hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-06-13 08:51:20 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: query for detecting enabling Javascript in Android WebSettings

Browse Source
This commit is contained in:
Ed Minnix
2022-11-08 19:20:43 -05:00
parent 8b11e98d42
commit 4d3a837310
4 changed files with 70 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
java/ql/src/Security/CWE/CWE-079/AndroidWebViewSettingsEnabledJavaScript.qhelp Normal file
View File

@@ -0,0 +1,45 @@
<!DOCTYPE qhelp PUBLIC
"-//Semmle//qhelp//EN"
"qhelp.dtd">
<qhelp>
<overview>
<p>
Enabling JavaScript in an Android WebView allows for the running of JavaScript
code in the context of the running application. This opens the possibility for a
man-in-the-middle attack, where the attacker can inject arbitrary JavaScript.
</p>
<p>
You can enable or disbale Javascript execution using
the <code>setJavaScriptEnabled</code> method of the settings of a webview.
</p>
</overview>
<recommendation>
<p>If Javascript does not need to be enabled, call <code>setJavaScriptEnabled(false)</code> on the settings of the webview.</p>
<p>If JavaScript is necessary, only load content from trusted servers using encrypted channels, such as https with certificate verification.</p>
</recommendation>
<example>
<p>In the following (bad) example, a webview has JavaScript enabled in its settings.</p>
<sample src="WebSettingsEnableJavascript.java"/>
<p>In the following (good) example, a webview explicitly disallows JavaScript execution.</p>
<sample src="WebSettingsDisableJavascript.java"/>
</example>
<references>
<li>
Oversecured Android Vulnerabilities Guide: <a href="https://oversecured.com/vulnerabilities#Android/Enabled_JavaScript">Enabled JavaScript</a>
</li>
<li>
Android documentation: <a href="https://developer.android.com/reference/android/webkit/WebSettings#setJavaScriptEnabled(boolean)">setJavaScriptEnabled</a>
</li>
</references>
</qhelp>