hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

Java: Mention AssetLoader in WebView file access query documentation

Browse Source
This commit is contained in:
Ed Minnix
2022-11-30 10:43:53 -05:00
parent c836c4feb7
commit 5ac1e012ae
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
java/ql/src/Security/CWE/CWE-200/AndroidWebViewSettingsFileAccess.qhelp
View File

@@ -21,6 +21,11 @@
<li><code>setAllowFileAccessFromFileURLs</code></li>
<li><code>setAllowUniversalAccessFromFileURLs</code></li>
</ul>
<p>If your application requires access to the file system, it is best to
avoid using <code>file://</code> urls, and instead use an alternative that
allows loading files via https, such
as <code>androidx.webkit.WebViewAssetLoader</code>.</p>
</recommendation>
<example>
@@ -45,6 +50,9 @@
<li>
Android documentation: <a href="https://developer.android.com/reference/android/webkit/WebSettings#setAllowUniversalAccessFromFileURLs(boolean)">WebSettings.setAllowUniversalAccessFromFileURLs</a>.
</li>
<li>
Android documentation: <a href="https://developer.android.com/reference/androidx/webkit/WebViewAssetLoader">WebViewAssetLoader</a>.
</li>
</references>
</qhelp>