android - Google Play 警告 : Your app contains a File-based XSS issue? JavaScript 启用 = True

Question

我们最近收到了一封来自 Google 的电子邮件，内容涉及我们在 Google Play 商店上发布的应用程序。

以下是他们在邮件中的说明。

Hello Google Play Developer,

The apps listed at the end of this email have a WebView File-based Cross-Site Scripting issue which can allow a malicious network to access any file accessible to your app.

What's happening

One or more of your apps contain a File-based Cross-Site Scripting vulnerability that must be fixed. Please refer to the notice on your Play Console for the deadline to fix this vulnerability. After this deadline, updates to affected apps will be blocked if the vulnerability is still present. Your published APK version will remain unaffected.

Action required

WebViews with WebSettings that set either setAllowFileAccessFromFileURLs orsetAllowUniversalAccessFromFileURLs to true must not load any untrusted web content. This includes content from trusted domains that is loaded over HTTP. Malicious web content or networks can inject scripts to redirect the WebView to a malicious file and launch a Cross-Site Scripting attack to access private local files or cookies.

You should prevent this vulnerability in one of the following ways:

Ensure that WebViews do not have dangerous settings - You can update yourandroid:targetSdkVersion in your Manifest to be at least 16 to use safe default settings for WebView. Otherwise, you can callsetAllowFileAccessFromFileURLs(false) andsetAllowUniversalAccessFromFileURLs(false) to ensure that their WebViews are safe.
Ensure that WebViews cannot load file:// URLs or execute JavaScript - You can call setAllowFileAccess(false) to prevent WebViews with dangerous settings from loading file:// URLs or call setJavaScriptEnabled(false) to prevent WebViews with dangerous settings from executing JavaScript code.
Ensure that WebViews with dangerous settings not load untrusted web content - If a WebView needs to enable these dangerous settings, you must ensure that it does not load untrusted web content.
We recommend that you also ensure that WebViews with dangerous settings do not load web content over HTTP. You can set android:usesCleartextTraffic=false or set aNetwork Security Config that disallows HTTP traffic in your Manifest. Alternatively, you can ensure that any WebViews with dangerous settings do not load any URLs with HTTP schemes.

Lastly, you should also ensure that WebViews with dangerous settings do not load URLs obtained from untrusted sources.

Next steps

Update your app using the steps highlighted above.
Sign in to your Play Console and submit the updated version of your app.
Check back after five hours; we will show a warning message if the app hasn't been updated correctly.

现在的问题是，我们实际上在应用程序中加载本地 html 文件，这需要一些 javascript 交互，并且需要访问本地资源，因此我们必须保持以下权限为 true。

callsetAllowFileAccessFromFileURLs(true). setAllowUniversalAccessFromFileURLs(false). setJavaScriptEnabled(true).

可能的解决方案是什么以及如何安全地防止应用程序中的漏洞？

Answer 1

首先，如果您使用 WebView ，请添加以下代码:

webView.getSettings().setLoadsImagesAutomatically(true);
webView.getSettings().setJavaScriptEnabled(true);
webView.setInitialScale(1);
webView.getSettings().setDefaultZoom(WebSettings.ZoomDensity.FAR);
webView.getSettings().setLoadWithOverviewMode(true);
webView.getSettings().setUseWideViewPort(true);
webView.getSettings().setBuiltInZoomControls(false);
webView.getSettings().setDisplayZoomControls(false);
webView.getSettings().setDomStorageEnabled(true);
webView.getSettings().setAllowFileAccess(true);

您还必须将以下代码添加到 manifest.xml 中:

<meta-data android:name="android.webkit.WebView.EnableSafeBrowsing"
            android:value="true" />

希望它能解决您的问题。