JAVA.JS.RI : Risky JavaScript Interface (Java)

Summary

An instruction allows JavaScript to invoke operations that are normally reserved for Android applications.

This warning class is only available for Android API version 17 and earlier.

Android API version 17 and earlier present a security risk related to JavaScript execution and the use of addJavascriptInterface(). As described in the Android API documentation for addJavascriptInterface(), it allows JavaScript to invoke operations that are normally reserved for Android applications. This could lead to the execution of untrusted Java code with the application permissions. Moreover, all public methods (including inherited ones) can be accessed. An example exploit is described in an F-Secure Labs (now WithSecure) blog post.

The Android security tips recommend checking the content and behavior of the JavaScript code to be executed. If the JavaScript execution is not required or if the application does not directly use JavaScript within the web view, disable the JavaScript execution.

Properties

WARNING_FILTER += discard class="Risky JavaScript Interface (Java)"

Example

The warnings issued in the following code example will depend on the Android API framework used.

package example.javascriptExecutionChecker;

import android.app.Activity;
import android.os.Bundle;
import android.webkit.WebView;

public class JavascriptExecutionExample extends Activity {

  WebView myWebView;

  public void onCreate(Bundle savedInstanceState) {
      super.onCreate(savedInstanceState);
      myWebView = new WebView(this);
      myWebView.getSettings().setJavaScriptEnabled(true); /* JavaScript Enabled (Java)
                  * warning issued here for Android API version 17 or earlier only
                  * /
      myWebView.addJavascriptInterface(new MyJavaScriptInterface(), "saymyname"); /* Warning issued here depends on Android API version:
                  * - Risky JavaScript Interface (Java) for Android API version 17 or earlier
                  * - Missing JavaScript Entry Point (Java) for Android API version 18 or later
                  * /


      myWebView.loadUrl("file:///html_pages/index.html");
      setContentView(myWebView);
  }

  final class MyJavaScriptInterface {
      MyJavaScriptInterface() { }

      public String myMessage() {
          return "Hello World!";
      }
  }
}

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.

• REPORT_SIMILAR_WARNINGS
• WARNING_FILTER