(THIS CODING RULE OR GUIDELINE IS UNDER CONSTRUCTION)

For API level JELLY_BEAN or below, allowing an app to use the addJavascriptInterface method with untrusted content in a WebView leaves the app vulnerable to scripting attacks using reflection to access public methods from JavaScript.  The method addJavascriptInterface(Object, String) is called from the android.webkit.WebView class. Sensitive data and app control should not be exposed to a scripting attack.

Noncompliant Code Example

This noncompliant code example shows an application that calls the addJavascriptInterface() method, and hence is not secure for API level JELLY_BEAN and lower.

WebView webView = new WebView(this);
setContentView(webView);
...
class JsObject {
    @JavascriptInterface
    public String toString() { return "injectedObject"; }
 }
 webView.addJavascriptInterface(new JsObject(), "injectedObject");
 webView.loadData("", "text/html", null);
 webView.loadUrl("javascript:alert(injectedObject.toString())");

JavaScript can now control the host. Java reflection could be used to access any of the public methods of an injected object, using the permissions of the app.

Compliant Solution #1

Compliant code could not call the addJavascriptInterface() method, leaving the WebView in the default safe state of having JavaScript disabled.

WebView webView = new WebView(this);
setContentView(webView);
...

Compliant Solution #2

Another compliant solution is to specify in the app's manifest that the app is only for API levels JELLY_BEAN_MR1 and above. For these API levels, only public methods that are annotated with JavascriptInterface can be accessed from JavaScript. API level 17 is JELLY_BEAN_MR1.

<manifest>
<uses-sdk android:minSdkVersion="17" />
...

</manifest>

Risk Assessment

Allowing an app to provide access to the addJavascriptInterface method in a WebView which could contain untrusted content may leave it open to scripting attacks that could corrupt the host, for API level JELLY_BEAN and below.

Automated Detection

Automatic detection of a call to the addJavascriptInterface() method in a WebView is straightforward. Automatic detection of if the minimum API is set to JELLY_BEAN_MR1 in the app manifest is straightforward. Determination of whether the WebView could contain untrusted content could be impossible to do in an automated way for some applications.

Bibliography