Java: Query for detecting enabling Javascript in Android WebSettings

[egregius313]

Add a query for detecting the enabling of JavaScript execution in Android WebViews.

[github-actions]

QHelp previews:

java/ql/src/Security/CWE/CWE-079/AndroidWebViewSettingsEnabledJavaScript.qhelp

Android WebView JavaScript settings

Enabling JavaScript in an Android WebView allows for the running of JavaScript code in the context of the running application. This opens the possibility for cross-site scripting if the attacker can inject arbitrary JavaScript.

For example, if your application's WebView allows for visitng web pages which you do not trust, it is possible for an attacker to lead the user to a page which loads malicious JavaScript.

You can enable or disbale Javascript execution using the setJavaScriptEnabled method of the settings of a WebView.

Recommendation

If Javascript does not need to be enabled, call setJavaScriptEnabled(false) on the settings of the WebView.

If JavaScript is necessary, only load content from trusted servers using encrypted channels, such as HTTPS with certificate verification.

Example

In the following (bad) example, a WebView has JavaScript enabled in its settings.

WebSettings settings = webview.getSettings();
settings.setJavaScriptEnabled(true);

In the following (good) example, a WebView explicitly disallows JavaScript execution.

WebSettings settings = webview.getSettings();
settings.setJavaScriptEnabled(false);

References

• Android documentation: setJavaScriptEnabled
• Common Weakness Enumeration: CWE-79.

[atorralba]

I added some comments. Also, this will need tests.

[atorralba]

The attack vector isn't only a MitM attack: if the application loads untrusted content in the WebView, attackers could provide malicious JavaScript to be executed as well.

[atorralba]

Maybe mention that this is false by default, and thus it would also suffice to not explicitly enable it?