| 130 | # ------------------------------------------------------------------ |
| 131 | |
| 132 | def check_webview(self) -> list: |
| 133 | checks = [ |
| 134 | { |
| 135 | "id": "WEBVIEW_JS_INTERFACE", |
| 136 | "title": "JavaScript Interface Exposed to WebView", |
| 137 | "severity": "CRITICAL", |
| 138 | "owasp": "M4: Insufficient Input/Output Validation", |
| 139 | "description": ( |
| 140 | "addJavascriptInterface() exposes Java objects to JavaScript. " |
| 141 | "Any JavaScript running in the WebView (including injected scripts " |
| 142 | "via XSS) can call these methods, potentially leading to arbitrary " |
| 143 | "code execution." |
| 144 | ), |
| 145 | "pattern": r'addJavascriptInterface\s*\(', |
| 146 | }, |
| 147 | { |
| 148 | "id": "WEBVIEW_SSL_IGNORE", |
| 149 | "title": "WebView Ignores SSL Errors", |
| 150 | "severity": "CRITICAL", |
| 151 | "owasp": "M5: Insecure Communication", |
| 152 | "description": ( |
| 153 | "Overriding onReceivedSslError() and calling handler.proceed() " |
| 154 | "disables SSL certificate validation, making the app vulnerable " |
| 155 | "to MITM attacks. The app will trust any certificate." |
| 156 | ), |
| 157 | "pattern": r'onReceivedSslError', |
| 158 | }, |
| 159 | { |
| 160 | "id": "WEBVIEW_UNIV_ACCESS", |
| 161 | "title": "WebView Universal File Access Enabled", |
| 162 | "severity": "CRITICAL", |
| 163 | "owasp": "M9: Insecure Data Storage", |
| 164 | "description": ( |
| 165 | "setAllowUniversalAccessFromFileURLs(true) allows JavaScript in " |
| 166 | "file:// URLs to read any file accessible to the app, including " |
| 167 | "private data, tokens, and databases." |
| 168 | ), |
| 169 | "pattern": r'setAllowUniversalAccessFromFileURLs\s*\(\s*true', |
| 170 | }, |
| 171 | { |
| 172 | "id": "WEBVIEW_JS_ENABLED", |
| 173 | "title": "JavaScript Enabled in WebView", |
| 174 | "severity": "HIGH", |
| 175 | "owasp": "M4: Insufficient Input/Output Validation", |
| 176 | "description": ( |
| 177 | "Enabling JavaScript in WebView opens attack surface for XSS. " |
| 178 | "Combine only with strict Content-Security-Policy and input " |
| 179 | "sanitisation. Avoid if the app does not require it." |
| 180 | ), |
| 181 | "pattern": r'setJavaScriptEnabled\s*\(\s*true', |
| 182 | }, |
| 183 | { |
| 184 | "id": "WEBVIEW_FILE_ACCESS", |
| 185 | "title": "WebView File Access Enabled", |
| 186 | "severity": "HIGH", |
| 187 | "owasp": "M9: Insecure Data Storage", |
| 188 | "description": ( |
| 189 | "setAllowFileAccess(true) or setAllowFileAccessFromFileURLs(true) " |