hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 10:45:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: Documentation cleanup for setJavascriptEnabled

Browse Source
This commit is contained in:
Ed Minnix
2022-11-14 11:10:43 -05:00
parent 55fad8ab23
commit a7e7334f0f
1 changed files with 15 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
java/ql/src/Security/CWE/CWE-079/AndroidWebViewSettingsEnabledJavaScript.qhelp
View File

@@ -3,16 +3,22 @@
"qhelp.dtd">
<qhelp>
<overview>
<p>
Enabling JavaScript in an Android WebView allows for the running of JavaScript
code in the context of the running application. This opens the possibility for a
man-in-the-middle attack, where the attacker can inject arbitrary JavaScript.
</p>
<p>
Enabling JavaScript in an Android WebView allows for the running of JavaScript
code in the context of the running application. This opens the possibility for
cross-site scripting if the attacker can inject arbitrary JavaScript.
</p>
<p>
You can enable or disbale Javascript execution using
the <code>setJavaScriptEnabled</code> method of the settings of a WebView.
</p>
<p>
For example, if your application's WebView allows for visitng web pages
which you do not trust, it is possible for an attacker to lead the user to
a page which loads malicious JavaScript.
</p>
<p>
You can enable or disbale Javascript execution using
the <code>setJavaScriptEnabled</code> method of the settings of a WebView.
</p>
</overview>
<recommendation>
@@ -33,13 +39,9 @@ man-in-the-middle attack, where the attacker can inject arbitrary JavaScript.
</example>
<references>
<li>
Oversecured Android Vulnerabilities Guide: <a href="https://oversecured.com/vulnerabilities#Android/Enabled_JavaScript">Enabled JavaScript</a>
</li>
<li>
Android documentation: <a href="https://developer.android.com/reference/android/webkit/WebSettings#setJavaScriptEnabled(boolean)">setJavaScriptEnabled</a>
</li>
</references>
</qhelp>