Browse our specialized collection of Android security rules designed to help you write better, more secure Android applications.
To run these rules against your Android codebase:
codepathfinder ci --project /src/project --ruleset cpf/androidWebView JavaScript Enabled
Rule ID: java/android/webview-javascript-enabled
Severity: Medium | CWE: 079
Enabling JavaScript execution in a WebView can result in cross-site scripting attacks.
// ❌ Vulnerable: JavaScript enabled without safeguardsWebView webView = new WebView(context);webView.getSettings().setJavaScriptEnabled(true);
// ✅ Safe: JavaScript disabled by defaultWebView webView = new WebView(context);// JavaScript remains disabledwebView.loadUrl("https://trusted-domain.com");WebView JavaScript Interface
Rule ID: java/android/webview-javascript-interface
Severity: Medium | CWE: 079
Enabling addJavascriptInterface exposes java methods to JavaScript.
// ❌ Vulnerable: Exposing Java interface to JavaScriptwebView.addJavascriptInterface(new JavaScriptInterface(), "Android");
// ✅ Safe: Using modern API methodsif (Build.VERSION.SDK_INT >= Build.VERSION_CODES.KITKAT) { webView.evaluateJavascript("javascript:processData()", null);}WebView Content Access
Rule ID: java/android/webview-set-allow-content-access
Severity: Medium | CWE: 079
Enabling setAllowContentAccess enables content:// access from webpages.
// ❌ Vulnerable: Enabling content accesswebView.getSettings().setAllowContentAccess(true);
// ✅ Safe: Content access disabledWebView webView = new WebView(context);webView.getSettings().setAllowContentAccess(false);// Only load trusted contentWebView File Access
Rule ID: java/android/webview-set-allow-file-access
Severity: Medium | CWE: 079
Enabling setAllowFileAccess enables webview access to file:/// URLs.
// ❌ Vulnerable: Enabling file accesswebView.getSettings().setAllowFileAccess(true);
// ✅ Safe: File access disabledWebView webView = new WebView(context);webView.getSettings().setAllowFileAccess(false);// Use content providers for controlled file accessWebView File URL Access
Rule ID: java/android/webview-set-allow-file-access-from-file-urls
Severity: Medium | CWE: 079
Enabling setAllowFileAccessFromFileURLs leaks sandbox access to file:/// URLs.
// ❌ Vulnerable: Enabling file URL accesswebView.getSettings().setAllowFileAccessFromFileURLs(true);
// ✅ Safe: File URL access disabledWebView webView = new WebView(context);webView.getSettings().setAllowFileAccessFromFileURLs(false);// Implement proper file access controlsFor more information on using Code PathFinder with Android, see our documentation.