Skip to content

MASWE-0034: WebViews Allow Access to Local Resources with Untrusted Content

MAS Requirement

The app only allows trusted WebView content to access local resources.

Mappings

MASVS V1: MSTG-PLATFORM-6

MASVS V2: MASVS-PLATFORM-2, MASVS-STORAGE-2, MASVS-CODE-4

CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-669: Incorrect Resource Transfer Between Spheres

Android Risks: webview-unsafe-file-inclusion

Android Core Quality: WebView_Asset_Loader

Overview

This weakness occurs when a WebView is configured to access local resources while also rendering untrusted content, allowing that content to reach files and data outside the web sandbox.

Settings that enable file or content access (e.g. setAllowFileAccess, setAllowFileAccessFromFileURLs, setAllowUniversalAccessFromFileURLs, setAllowContentAccess on Android, or overly broad file read access grants on iOS) let JavaScript running in the WebView read app-private files, traverse the filesystem, or exfiltrate data. Insecure custom resource loading, such as serving internal files through a hand-rolled WebResourceResponse instead of a safe asset loader, can likewise expose protected files to the less-trusted WebView JavaScript context or serve attacker-controllable content from the app's own origin.

Modes of Introduction

  • File Access Enabled with Untrusted Content: Enabling file or content access settings on WebViews that also render untrusted or externally influenced content.
  • Universal Access from File URLs: Allowing universal or file-URL cross-origin access, so a local HTML file can read other local files and send them to remote origins.
  • Insecure Custom Resource Loading: Serving internal files through custom response handlers without path validation, instead of a dedicated asset-loading mechanism with a restricted scope.
  • Overly Broad File Read Grants: Granting the WebView read access to broader directories than the specific content it needs to display.

Impact

  • Compromise of Sensitive Data: Attackers can read and exfiltrate app-private files, such as databases, preferences, or cached tokens, resulting in unauthorized disclosure of user and app data.
  • Authentication or Authorization Bypass: Attackers can steal session material stored in reachable files or WebView storage, resulting in account takeover.

Mitigations

  • Disable File and Content Access: Keep file, file-URL, and content access settings disabled unless strictly required, and never combine them with untrusted content.
  • Use a Safe Asset Loader: Serve local app resources through a dedicated asset-loading mechanism with a fixed, validated scope instead of custom response handlers over arbitrary paths.
  • Scope File Read Access Narrowly: When loading local files, grant read access only to the specific file or directory being displayed.
  • Separate Trusted and Untrusted Content: Render untrusted content only in WebViews with no local resource access and no privileged configuration.

Knowledge

MASTG-KNOW-0018: WebViews MASTG-KNOW-0076: WebViews MASTG-KNOW-0139: WKContentWorld

Tests

MASTG-TEST-0252: References to Local File Access in WebViews MASTG-TEST-0253: Runtime Use of Local File Access APIs in WebViews MASTG-TEST-0251: Runtime Use of Content Provider Access APIs in WebViews MASTG-TEST-0334: Native Code Exposed Through WebViews MASTG-TEST-0250: References to Content Provider Access in WebViews MASTG-TEST-0376: References to Native Bridge APIs in WebViews MASTG-TEST-0336: Runtime Setting of Relaxed WebView File Origin Policies MASTG-TEST-0335: WebView File Origin Access Relaxed by Configuration MASTG-TEST-0377: References to evaluateJavaScript Used as Bridge Reply in WKScriptMessageHandler MASTG-TEST-0379: References to evaluateJavaScript Without Content World Isolation MASTG-TEST-0380: References to evaluateJavaScript Writing Sensitive Data into WebView DOM MASTG-TEST-0333: Overly Broad File Read Access in WebViews MASTG-TEST-0378: References to Password Fields in WebView-Loaded HTML

Best Practices

MASTG-BEST-0010: Use Up-to-Date minSdkVersion MASTG-BEST-0011: Securely Load File Content in a WebView MASTG-BEST-0012: Disable JavaScript in WebViews MASTG-BEST-0013: Disable Content Provider Access in WebViews MASTG-BEST-0049: Restrict and Validate Access to Exported Content Providers MASTG-BEST-0035: Prefer Origin Scoped Messaging Over Legacy JavaScript Bridges MASTG-BEST-0058: Restrict Native Functionality Exposed Through WebView Bridges MASTG-BEST-0033: Securely Load File Content in a WebView MASTG-BEST-0062: Use WKScriptMessageHandlerWithReply to Return Data to JavaScript MASTG-BEST-0061: Use WKContentWorld Isolation for DOM Inspection Scripts MASTG-BEST-0059: Render Sensitive UI as Native Views Over the WebView MASTG-BEST-0060: Use Native Views for Sensitive Text Entry Over a WebView