The WebView.setWebContentsDebuggingEnabled method enables or disables the contents of any WebView in the application to be debugged.
Enabling debugging featues could allow for additional entry points or leaking sensitive information. -As such, debugging should only be anabled during development, and disabled during production builds.
+Enabling debugging features could allow for additional entry points or leaking sensitive information. +As such, debugging should only be enabled during development, and disabled in production builds.
Ensure that debugging features are not enabled during production builds. +
Ensure that debugging features are not enabled in production builds.
If WebView.setWebContentsDebuggingEnabled(true) is used, ensure that it is guarded by a flag indicating that this is a debug build.
In the code below, the BAD case shows debugging always being enabled,
-whereas the GOOD case only enables debugging if the android:debuggable attribute is set to true.
In the code below, the BAD case shows WebView debugging always being enabled,
+whereas the GOOD case only enables it if the android:debuggable attribute is set to true.