Skip to content

Commit 656e406

Browse files
shivasuryashivasurya
authored
added blog post for targeting android framework (#169)
* added blog post for targeting android framework * added content for blog post * added content for blog post
1 parent 8824052 commit 656e406

File tree

3 files changed

+146
-1
lines changed

3 files changed

+146
-1
lines changed

‎docs/public/assets/webview.webp‎

183 KB
Loading

‎docs/src/content/docs/blog/finding-webview-misconfigurations-android.mdx‎

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
---
2+
title: Detecting WebView Misconfigurations in Android With Code-PathFinder
3+
description: "A short blog post about finding WebView misconfigurations in Android with Code-PathFinder"
4+
template: splash
5+
author: "@sshivasurya"
6+
pubDate: "2024-10-20"
7+
---
8+
9+
import PostHogLayout from '../../../layouts/PostHogLayout.astro';
10+
import { Card } from '@astrojs/starlight/components';
11+
12+
<PostHogLayout>
13+
</PostHogLayout>
14+
15+
16+
<Card title="">
17+
<div style=" margin: 2rem auto; padding: 0 1.5rem; max-width: 800px;">
18+
## Introduction
19+
20+
Android WebView is a component that allows you to display web content in your Android application. It's fairly complex to configure and easy to misconfigure. From browsers to
21+
third-party applications, they use powerful APIs to interact with the web, such as sending cookies, setting local storage, setting headers, and more.
22+
In this blog post, we will discuss how to detect WebView misconfigurations in Android with [Code-PathFinder](https://github.com/shivasurya/code-pathfinder).
23+
24+
![Android WebView Illustration](/assets/webview.webp)
25+
26+
### WebView Misconfigurations
27+
28+
- Cross-site scripting
29+
- Enabling content access from WebView JavaScript
30+
- Enabling file access from WebView JavaScript
31+
- Enabling universal file access from WebView JavaScript
32+
- JavaScript settings
33+
- WebView JavaScript interface injection
34+
35+
#### Cross-site scripting
36+
37+
Cross-site scripting (XSS) is a type of security vulnerability that allows an attacker to inject malicious code into a web application. This can be used to steal sensitive information,
38+
such as user credentials, or to take control of the victim's account. WebView poses a couple of methods to execute JavaScript in the context of the WebView, and it doesn't respect the
39+
same-origin policy. Such methods are:
40+
41+
- `loadUrl`
42+
- `loadData`
43+
- `loadDataWithBaseURL`
44+
- `evaluateJavascript`
45+
- `evaluateJavaScriptAsync`
46+
47+
When using these methods, it's important to ensure that the data being passed in is properly sanitized and validated. Additionally, the application should be aware of the context in which
48+
the JavaScript code is being used. Code-PathFinder helps you find the code path where the JavaScript is being executed and the data being passed in is not properly sanitized and validated.
49+
50+
```sql
51+
FROM MethodInvocation AS mi
52+
WHERE
53+
mi.GetName() = "loadUrl" || mi.GetName() = "loadData"
54+
|| mi.GetName() = "loadDataWithBaseURL"
55+
|| mi.GetName() = "evaluateJavascript"
56+
|| mi.GetName() = "evaluateJavaScriptAsync"
57+
SELECT mi, mi.GetEnclosingMethod()
58+
```
59+
60+
61+
#### Enabling Content URL access from WebView
62+
63+
The content protocol allows loading data from a URL. For instance, content:// is used to load data from a file on the device such as images, videos, etc. While this is a useful feature, it can also be
64+
misused to access sensitive data from the application's file system. This can be done by using the `setAllowContentAccess` method of the WebView class. Using Code-PathFinder, you can find the code path where the
65+
`setAllowContentAccess` method is being called.
66+
67+
```sql
68+
FROM MethodInvocation AS mi
69+
WHERE
70+
mi.GetName() = "setAllowContentAccess"
71+
SELECT mi, mi.GetEnclosingMethod()
72+
```
73+
74+
### Enabling File access from WebView JavaScript
75+
76+
The file protocol allows loading data from a file on the device. For instance, file:// is used to load data from a file on the device such as images, videos, etc. While this is a useful feature, it can also be
77+
misused to access sensitive data from the application's file system. This can be done by using the `setAllowFileAccess` method of the WebView class. Using Code-PathFinder, you can find the code path where the
78+
