hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 11:16:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Java: Query for Android WebView File Access

Browse Source 
Query for Android WebView file access settings
This commit is contained in:
Ed Minnix
2022-11-08 21:41:18 -05:00
parent 8b11e98d42
commit b9c2ee75be
4 changed files with 85 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

57
java/ql/src/Security/CWE/CWE-200/AndroidWebViewSettingsFileAccess.qhelp Normal file
View File

@@ -0,0 +1,57 @@
<!DOCTYPE qhelp PUBLIC
"-//Semmle//qhelp//EN"
"qhelp.dtd">
<qhelp>
<overview>
<p>
File access in an Android WebView can expose the device's file system to
the JavaScript running in the WebView. If there are vulnerabilities in the
JavaScript, file access may allow an attacker to access or steal the
user's data.
</p>
</overview>
<recommendation>
<p>When possible, you should disallow file access by setting the following settings to <code>false</code>:</p>
<ul>
<li><code>setAllowFileAccess</code></li>
<li><code>setAllowFileAccessFromFileURLs</code></li>
<li><code>setAllowUniversalAccessFromFileURLs</code></li>
</ul>
</recommendation>
<example>
<p>In the following (bad) example, the WebView is configured with the settings
which would allow local file access.</p>
<sample src="WebViewFileAccessUnsafe.java"/>
<p>In the following (good) example, the WebView is configured to disallow file access.</p>
<sample src="WebViewFileAccessSafe.java"/>
</example>
<references>
<li>
Android documentation: <a href="https://developer.android.com/reference/android/webkit/WebSettings#setAllowFileAccess(boolean)"><code>WebSettings.setAllowFileAccess</code></a>.
</li>
<li>
Android documentation: <a href="https://developer.android.com/reference/android/webkit/WebSettings#setAllowFileAccessFromFileURLs(boolean)"><code>WebSettings.setAllowFileAccessFromFileURLs</code></a>.
</li>
<li>
Android documentation: <a href="https://developer.android.com/reference/android/webkit/WebSettings#setAllowUniversalAccessFromFileURLs(boolean)"><code>WebSettings.setAllowUniversalAccessFromFileURLs</code></a>.
</li>
<li>
File access from URLs is enabled for WebView: <a href="https://oversecured.com/vulnerabilities#Android/File_access_from_file_URLs_is_enabled_for_WebView">File access for URLs is enabled for WebView</a>.
</li>
<li>
File access is enabled for WebView: <a href="https://oversecured.com/vulnerabilities#Android/File_access_is_enabled_for_WebView">File access is enabled for WebView</a>.
</li>
<li>
Universal file access from file URLs is enabled for WebView: <a href="https://oversecured.com/vulnerabilities#Android/Universal_file_access_from_file_URLs_is_enabled_for_WebView">Universal file access from file URLs is enabled for WebView</a>.
</li>
</references>
</qhelp>

18
java/ql/src/Security/CWE/CWE-200/AndroidWebViewSettingsFileAccess.ql Normal file
View File

@@ -0,0 +1,18 @@
/**
* @name Android WebSettings file access
* @kind problem
* @id java/android-websettings-file-access
* @problem.severity warning
* @security-severity 6.5
* @precision high
* @tags security
* external/cwe/cwe-200
*/
import java
import semmle.code.java.frameworks.android.WebView
from MethodAccess ma
where ma.getMethod() instanceof CrossOriginAccessMethod
select ma, "WebView setting $@ may allow for unauthorized access of sensitive information.", ma,
ma.getMethod().getName()

5
java/ql/src/Security/CWE/CWE-200/WebViewFileAccessSafe.java Normal file
View File

@@ -0,0 +1,5 @@
WebSettings settings = view.getSettings();
settings.setAllowFileAccess(false);
settings.setAllowFileAccessFromURLs(false);
settings.setAllowUniversalAccessFromURLs(false);

5
java/ql/src/Security/CWE/CWE-200/WebViewFileAccessUnsafe.java Normal file
View File

@@ -0,0 +1,5 @@
WebSettings settings = view.getSettings();
settings.setAllowFileAccess(true);
settings.setAllowFileAccessFromURLs(true);
settings.setAllowUniversalAccessFromURLs(true);