Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign upJava: CWE-749 Unsafe resource loading in Android WebView leaking to injection attacks #124
Labels
Comments
luchua-bc
changed the title
|
Your submission is now in status SecLab review. For information, the evaluation workflow is the following: |
|
Your submission is now in status CodeQL review. For information, the evaluation workflow is the following: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
CVE ID(s)
List the CVE ID(s) associated with this vulnerability. GitHub will automatically link CVE IDs to the GitHub Advisory Database.
Report
Describe the vulnerability. Provide any information you think will help GitHub assess the impact your query has on the open source community.
Android WebViews that allow loading urls controlled by external inputs and whose JavaScript interface is enabled are potentially vulnerable to cross-site scripting and sensitive resource disclosure attacks.
In addition, WebViews whose settings have setAllowFileAccessFromFileURLs or setAllowUniversalAccessFromFileURLs enabled are extremely vulnerable to cross-site scripting attacks, either accessing arbitrary local files including WebView cookies, session tokens, and private app data or even credentials used on arbitrary web sites.
A new query has been created to handle these two scenarios. And a test case has been added to facilitate testing and future regression testing. Stubs of frequently accessed Android programs were added too, which facilitates the development of new Android related queries.
Related PR is #3706