Update TWebBrowser usage for modern WebView requirements (iOS WKWebView, Android WebView security)

[jimmckeeth]

Overview

Lab 11 generates an HTML report and displays it using FMX's TWebBrowser component. On iOS, Apple removed UIWebView in iOS 14 (deprecated since iOS 8) and requires WKWebView. On Android, WebView security requirements have tightened significantly. Delphi 13's TWebBrowser uses WKWebView on iOS, but the HTML content loaded, the LoadFromStrings API, and security settings need verification against modern webview restrictions.

Background

iOS Changes

• iOS 14+: UIWebView is completely removed from the OS. Any app still linking against UIWebView is rejected by the App Store. Delphi 10.3's TWebBrowser used UIWebView internally.
• Delphi 10.4+: TWebBrowser was updated to use WKWebView. However, WKWebView has stricter security:
  • Local file loading requires WKWebView.loadFileURL:allowingReadAccessToURL: rather than loadHTMLString:baseURL:.
  • Inline <script> tags may be blocked by the Content Security Policy.
  • Mixed content (HTTP within HTTPS context) is blocked.

Android Changes

• Android's WebView is a standalone, auto-updating system component (since Android 5). Security patches are pushed independently of the OS.
• WebSettings.setAllowFileAccess(false) is the default since Android 11 — local file:// URIs in HTML are blocked.
• JavaScript is disabled by default in Android WebView; it must be explicitly enabled.

Current Code

Lab 11 builds an HTML string from log entry data and calls wbReport.LoadFromStrings(HTMLContent, ''). This may fail silently in WKWebView if the HTML references local resources or if the base URL is empty.

Files Affected

lab-src/Lab11.../frames/uReportFrame.pas  (HTML generation and WebBrowser loading)
lab-src/Lab11.../forms/formMain.pas

Steps to Address

1. Verify that Delphi 13's TWebBrowser.LoadFromStrings correctly maps to WKWebView.loadHTMLString:baseURL: on iOS — test with a simple HTML string.
2. Update the HTML report template to be self-contained (no external CSS or JS file references) since local file access is restricted in WKWebView.
3. If the report HTML uses inline styles only (no <link> or <script src="">), verify it renders correctly — this is the safest approach.
4. On Android, confirm that the HTML-only report renders correctly without requiring setAllowFileAccess(true).
5. If the report uses JavaScript (e.g., for sorting or charts), explicitly note that JavaScriptEnabled must be set and explain the security implications in the lab instructions.
6. Test the HTML report with special characters (accented characters, quotes in note fields) to ensure proper encoding — use TNetEncoding.HTML.Encode for user-entered content in the report.
7. Verify TWebBrowser navigation events (OnShouldStartLoadWithRequest) still fire correctly in Delphi 13 if used for link interception.

Test Plan

• On iOS 17 simulator: Lab 11 report loads and displays all project entries with correct formatting.
• On Android 13 emulator: Lab 11 report loads and displays correctly.
• HTML with special characters (e.g., <, &, accented letters in notes) renders correctly without garbled text.
• No UIWebView symbol is linked in the iOS binary (verify with nm or check Delphi 13 release notes).
• The TWebBrowser does not show a blank white screen on first load (timing issue that affected some Delphi versions).
• Tapping a link in the report (if any) does not navigate away from the report frame.
• Report renders correctly in both portrait and landscape orientation.