Cross-Site Scripting: Inter-Component Communication

[QiAnXinCodeSafe]

VasSonic/sonic-android/sample/src/main/java/com/tencent/sonic/demo/BrowserActivity.java

Lines 71 to 72 in 59936be

	Intent intent = getIntent();
	String url = intent.getStringExtra(PARAM_URL);

VasSonic/sonic-android/sample/src/main/java/com/tencent/sonic/demo/BrowserActivity.java

Lines 111 to 113 in 59936be

	sonicSession = SonicEngine.getInstance().createSession(url, sessionConfigBuilder.build());
	if (null != sonicSession) {
	sonicSession.bindClient(sonicSessionClient = new SonicSessionClientImpl());

VasSonic/sonic-android/sample/src/main/java/com/tencent/sonic/demo/BrowserActivity.java

Line 188 in 59936be

sonicSessionClient.clientReady();

VasSonic/sonic-android/sdk/src/main/java/com/tencent/sonic/sdk/SonicSessionClient.java

Lines 35 to 37 in 59936be

	public void clientReady() {
	if (session != null) {
	session.onClientReady();

VasSonic/sonic-android/sdk/src/main/java/com/tencent/sonic/sdk/StandardSonicSession.java

Line 124 in 59936be

sessionClient.loadUrl(srcUrl, new Bundle());

VasSonic/sonic-android/sample/src/main/java/com/tencent/sonic/demo/SonicSessionClientImpl.java

Lines 40 to 41 in 59936be

	public void loadUrl(String url, Bundle extraData) {
	webView.loadUrl(url);

Sending unvalidated data to a web browser can result in the browser executing malicious code.