`setAllowFileAccess` and `setAllowFileAccessFromFileURLs` methods are being called.
79+
80+
```sql
81+
FROM MethodInvocation AS mi
82+
WHERE
83+
mi.GetName() = "setAllowFileAccess"
84+
|| mi.GetName() = "setAllowFileAccessFromFileURLs"
85+
SELECT mi, mi.GetEnclosingMethod()
86+
```
87+
88+
### Enabling Universal file access from WebView JavaScript
89+
90+
The `setAllowUniversalAccessFromFileURLs` method allows JavaScript to access the file protocol from any origin. This can be used to access sensitive data from the application's file system. If this WebView setting is enabled,
91+
the web page can access the file system of the device. While this is a useful feature to flexibly access files and content, it seriously poses a security threat when arbitrary website JavaScript is loaded into the frame.
92+
Using Code-PathFinder, you can find the code path where the `setAllowUniversalAccessFromFileURLs` method is being called.
93+
94+
```sql
95+
FROM MethodInvocation AS mi
96+
WHERE
97+
mi.GetName() = "setAllowUniversalAccessFromFileURLs"
98+
SELECT mi, mi.GetEnclosingMethod()
99+
```
100+
101+
### JavaScript settings
102+
103+
JavaScript settings can be used to control the behavior of the WebView. For instance, you can enable or disable JavaScript, enable or disable JavaScript interfaces, enable or disable JavaScript's ability to open windows,
104+
and enable or disable JavaScript's ability to open popups. Using Code-PathFinder, you can find the code path where the `setJavaScriptEnabled` method is being called.
105+
106+
```sql
107+
FROM MethodInvocation AS mi
108+
WHERE
109+
(mi.GetName() = "setJavaScriptEnabled" && "true" in mi.getArgumentName())
110+
|| (mi.GetName() = "setJavaScriptCanOpenWindowsAutomatically" && "true" in mi.getArgumentName())
111+
SELECT mi, mi.GetEnclosingMethod()
112+
```
113+
114+
### JavaScript interfaces
115+
116+
Here comes the most important ⚠️ and exciting part of the WebView. JavaScript interfaces allow you to expose native methods to JavaScript. For instance, you can expose a native method to JavaScript to open a file picker
117+
or execute Java methods. Historically, [JavaScript interfaces](https://labs.withsecure.com/publications/webview-addjavascriptinterface-remote-code-execution) were abused to execute arbitrary code on the device and
118+
attain remote code execution. Using Code-PathFinder, you can find the code path where the `addJavascriptInterface` method is being called.
119+
120+
```sql
121+
predicate isJavaScriptEnabled(method_invocation mi) {
122+
mi.getName() == "addJavascriptInterface"
123+
}
124+
125+
FROM method_invocation AS mi
126+
WHERE isJavaScriptEnabled(mi)
127+
SELECT mi.getName(), "JavaScript interface exposed"
128+
```
129+
130+
The above vulnerability classification is based on the [OWASP Mobile Top 10](https://owasp.org/www-project-mobile-top-10/) and [OWASP Mobile Security Testing Guide](https://owasp.org/www-project-mobile-security-testing-guide/).
131+
132+
### Conclusion
133+
134+
While [Code-PathFinder, the open-source alternative to CodeQL](https://codepathfinder.dev), is a powerful tool for finding security vulnerabilities in Android applications, one can always tweak the queries to filter out false positives
135+
more effectively compared to grep-based scanners like `Semgrep` or `ast-grep`. This is because the taint analysis and source-to-sink analysis are far more powerful than grep-based scanners. Give it a try and file an [issue](https://github.com/shivasurya/code-pathfinder/issues)
136+
if you find any bugs or have any suggestions.
137+
138+
139+
### Contributing to Code-PathFinder OSS
140+
141+
If you are interested in contributing to Code-PathFinder, please check out the [Code-PathFinder](https://github.com/shivasurya/code-pathfinder) repository.
142+
Give it a try and file an issue if you find any bugs or have any suggestions.
143+
</div>
144+
</Card>
145+

‎docs/src/content/docs/blog/index.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ export const allPosts = await getCollection('docs', ({ id, data }) => {
3535
<ul style="list-style-type: none;">
3636
<li> <h3><a href={`/${post.slug}`} style="text-decoration:none">{post.data.title}</a></h3></li>
3737
{post.data.description}
38-
<p style="font-size: 0.8rem;">written by <a href="https://shivasurya.me">Shivasurya</a></p>
38+
<p style="font-size: 0.8rem;">Crafted by <a href="https://x.com/sshivasurya">@sshivasurya</a></p>
3939
<hr />
4040
</ul>
4141
))}

0 commit comments

Comments
 (0)