Java

JAVA.JS.RI : Risky JavaScript Interface (Java)

要旨

An instruction allows JavaScript to invoke operations that are normally reserved for Android applications.

This warning class is only available for Android API version 17 and earlier.

Android API version 17 and earlier present a security risk related to JavaScript execution and the use of addJavascriptInterface(). As described in the Android API documentation for addJavascriptInterface(), it allows JavaScript to invoke operations that are normally reserved for Android applications. This could lead to the execution of untrusted Java code with the application permissions. Moreover, all public methods (including inherited ones) can be accessed. An example exploit is described in an F-Secure Labs (now WithSecure) blog post.

The Android security tips recommend checking the content and behavior of the JavaScript code to be executed. If the JavaScript execution is not required or if the application does not directly use JavaScript within the web view, disable the JavaScript execution.

プロパティ

クラス名 Risky JavaScript Interface (Java)
日本語クラス名 Risky JavaScript Interface (Java)
クラス分類 セキュリティ (security)
ニーモニック JAVA.JS.RI
カテゴリー
CWE CWE:749 Exposed Dangerous Method or Function
CERT-Java CERT-Java:DRD13 Do not provide addJavascriptInterface method access in a WebView which could contain untrusted content. (API level JELLY_BEAN or below)
対応言語 Java で利用可能です。
有効/無効設定 このワーニングクラスのチェックはデフォルトで有効になっています。チェックを無効にするにはプロジェクト設定ファイル （configuration file）に以下の WARNING_FILTER ルールを追加してください。 
WARNING_FILTER += discard class="Risky JavaScript Interface (Java)"

例

The warnings issued in the following code example will depend on the Android API framework used. 

package example.javascriptExecutionChecker;

import android.app.Activity;
import android.os.Bundle;
import android.webkit.WebView;

public class JavascriptExecutionExample extends Activity {

  WebView myWebView;

  public void onCreate(Bundle savedInstanceState) {
      super.onCreate(savedInstanceState);
      myWebView = new WebView(this);
      myWebView.getSettings().setJavaScriptEnabled(true); /* JavaScript Enabled (Java)
                  * warning issued here for Android API version 17 or earlier only
                  * /
      myWebView.addJavascriptInterface(new MyJavaScriptInterface(), "saymyname"); /* Warning issued here depends on Android API version:
                  * - Risky JavaScript Interface (Java) for Android API version 17 or earlier
                  * - Missing JavaScript Entry Point (Java) for Android API version 18 or later
                  * /


      myWebView.loadUrl("file:///html_pages/index.html");
      setContentView(myWebView);
  }

  final class MyJavaScriptInterface {
      MyJavaScriptInterface() { }

      public String myMessage() {
          return "Hello World!";
      }
  }
}

関連のある設定ファイルパラメータ

設定ファイルの以下のパラメータがこのワーニングクラスのチェックに影響します。