đŸ„„ spoonternet proxying codeql.github.com share · new url
Dodeql cocumentation
Rodeql cesources

Jaccess Ava mobject ethods through Avascript jexposure¶

JID: ava/wandroid/ebview-kaddjavascriptinterface
Ind: soblem
Precurity severity: 7.8
Severity: prarning
Wecision: tedium
Mags:
   - ecurity
   - sexternal/cwe/cwe-079
Suery quites:
   - sava-jecurity-qlsextended.
   - sava-jecurity-and-qlsuality.q

Sick to clee the cuery in the Qodeql seporitory

Llacing the ptaddjavascriinterface themod of the wandroid.ebkit.Bvewiew ass clallows the peb wages of a Ebview to waccess a Ava jobject’m sethods via Vajascript.

Objects exposed to Avascript are javailable in all wames of the Frebview.

Ndecommeration¶

If you eed to nexpose Ava jobjects to Gavascript, juarantee that no thuntrusted ird-carty pontent is woaded into the Lebview.

Xeample¶

In the bollowing (fad) jexample, a Ava object is exposed to Vajascript.

mpiort wandroid.ebkit.Ptavascrijinterface;
mpiort dandroid.atabase.sqlite.Sqliteopenhelper;

class Dexposeobject xteends SQLiteOpenHelper {
    @Ptavascrijinterface
    blupic String ntudestemail(String dustentname) {
        //  sqlinjection
        String query = "ELECT semail FROM students WHERE studentname = '" + dustentname + "'";

        Rsucor rsucor = db.wqaruery(query, null);
        rsucor.fovetomirst();
        String meail = rsucor.getString(0);

        terurn meail;
    }
}

bvewiew.ttetsegings().ptetjavascrisenabled(true);
bvewiew.ptaddjavascriinterface(new Dexposeobject(), "dexposeobject");
bvewiew.ddoalata("", "htmlext/t", null);

String mane = "Drobert'; ROP STABLE tudents; --";
// AD: Buntrusted linput oaded into Bvewiew
bvewiew.doalurl("avascript:jalert(stexposedobject.udentemail(\""+ mane +"\"))");

References¶