success (2xx) and non-empty body. Security: This is the single point of enforcement for remote module loading. In debug mode, all URLs are allowed. In production, checks security.allowRemoteModules and security.remoteModuleAllowlist from the app config.

// In debug mode, all URLs are allowed. In production, checks security.allowRemoteModules
// and security.remoteModuleAllowlist from the app config.
bool HttpFetchText(const std::string& url, std::string& out, std::string& contentType, int& status) {
  out.clear();
  contentType.clear();
  status = 0;
  
  // Security gate: check if remote module loading is allowed before any HTTP fetch.
  if (!IsRemoteUrlAllowed(url)) {
    status = 403; // Forbidden
    if (IsScriptLoadingLogEnabled()) {
      DEBUG_WRITE("[http-esm][security][blocked] %s", url.c_str());
    }
    return false;
  }
  
  try {
    JEnv env;

    // Allow network operations on the current thread (dev-only HMR path)
    // Some Android environments enforce StrictMode which throws NetworkOnMainThreadException
    // when performing network I/O on the main thread. Since this fetch runs on the JS/V8 thread
    // during development, explicitly relax the policy here.
    {
      jclass clsStrict = env.FindClass("android/os/StrictMode");
      jclass clsPolicyBuilder = env.FindClass("android/os/StrictMode$ThreadPolicy$Builder");
      if (clsStrict && clsPolicyBuilder) {
        jmethodID builderCtor = env.GetMethodID(clsPolicyBuilder, "<init>", "()V");
        jobject builder = env.NewObject(clsPolicyBuilder, builderCtor);
        if (builder) {
          jmethodID permitAll = env.GetMethodID(clsPolicyBuilder, "permitAll", "()Landroid/os/StrictMode$ThreadPolicy$Builder;");
          jobject builder2 = permitAll ? env.CallObjectMethod(builder, permitAll) : builder;
          jmethodID build = env.GetMethodID(clsPolicyBuilder, "build", "()Landroid/os/StrictMode$ThreadPolicy;");
          jobject policy = build ? env.CallObjectMethod(builder2 ? builder2 : builder, build) : nullptr;
          if (policy) {
            jmethodID setThreadPolicy = env.GetStaticMethodID(clsStrict, "setThreadPolicy", "(Landroid/os/StrictMode$ThreadPolicy;)V");
            if (setThreadPolicy) {
              env.CallStaticVoidMethod(clsStrict, setThreadPolicy, policy);
            }
          }
        }
      }
    }

    jclass clsURL = env.FindClass("java/net/URL");
    if (!clsURL) return false;
    jmethodID urlCtor = env.GetMethodID(clsURL, "<init>", "(Ljava/lang/String;)V");
    jmethodID openConnection = env.GetMethodID(clsURL, "openConnection", "()Ljava/net/URLConnection;");
    jstring jUrlStr = env.NewStringUTF(url.c_str());
    jobject urlObj = env.NewObject(clsURL, urlCtor, jUrlStr);

  jobject conn = env.CallObjectMethod(urlObj, openConnection);
    if (!conn) return false;

    jclass clsConn = env.GetObjectClass(conn);
    jmethodID setConnectTimeout = env.GetMethodID(clsConn, "setConnectTimeout", "(I)V");
    jmethodID setReadTimeout = env.GetMethodID(clsConn, "setReadTimeout", "(I)V");
    jmethodID setDoInput = env.GetMethodID(clsConn, "setDoInput", "(Z)V");
    jmethodID setUseCaches = env.GetMethodID(clsConn, "setUseCaches", "(Z)V");
    jmethodID setReqProp = env.GetMethodID(clsConn, "setRequestProperty", "(Ljava/lang/String;Ljava/lang/String;)V");