CODEWITHSUNDEEP
androidwebviewxssandroid-security
BhavikKama
BhavikKama

Reputation: 8800

Google Play warning: Your app contains a File-based XSS issue? JavaScript Enable = True

We have recently received an email from google regarding our published app on google play store.

Following is what they have stated in mail.

Hello Google Play Developer,

The apps listed at the end of this email have a WebView File-based Cross-Site Scripting issue which can allow a malicious network to access any file accessible to your app.

What's happening

One or more of your apps contain a File-based Cross-Site Scripting vulnerability that must be fixed. Please refer to the notice on your Play Console for the deadline to fix this vulnerability. After this deadline, updates to affected apps will be blocked if the vulnerability is still present. Your published APK version will remain unaffected.

Action required

WebViews with WebSettings that set either setAllowFileAccessFromFileURLs orsetAllowUniversalAccessFromFileURLs to true must not load any untrusted web content. This includes content from trusted domains that is loaded over HTTP. Malicious web content or networks can inject scripts to redirect the WebView to a malicious file and launch a Cross-Site Scripting attack to access private local files or cookies.

You should prevent this vulnerability in one of the following ways:

Ensure that WebViews do not have dangerous settings - You can update yourandroid:targetSdkVersion in your Manifest to be at least 16 to use safe default settings for WebView. Otherwise, you can callsetAllowFileAccessFromFileURLs(false) andsetAllowUniversalAccessFromFileURLs(false) to ensure that their WebViews are safe.
Ensure that WebViews cannot load file:// URLs or execute JavaScript - You can call setAllowFileAccess(false) to prevent WebViews with dangerous settings from loading file:// URLs or call setJavaScriptEnabled(false) to prevent WebViews with dangerous settings from executing JavaScript code.
Ensure that WebViews with dangerous settings not load untrusted web content - If a WebView needs to enable these dangerous settings, you must ensure that it does not load untrusted web content.
We recommend that you also ensure that WebViews with dangerous settings do not load web content over HTTP. You can set android:usesCleartextTraffic=false or set aNetwork Security Config that disallows HTTP traffic in your Manifest. Alternatively, you can ensure that any WebViews with dangerous settings do not load any URLs with HTTP schemes.

Lastly, you should also ensure that WebViews with dangerous settings do not load URLs obtained from untrusted sources.

Next steps

Update your app using the steps highlighted above.
Sign in to your Play Console and submit the updated version of your app.
Check back after five hours; we will show a warning message if the app hasn't been updated correctly.

Now the issue is We actually loads local html files in our app which needs some javascript interaction as well as need to access local resources so we must need to keep following permission true.

callsetAllowFileAccessFromFileURLs(true). setAllowUniversalAccessFromFileURLs(false). setJavaScriptEnabled(true).

What could be the possible solution for this and how I can securely prevent vulnerabilities in my app?

Upvotes: 2

Views: 4673

Answers (1)

Muhammad Umair
Muhammad Umair

Reputation: 593

Firstly if you are using web view add the following code their:

webView.getSettings().setLoadsImagesAutomatically(true);
webView.getSettings().setJavaScriptEnabled(true);
webView.setInitialScale(1);
webView.getSettings().setDefaultZoom(WebSettings.ZoomDensity.FAR);
webView.getSettings().setLoadWithOverviewMode(true);
webView.getSettings().setUseWideViewPort(true);
webView.getSettings().setBuiltInZoomControls(false);
webView.getSettings().setDisplayZoomControls(false);
webView.getSettings().setDomStorageEnabled(true);
webView.getSettings().setAllowFileAccess(true);

Also you have to add the following code in to manifest.xml:

<meta-data android:name="android.webkit.WebView.EnableSafeBrowsing"
            android:value="true" />

I hope it will resolve you problem.

Upvotes: 3

Related Questions