...
| Code Block | ||
|---|---|---|
| ||
WebView webView = new WebView(this);
setContentView(webView);
...
class JsObject {
private String @JavascriptInterfacesensitiveInformation;
public String toString() { return "injectedObject"sensitiveInformation; }
}
webView.addJavascriptInterface(new JsObject(), "injectedObject");
webView.loadData("", "text/html", null);
webView.loadUrl("http://www.example.com"); |
...
Compliant Solution #1
Compliant code could not call refrain from calling the addJavascriptInterface() method, leaving the WebView in the default safe state of having JavaScript disabled.
| Code Block | ||
|---|---|---|
| ||
WebView webView = new WebView(this); setContentView(webView); ... |
...