Skip to main content

Insecure service configuration - Webview

Need​

Secure service configuration for Webview

Context​

  • Usage of Swift for iOS and macOS app development
  • Usage of UIKit for building modern and responsive user interfaces
  • Usage of WebKit for rendering web content and building web browsers

Description​

Non compliant code​

import UIKit
import WebKit

class ViewController: UIViewController, WKNavigationDelegate {

    var webView: WKWebView!

    override func loadView() {
        webView = WKWebView()
        webView.navigationDelegate = self
        view = webView
    }

    override func viewDidLoad() {
        super.viewDidLoad()

        // Enable JavaScript
        webView.configuration.preferences.javaScriptEnabled = true

        let url = URL(string: "https://www.example.com")!
        webView.load(URLRequest(url: url))
        webView.allowsBackForwardNavigationGestures = true
    }
}

The above Swift code is for a simple iOS mobile application that uses a WebView to display web content. The WebView is configured to enable JavaScript using the javaScriptEnabled property.

The loadView() function is overridden to create a WKWebView instance and set it as the view of the UIViewController. The navigationDelegate property is set to self so that the view controller can respond to navigation events in the WebView.

In the viewDidLoad() function, which is called after the view controller's view is loaded into memory, the javaScriptEnabled property of the WebView's configuration's preferences is set to true. This means that JavaScript is enabled in the WebView, which is not recommended because it can potentially expose the application to Cross-Site Scripting (XSS) attacks.

The WebView is then directed to load a URL and the allowsBackForwardNavigationGestures property is set to true to allow the user to navigate back and forward through their history in the WebView using gestures.

This code is vulnerable because it enables JavaScript in the WebView, which can increase the risk of XSS attacks. An attacker could potentially inject malicious JavaScript code into the WebView, which would then be executed in the context of the application. This could lead to a variety of attacks, such as stealing sensitive information or performing actions on behalf of the user.

Steps​

  • Disable JavaScript in the WebView configuration.
  • Ensure that JavaScript is only enabled for trusted sources.
  • Implement input validation and output encoding to prevent XSS attacks.
  • Regularly update the WebView component to benefit from security patches and fixes.

Compliant code​

import UIKit
import WebKit

class ViewController: UIViewController, WKNavigationDelegate {

    var webView: WKWebView!

    override func loadView() {
        webView = WKWebView()
        webView.navigationDelegate = self
        view = webView
    }

    override func viewDidLoad() {
        super.viewDidLoad()

        // Disable JavaScript
        webView.configuration.preferences.javaScriptEnabled = false

        let url = URL(string: "https://www.example.com")!
        webView.load(URLRequest(url: url))
        webView.allowsBackForwardNavigationGestures = true
    }
}

The updated code disables JavaScript in the WebView configuration by setting webView.configuration.preferences.javaScriptEnabled to false. This is a crucial step in preventing potential Cross-Site Scripting (XSS) attacks, as it restricts the execution of JavaScript within the WebView.

However, disabling JavaScript might not be feasible in all scenarios, especially if your application relies on JavaScript for certain functionalities. In such cases, it's recommended to enable JavaScript only for trusted sources. This can be achieved by implementing a whitelist of trusted URLs and only enabling JavaScript for these URLs.

In addition to this, it's important to implement input validation and output encoding to further prevent XSS attacks. Input validation involves checking and sanitizing any user input to ensure it does not contain malicious scripts. Output encoding involves encoding user input before displaying it on the WebView to ensure any scripts contained in the input are not executed.

Lastly, it's recommended to regularly update the WebView component to benefit from security patches and fixes. This can help in mitigating any known vulnerabilities in the WebView component.

References​

Last updated on