Java


JAVA.JS.MEP : Missing JavaScript Entry Point (Java)

Summary

An interface is passed as a parameter to WebView.addJavascriptInterface(), but has no public methods annotated as @JavascriptInterface.

This warning class is only available for Android API version 18 and higher.

In Android API version 18 and higher, only trusted public methods that are annotated with @JavascriptInterface can be accessed from JavaScript. If an object does not have any public methods annotated as @JavascriptInterface then it is useless in a JavaScript execution because it does not have an entry point.

Properties

Class Name Missing JavaScript Entry Point (Java)
Significance reliability
Mnemonic JAVA.JS.MEP
Categories
CWE CWE:749 Exposed Dangerous Method or Function
Availability Available for Java only.

Android Only. Warnings of this class will only be reported in Android code: that is, code that uses the Android API.

Enabling Checks for this warning class are enabled by default. To disable them, add the following WARNING_FILTER rule to the project configuration file.
WARNING_FILTER += discard class="Missing JavaScript Entry Point (Java)"

Example

The warnings issued in the following code example will depend on the Android API framework used.

package example.javascriptExecutionChecker;

import android.app.Activity;
import android.os.Bundle;
import android.webkit.WebView;

public class JavascriptExecutionExample extends Activity {

  WebView myWebView;

  public void onCreate(Bundle savedInstanceState) {
      super.onCreate(savedInstanceState);
      myWebView = new WebView(this);
      myWebView.getSettings().setJavaScriptEnabled(true); /* JavaScript Enabled (Java)
                  * warning issued here for Android API version 17 or earlier only
                  * /
      myWebView.addJavascriptInterface(new MyJavaScriptInterface(), "saymyname"); /* Warning issued here depends on Android API version:
                  * - Risky JavaScript Interface (Java) for Android API version 17 or earlier
                  * - Missing JavaScript Entry Point (Java) for Android API version 18 or later
                  * /


      myWebView.loadUrl("file:///html_pages/index.html");
      setContentView(myWebView);
  }

  final class MyJavaScriptInterface {
      MyJavaScriptInterface() { }

      public String myMessage() {
          return "Hello World!";
      }
  }
}

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.