Description

Detects potential open redirect vulnerabilities in Cordova applications using InAppBrowser.open API. This security issue occurs when untrusted or unvalidated URLs are passed to cordova.InAppBrowser.open(), which could allow attackers to redirect users to malicious websites.

Detection Strategy

• Identifies calls to cordova.InAppBrowser.open in the JavaScript code

• Checks if the first argument (URL parameter) passed to the open() function comes from an untrusted source

• Reports a vulnerability when the URL parameter is derived from user input or other untrusted sources without proper validation

Vulnerable code example

function openExternalUrl() {
    const urlParams = new URLSearchParams(window.location.search);
    const targetUrl = urlParams.get('redirect');
    // VULNERABLE: Opens external URL without validation, allowing malicious redirects
    cordova.InAppBrowser.open(targetUrl, '_system');
}

✅ Secure code example

function openExternalUrl() {
    const urlParams = new URLSearchParams(window.location.search);
    const targetUrl = urlParams.get('redirect');
    const allowedDomains = ['trusted-domain.com', 'api.trusted-domain.com'];
    
    try {
        const url = new URL(targetUrl);
        // Check if URL hostname matches any allowed domain...