Google Play Cross App Scripting Vulnerability: How do I protect calls to evaluateJavascript?

Question

My app is caught up in Google's Cross App Scripting security warning and I can't seem to get a version of the app that doesn't trigger Google's warning.

The majority of the functionality is a WebView wrapper for a web app. That's where the warning is.

I think I've followed the directions in Google's tutorial for Option 2, which are as follows:

1. Update your targetSdkVersion.

It has to be above 16 and I've done that.

2. Protect calls to evaluateJavascript

The WebView does accept URL's from Intents, but those are checked ahead of time to always be trusted. And all external URLs that might appear inside the app are opened externally, i.e. in Chrome.

3. Prevent unsafe file loads

The WebView never opens file:// URIs.

The code below is the relevant section from the class and method that Google is indicating has a problem. I think I've correctly filtered out all code paths there so that the only URIs that open would be my own domain.

I've already been through two levels of Google support and all they say is to follow the directions in their tutorial. I think I've done that: https://support.google.com/faqs/answer/9084685

rootUrl = "https://example.com"

Intent intent = getIntent();

if (intent.getStringExtra("action_url") != null) {
    if (intent.getStringExtra(NotificationIntentService.NOTIFICATIONS_DESTINATION) != null) {
        myWebView.loadUrl(rootUrl + intent.getStringExtra(NotificationIntentService.NOTIFICATIONS_DESTINATION));
       } else if ( 

  intent.getStringExtra("action_url").matches("^https://example.com/")) {
        myWebView.loadUrl(intent.getStringExtra("action_url"));
     }
    } else {
        if (retrieveHasRegistered(context)) {
            myWebView.loadUrl(rootUrl + "/android?registered");
        } else {
            myWebView.loadUrl(rootUrl + "/android");
        }
    }
}