Skip to content

Commit 047b1eb

Browse files
ESS-ENNESS-ENN
committed
swift-webview-config-allows-js-open-windows-swift
1 parent a665363 commit 047b1eb

3 files changed

+114
-0
lines changed

‎rules/swift/security/swift-webview-config-allows-js-open-windows-swift.yml

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
id: swift-webview-config-allows-js-open-windows-swift
2+
language: swift
3+
severity: warning
4+
message: >-
5+
Webviews were observed that explictly allow JavaScript in an WKWebview
6+
to open windows automatically. Consider disabling this functionality if
7+
not required, following the principle of least privelege.
8+
note: >-
9+
[CWE-272]: Least Privilege Violation
10+
[REFERENCES]
11+
https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/
12+
https://developer.apple.com/documentation/webkit/wkpreferences/1536573-javascriptcanopenwindowsautomati
13+
utils:
14+
match_JavaScriptCanOpenWindowsAutomatically:
15+
kind: assignment
16+
all:
17+
- has:
18+
stopBy: end
19+
kind: navigation_expression
20+
has:
21+
stopBy: end
22+
kind: simple_identifier
23+
pattern: $R
24+
- has:
25+
stopBy: end
26+
kind: navigation_suffix
27+
has:
28+
stopBy: end
29+
kind: simple_identifier
30+
regex: "^JavaScriptCanOpenWindowsAutomatically$"
31+
- has:
32+
kind: boolean_literal
33+
regex: "^true$"
34+
- follows:
35+
stopBy: end
36+
kind: property_declaration
37+
has:
38+
stopBy: end
39+
kind: pattern
40+
has:
41+
kind: simple_identifier
42+
pattern: $R
43+
- not:
44+
precedes:
45+
stopBy: neighbor
46+
kind: assignment
47+
has:
48+
stopBy: end
49+
kind: boolean_literal
50+
regex: "^true$|false"
51+
- not:
52+
follows:
53+
stopBy: neighbor
54+
kind: assignment
55+
has:
56+
stopBy: end
57+
kind: boolean_literal
58+
regex: "^true"
59+
60+
rule:
61+
any:
62+
- matches: match_JavaScriptCanOpenWindowsAutomatically

‎tests/__snapshots__/swift-webview-config-allows-js-open-windows-swift-snapshot.yml

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
id: swift-webview-config-allows-js-open-windows-swift
2+
snapshots:
3+
? |
4+
let prefs = WKPreferences()
5+
prefs.JavaScriptCanOpenWindowsAutomatically = true
6+
: labels:
7+
- source: prefs.JavaScriptCanOpenWindowsAutomatically = true
8+
style: primary
9+
start: 28
10+
end: 79
11+
- source: prefs
12+
style: secondary
13+
start: 28
14+
end: 33
15+
- source: prefs.JavaScriptCanOpenWindowsAutomatically
16+
style: secondary
17+
start: 28
18+
end: 71
19+
- source: JavaScriptCanOpenWindowsAutomatically
20+
style: secondary
21+
start: 34
22+
end: 71
23+
- source: .JavaScriptCanOpenWindowsAutomatically
24+
style: secondary
25+
start: 33
26+
end: 71
27+
- source: 'true'
28+
style: secondary
29+
start: 75
30+
end: 79
31+
- source: prefs
32+
style: secondary
33+
start: 4
34+
end: 9
35+
- source: prefs
36+
style: secondary
37+
start: 4
38+
end: 9
39+
- source: let prefs = WKPreferences()
40+
style: secondary
41+
start: 0
42+
end: 27

‎tests/swift/swift-webview-config-allows-js-open-windows-swift-test.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
id: swift-webview-config-allows-js-open-windows-swift
2+
valid:
3+
- |
4+
let prefs2 = WKPreferences()
5+
prefs2.JavaScriptCanOpenWindowsAutomatically = true
6+
prefs2.JavaScriptCanOpenWindowsAutomatically = false
7+
invalid:
8+
- |
9+
let prefs = WKPreferences()
10+
prefs.JavaScriptCanOpenWindowsAutomatically = true

0 commit comments

Comments
 (0)