(THIS CODING RULE OR GUIDELINE IS UNDER CONSTRUCTION)

For API level JELLY_BEAN or below, allowing an app to use the addJavascriptInterface method with untrusted content in a WebView leaves WebView leaves the app vulnerable to scripting attacks using reflection to access public methods from JavaScript.  Untrusted content examples include content from any HTTP URL (as opposed to HTTPS) and user-provided content. The method addJavascriptInterface(Object, String) is called from the android.webkit.WebView class. Sensitive data and app control should not be exposed to a scripting attack. Also, code received via such an interface cannot be trusted and it could corrupt the network or server.attacks.

Noncompliant Code Example

This noncompliant code example shows an application that calls the addJavascriptInterface() method, and hence is not secure for API level JELLY_BEAN and lower.

WebView webView = new WebView(this);
setContentView(webView);
...
class JsObject {
     private String sensitiveInformation;

     @JavascriptInterface...
     public String toString() { return "injectedObject"sensitiveInformation; }
 
}
 webView.addJavascriptInterface(new JsObject(), "injectedObject");
 webView.loadData("", "text/html", null);
 webView.loadUrl("javascript:alert(injectedObject.toString())http://www.example.com");

JavaScript can now control the host. Java reflection could be used to access any of the public methods of an injected object, using the permissions of the app.

Compliant Solution #1

Compliant code could not call refrain from calling the addJavascriptInterface() method, leaving the WebView in the default safe state of having JavaScript disabled.

WebView webView = new WebView(this);
setContentView(webView);
...

Compliant Solution #2

Another compliant solution is to specify in the app's manifest that the app is only for API levels JELLY_BEAN_MR1 and above. For these API levels, only public methods that are annotated with JavascriptInterface can be accessed from JavaScript. API level 17 is JELLY_BEAN_MR1.

<manifest>
<uses-sdk android:minSdkVersion="17" />
...

</manifest>

Applicability

Android Version Applicability 

Applies to Android API versions 16 (JELLY_BEAN) and below.

Risk Assessment

Allowing an app to use JavaScript to provide access to the addJavascriptInterface method in a WebView which could contain untrusted content may leave it open to scripting attacks that could corrupt the host, for API level JELLY_BEAN and below.

Automated Detection

Automatic detection of a call to the addJavascriptInterface() method in a WebView is straightforward. Automatic detection of if WebView is straightforward. Similarly, it is straightforward to automatically ensure that the minimum API is set to JELLY_BEAN_MR1 in the app manifest is straightforward. Determination Automatic determination of whether the WebView could contain untrusted content could be impossible to do in an automated way may be impossible for some applications.

Related Guidelines

Bibliography

...