|
1 | | -<p>WebViews can be used to display web content as part of a mobile application. A browser engine is used to render and display the content. Like a web |
2 | | -application, a mobile application that uses WebViews can be vulnerable to Cross-Site Scripting if untrusted code is rendered.</p> |
3 | | -<p>If malicious JavaScript code in a WebView is executed this can leak the contents of sensitive files when access to local files is enabled.</p> |
| 1 | +<p>Exposing the Android file system to WebViews is security-sensitive.</p> |
| 2 | +<p>Granting file access to WebViews, particularly through the <code>file://</code> scheme, introduces a risk of local file inclusion vulnerabilities. |
| 3 | +The severity of this risk depends heavily on the specific <code>WebSettings</code> configured. Overly permissive settings can allow malicious scripts |
| 4 | +to access a wide range of local files, potentially exposing sensitive data such as Personally Identifiable Information (PII) or private application |
| 5 | +data, leading to data breaches and other security compromises.</p> |
4 | 6 | <h2>Ask Yourself Whether</h2> |
5 | 7 | <ul> |
6 | | - <li> No local files have to be accessed by the Webview. </li> |
7 | | - <li> The WebView contains untrusted data that could cause harm when rendered. </li> |
| 8 | + <li> You open files that may be created or altered by external sources. </li> |
| 9 | + <li> You open arbitrary URLs from external sources. </li> |
8 | 10 | </ul> |
9 | | -<p>There is a risk if you answered yes to any of those questions.</p> |
| 11 | +<p>There is a risk if you answered yes to any of these questions.</p> |
10 | 12 | <h2>Recommended Secure Coding Practices</h2> |
11 | | -<p>It is recommended to disable access to local files for WebViews unless it is necessary. In the case of a successful attack through a Cross-Site |
12 | | -Scripting vulnerability the attackers attack surface decreases drastically if no files can be read out.</p> |
| 13 | +<p>Avoid opening <code>file://</code> URLs from external sources in WebView components. If your application accepts arbitrary URLs from external |
| 14 | +sources, do not enable this functionality. Instead, utilize <code>androidx.webkit.WebViewAssetLoader</code> to access files, including assets and |
| 15 | +resources, via <code>http(s)://</code> schemes.</p> |
| 16 | +<p>For enhanced security, ensure that the options to load <code>file://</code> URLs are explicitly set to false.</p> |
13 | 17 | <h2>Sensitive Code Example</h2> |
14 | 18 | <pre> |
15 | | -import android.webkit.WebView |
16 | | - |
17 | | -val webView: WebView = findViewById(R.id.webview) |
18 | | -webView.getSettings().setAllowContentAccess(true) // Sensitive |
19 | | -webView.getSettings().setAllowFileAccess(true) // Sensitive |
| 19 | +AndroidView( |
| 20 | + factory = { context -> |
| 21 | + WebView(context).apply { |
| 22 | + webViewClient = WebViewClient() |
| 23 | + settings.apply { |
| 24 | + allowFileAccess = true // Sensitive |
| 25 | + allowFileAccessFromFileURLs = true // Sensitive |
| 26 | + allowUniversalAccessFromFileURLs = true // Sensitive |
| 27 | + allowContentAccess = true // Sensitive |
| 28 | + } |
| 29 | + loadUrl("file:///android_asset/example.html") |
| 30 | + } |
| 31 | + } |
| 32 | +) |
20 | 33 | </pre> |
21 | 34 | <h2>Compliant Solution</h2> |
22 | 35 | <pre> |
23 | | -import android.webkit.WebView |
| 36 | +AndroidView( |
| 37 | + factory = { context -> |
| 38 | + val webView = WebView(context) |
| 39 | + val assetLoader = WebViewAssetLoader.Builder() |
| 40 | + .addPathHandler("/assets/", WebViewAssetLoader.AssetsPathHandler(context)) |
| 41 | + .build() |
| 42 | + |
| 43 | + webView.webViewClient = object : WebViewClient() { |
| 44 | + @RequiresApi(Build.VERSION_CODES.LOLLIPOP) |
| 45 | + override fun shouldInterceptRequest(view: WebView?, request: WebResourceRequest): WebResourceResponse? { |
| 46 | + return assetLoader.shouldInterceptRequest(request.url) |
| 47 | + } |
| 48 | + |
| 49 | + @Suppress("deprecation") |
| 50 | + override fun shouldInterceptRequest(view: WebView?, url: String?): WebResourceResponse? { |
| 51 | + return assetLoader.shouldInterceptRequest(Uri.parse(url)) |
| 52 | + } |
| 53 | + } |
| 54 | + |
| 55 | + webView.settings.apply { |
| 56 | + allowFileAccess = false |
| 57 | + allowFileAccessFromFileURLs = false |
| 58 | + allowUniversalAccessFromFileURLs = false |
| 59 | + allowContentAccess = false |
| 60 | + } |
24 | 61 |
|
25 | | -val webView: WebView = findViewById(R.id.webview) |
26 | | -webView.getSettings().setAllowContentAccess(false) |
27 | | -webView.getSettings().setAllowFileAccess(false) |
| 62 | + webView.loadUrl("https://appassets.androidplatform.net/assets/example.html") |
| 63 | + webView |
| 64 | + } |
| 65 | +) |
28 | 66 | </pre> |
| 67 | +<p>The compliant solution uses <code>WebViewAssetLoader</code> to load local files instead of directly accessing them via <code>file://</code> URLs. |
| 68 | +This approach serves assets over a secure <code><a href="https://appassets.androidplatform.net">https://appassets.androidplatform.net</a></code> URL, |
| 69 | +effectively isolating the WebView from the local file system.</p> |
| 70 | +<p>The file access settings are disabled by default in modern Android versions. To prevent possible security issues in |
| 71 | +<code>Build.VERSION_CODES.Q</code> and earlier, it is still recommended to explicitly set those values to false.</p> |
29 | 72 | <h2>See</h2> |
30 | 73 | <ul> |
31 | | - <li> OWASP - <a href="https://owasp.org/Top10/A03_2021-Injection/">Top 10 2021 Category A3 - Injection</a> </li> |
| 74 | + <li> OWASP - <a href="https://owasp.org/Top10/A01_2021-Broken_Access_Control/">Top 10 2021 Category A1 - Broken Access Control</a> </li> |
| 75 | + <li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">Top 10 2017 Category A3 - Sensitive Data |
| 76 | + Exposure</a> </li> |
32 | 77 | <li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration">Top 10 2017 Category A6 - Security |
33 | 78 | Misconfiguration</a> </li> |
34 | | - <li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)">Top 10 2017 Category A7 - Cross-Site Scripting |
35 | | - (XSS)</a> </li> |
36 | 79 | <li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m8-security-misconfiguration">Mobile Top 10 2024 Category M8 - Security |
37 | 80 | Misconfiguration</a> </li> |
| 81 | + <li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-PLATFORM/">Mobile AppSec Verification Standard - Platform Interaction Requirements</a> |
| 82 | + </li> |
38 | 83 | <li> CWE - <a href="https://cwe.mitre.org/data/definitions/79">CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site |
39 | 84 | Scripting')</a> </li> |
| 85 | + <li> Android Documentation - <a href="https://developer.android.com/privacy-and-security/risks/webview-unsafe-file-inclusion">WebViews - Unsafe File |
| 86 | + Inclusion</a> </li> |
40 | 87 | </ul> |
41 | 88 |
|
0 commit comments