Description

Detects Android WebView configurations where JavaScript is enabled together with settings for file or content access.

Detection Strategy

• Reads the decompiled code of the classes whose name contains Activity

• Checks if that code mentions setJavaScriptEnabled(true) or setJavaScriptEnabled(1), and also mentions setAllowContentAccess, setAllowFileAccess, setAllowFileAccessFromFileURLs or setAllowUniversalAccessFromFileURLs, whatever value they are given

• Reports a vulnerability when both are found