Skip to content

Commit 836704e

Browse files
ESS-ENNESS-ENN
committed
swift-webview-config-base-url-swift
1 parent 8c3da56 commit 836704e

File tree

3 files changed

+139
-0
lines changed

3 files changed

+139
-0
lines changed

‎rules/swift/security/swift-webview-config-base-url-swift.yml

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
id: swift-webview-config-base-url-swift
2+
severity: warning
3+
language: swift
4+
message: >-
5+
UIWebView instances were observed where the baseURL is misconfigured as
6+
nil, which allows for origin abuse within the webview. In order to remove
7+
the effective origin, the application should explicitly set the baseURL to
8+
`about:blank` or similar.
9+
note: >-
10+
[CWE-272] Least Privilege Violation.
11+
[REFERENCES]
12+
- https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/
13+
14+
ast-grep-essentials: true
15+
16+
utils:
17+
matches_patttern_loadHTMLString_&_load:
18+
kind: call_expression
19+
all:
20+
- has:
21+
kind: navigation_expression
22+
all:
23+
- has:
24+
kind: simple_identifier
25+
pattern: $W
26+
- has:
27+
kind: navigation_suffix
28+
has:
29+
kind: simple_identifier
30+
regex: ^(loadHTMLString|load)$
31+
- has:
32+
kind: call_suffix
33+
has:
34+
stopBy: end
35+
kind: value_argument
36+
all:
37+
- has:
38+
kind: simple_identifier
39+
regex: "^baseURL$"
40+
- has:
41+
regex: "^nil$"
42+
- any:
43+
- follows:
44+
stopBy: end
45+
kind: property_declaration
46+
all:
47+
- has:
48+
stopBy: end
49+
kind: pattern
50+
has:
51+
stopBy: neighbor
52+
kind: simple_identifier
53+
pattern: $W
54+
- has:
55+
stopBy: neighbor
56+
kind: call_expression
57+
all:
58+
- has:
59+
stopBy: neighbor
60+
kind: simple_identifier
61+
regex: "^UIWebView$"
62+
- has:
63+
stopBy: neighbor
64+
kind: call_suffix
65+
- inside:
66+
stopBy: end
67+
follows:
68+
stopBy: end
69+
kind: property_declaration
70+
all:
71+
- has:
72+
stopBy: end
73+
kind: pattern
74+
has:
75+
stopBy: neighbor
76+
kind: simple_identifier
77+
pattern: $W
78+
- has:
79+
stopBy: neighbor
80+
kind: call_expression
81+
all:
82+
- has:
83+
stopBy: neighbor
84+
kind: simple_identifier
85+
regex: "^UIWebView$"
86+
- has:
87+
stopBy: neighbor
88+
kind: call_suffix
89+
rule:
90+
kind: call_expression
91+
matches: matches_patttern_loadHTMLString_&_load
92+
not:
93+
all:
94+
- has:
95+
stopBy: end
96+
kind: ERROR
97+
- inside:
98+
stopBy: end
99+
kind: ERROR

‎tests/__snapshots__/swift-webview-config-base-url-swift-snapshot.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
id: swift-webview-config-base-url-swift
2+
snapshots: {}

‎tests/swift/swift-webview-config-base-url-swift-test.yml

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
id: swift-webview-config-base-url-swift
2+
valid:
3+
- |
4+
let webview2 = WKWebView(...)
5+
webview2.loadHTMLString(someHtmlString, baseURL: nil)
6+
invalid:
7+
- |
8+
let webview = UIWebView(...)
9+
webview.loadHTMLString(someHtmlString, baseURL: nil)
10+
- |
11+
let webview3 = UIWebView(...)
12+
webview3.load(data, mimetype: "application/json", textEncodingName: "UTF8", baseURL: nil)
13+
- |
14+
let webview13 = UIWebView(frame: self.view.bounds)
15+
let mixedContent = "<html><body><img src='image.jpg' /></body></html>"
16+
let dataMixed = mixedContent.data(using: .utf8)!
17+
webview13.load(dataMixed, mimetype: "text/html", textEncodingName: "UTF-8", baseURL: nil)
18+
self.view.addSubview(webview13)
19+
- |
20+
let webview12 = UIWebView(frame: self.view.bounds)
21+
let externalHtml = "<html><body><iframe src='https://www.example.com'></iframe></body></html>"
22+
webview12.loadHTMLString(externalHtml, baseURL: nil)
23+
self.view.addSubview(webview12)
24+
- |
25+
let webview10 = UIWebView(frame: self.view.bounds)
26+
let text = "This is a test."
27+
let data = text.data(using: .utf8)!
28+
webview10.load(data, mimetype: "text/plain", textEncodingName: "UTF-8", baseURL: nil)
29+
self.view.addSubview(webview10)
30+
- |
31+
let webview9 = UIWebView(frame: self.view.bounds)
32+
let dynamicHtml = "<html><body><h2>Dynamic Content</h2></body></html>"
33+
webview9.loadHTMLString(dynamicHtml, baseURL: nil)
34+
self.view.addSubview(webview9)
35+
- |
36+
let webview7 = UIWebView(frame: self.view.bounds)
37+
webview7.load(data, mimetype: "application/json", textEncodingName: "UTF-8", baseURL: nil)
38+
self.view.addSubview(webview7)

0 commit comments

Comments
 (0)