(THIS CODING RULE OR GUIDELINE IS UNDER CONSTRUCTION)

Allowing web apps to use JavaScript leaves For API level JELLY_BEAN or below, allowing an app to use the addJavascriptInterface method with untrusted content in a WebView leaves the app vulnerable to scripting attacks such as cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks.  By default, JavaScript is disabled in WebView.  However, it is possible to enable it by using the attacks using reflection to access public methods from JavaScript.  Untrusted content examples include content from any HTTP URL (as opposed to HTTPS) and user-provided content. The method addJavascriptInterface(Object, String) is called from the android.webkit.WebView class. Doing so is dangerous. Sensitive or personal data and app control should not be exposed to a JavaScript interface. Also, code received via such an interface cannot be trusted and it could corrupt the network or server.scripting attacks.

Noncompliant Code Example

This noncompliant code example shows an application that calls the addJavascriptInterface() method, and hence is not secure for API level JELLY_BEAN and lower.

WebView webView = new WebView(this);
setContentView(webView);
...
class JsObject {
     private String sensitiveInformation;

     @JavascriptInterface...
     public String toString() { return "injectedObject"sensitiveInformation; }
 
}
 webView.addJavascriptInterface(new JsObject(), "injectedObject");
 webView.loadData("", "text/html", null);
 webView.loadUrl("javascript:alert(injectedObject.toString())http://www.example.com");

JavaScript can now control the host. In particular, Java reflection could be used to access the fields of an injected objectany of the public methods of an injected object, using the permissions of the app.

Compliant Solution #1

Compliant code should not call could refrain from calling the addJavascriptInterface() method, leaving the WebView in the default safe state of having JavaScript disabled.

WebView webView = new WebView(this);
setContentView(webView);
...

Compliant Solution #2

Another compliant solution is to specify in the app's manifest that the app is only for API levels JELLY_BEAN_MR1 and above. For these API levels, only public methods that are annotated with JavascriptInterface can be accessed from JavaScript. API level 17 is JELLY_BEAN_MR1.

<manifest>
<uses-sdk android:minSdkVersion="17" />
...

</manifest>

Applicability

Android Version Applicability 

Applies to Android API versions 16 (JELLY_BEAN) and below.

Risk Assessment

Allowing an app to use JavaScript to provide access to the addJavascriptInterface method in a WebView which could contain untrusted content may leave it open to scripting attacks that could corrupt the host, for API level JELLY_BEAN and below.

Automated Detection

Automatic detection of a call to the addJavascriptInterface() method in a WebView is straightforward. Similarly, it is straightforward to automatically ensure that the minimum API is set to JELLY_BEAN_MR1 in the app manifest. Automatic determination of whether the WebView could contain untrusted content may be impossible for some applications.

Related Guidelines

Bibliography

...

Image Modified Image Modified Image Modified