hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 03:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Require JS enabled even when cross-origin access is enabled in the webviews

Browse Source
This commit is contained in:
Tony Torralba
2021-05-10 09:45:59 +02:00
parent 6884edf52a
commit c70503142f
2 changed files with 28 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
java/ql/test/query-tests/security/CWE-749/app/UnsafeAndroidAccess.java
View File

@@ -15,6 +15,7 @@ public class UnsafeAndroidAccess extends Activity {
testUniversalFileAccessEnabledWebView();
testFileAccessEnabledWebView();
testSafeWebView();
testCrossOriginEnabledJsDisabledWebView();
}
private void testJavaScriptEnabledWebView() {
@@ -39,6 +40,7 @@ public class UnsafeAndroidAccess extends Activity {
private void testUniversalFileAccessEnabledWebView() {
WebView wv = (WebView) findViewById(R.id.my_webview);
WebSettings webSettings = wv.getSettings();
webSettings.setJavaScriptEnabled(true);
webSettings.setAllowUniversalAccessFromFileURLs(true);
wv.setWebViewClient(new WebViewClient() {
@@ -58,6 +60,7 @@ public class UnsafeAndroidAccess extends Activity {
private void testFileAccessEnabledWebView() {
WebView wv = (WebView) findViewById(R.id.my_webview);
WebSettings webSettings = wv.getSettings();
webSettings.setJavaScriptEnabled(true);
webSettings.setAllowFileAccessFromFileURLs(true);
wv.setWebViewClient(new WebViewClient() {
@@ -90,4 +93,25 @@ public class UnsafeAndroidAccess extends Activity {
wv.loadUrl("https://www.mycorp.com/" + thisUrl); // Safe
wv.loadUrl("https://www.mycorp.com"); // Safe
}
}
private void testCrossOriginEnabledJsDisabledWebView() {
WebView wv = (WebView) findViewById(-1);
WebSettings webSettings = wv.getSettings();
webSettings.setAllowUniversalAccessFromFileURLs(true);
webSettings.setAllowFileAccessFromFileURLs(true);
wv.setWebViewClient(new WebViewClient() {
@Override
public boolean shouldOverrideUrlLoading(WebView view, String url) {
view.loadUrl(url);
return true;
}
});
String thisUrl = getIntent().getExtras().getString("url");
wv.loadUrl(thisUrl); // Safe
wv.loadUrl("https://www.mycorp.com/" + thisUrl); // Safe
wv.loadUrl("https://www.mycorp.com"); // Safe
}
}