Skip to content

Add Swift webview security rules and test cases for JS window handling #40

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Oct 29, 2024
Merged

Add Swift webview security rules and test cases for JS window handling #40

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a665363
swift-webview-config-fraudulent-site-warning-swift
ESS-ENN Oct 22, 2024
047b1eb
swift-webview-config-allows-js-open-windows-swift
ESS-ENN Oct 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 62 additions & 0 deletions rules/swift/security/swift-webview-config-allows-js-open-windows-swift.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,62 @@
id: swift-webview-config-allows-js-open-windows-swift
language: swift
severity: warning
message: >-
Webviews were observed that explictly allow JavaScript in an WKWebview
to open windows automatically. Consider disabling this functionality if
not required, following the principle of least privelege.
note: >-
[CWE-272]: Least Privilege Violation
[REFERENCES]
https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/
https://developer.apple.com/documentation/webkit/wkpreferences/1536573-javascriptcanopenwindowsautomati
utils:
match_JavaScriptCanOpenWindowsAutomatically:
kind: assignment
all:
- has:
stopBy: end
kind: navigation_expression
has:
stopBy: end
kind: simple_identifier
pattern: $R
- has:
stopBy: end
kind: navigation_suffix
has:
stopBy: end
kind: simple_identifier
regex: "^JavaScriptCanOpenWindowsAutomatically$"
- has:
kind: boolean_literal
regex: "^true$"
- follows:
stopBy: end
kind: property_declaration
has:
stopBy: end
kind: pattern
has:
kind: simple_identifier
pattern: $R
- not:
precedes:
stopBy: neighbor
kind: assignment
has:
stopBy: end
kind: boolean_literal
regex: "^true$|false"
- not:
follows:
stopBy: neighbor
kind: assignment
has:
stopBy: end
kind: boolean_literal
regex: "^true"

rule:
any:
- matches: match_JavaScriptCanOpenWindowsAutomatically
58 changes: 58 additions & 0 deletions rules/swift/security/swift-webview-config-fraudulent-site-warning-swift.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,58 @@
id: swift-webview-config-fraudulent-site-warning-swift
language: swift
severity: warning
message: >-
Webviews were observed that explicitly opt ouf of the WKWebView
fraudulent site warnings. Consider enabling such functionality, to better
protect your users from fraud/malware.
note: >-
[CWE-272]: Least Privilege Violation
[REFERENCES]
https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/
utils:
match_isFraudulentWebsiteWarningEnabled:
kind: assignment
all:
- has:
stopBy: end
kind: navigation_expression
has:
stopBy: end
kind: simple_identifier
pattern: $R
- has:
stopBy: end
kind: navigation_suffix
has:
stopBy: end
kind: simple_identifier
regex: "^isFraudulentWebsiteWarningEnabled$"
- has:
kind: boolean_literal
regex: "^false$"
- follows:
stopBy: end
kind: property_declaration
has:
stopBy: end
kind: pattern
has:
kind: simple_identifier
pattern: $R
- not:
precedes:
kind: assignment
has:
kind: boolean_literal
regex: "false$|true"
- not:
follows:
stopBy: end
kind: assignment
has:
stopBy: end
kind: boolean_literal
regex: "^false"
rule:
any:
- matches: match_isFraudulentWebsiteWarningEnabled
42 changes: 42 additions & 0 deletions tests/__snapshots__/swift-webview-config-allows-js-open-windows-swift-snapshot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
id: swift-webview-config-allows-js-open-windows-swift
snapshots:
? |
let prefs = WKPreferences()
prefs.JavaScriptCanOpenWindowsAutomatically = true
: labels:
- source: prefs.JavaScriptCanOpenWindowsAutomatically = true
style: primary
start: 28
end: 79
- source: prefs
style: secondary
start: 28
end: 33
- source: prefs.JavaScriptCanOpenWindowsAutomatically
style: secondary
start: 28
end: 71
- source: JavaScriptCanOpenWindowsAutomatically
style: secondary
start: 34
end: 71
- source: .JavaScriptCanOpenWindowsAutomatically
style: secondary
start: 33
end: 71
- source: 'true'
style: secondary
start: 75
end: 79
- source: prefs
style: secondary
start: 4
end: 9
- source: prefs
style: secondary
start: 4
end: 9
- source: let prefs = WKPreferences()
style: secondary
start: 0
end: 27
83 changes: 83 additions & 0 deletions tests/__snapshots__/swift-webview-config-fraudulent-site-warning-swift-snapshot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,83 @@
id: swift-webview-config-fraudulent-site-warning-swift
snapshots:
? |
let prefs2 = WKPreferences()
prefs2.isFraudulentWebsiteWarningEnabled = false
: labels:
- source: prefs2.isFraudulentWebsiteWarningEnabled = false
style: primary
start: 29
end: 78
- source: prefs2
style: secondary
start: 29
end: 35
- source: prefs2.isFraudulentWebsiteWarningEnabled
style: secondary
start: 29
end: 69
- source: isFraudulentWebsiteWarningEnabled
style: secondary
start: 36
end: 69
- source: .isFraudulentWebsiteWarningEnabled
style: secondary
start: 35
end: 69
- source: 'false'
style: secondary
start: 73
end: 78
- source: prefs2
style: secondary
start: 4
end: 10
- source: prefs2
style: secondary
start: 4
end: 10
- source: let prefs2 = WKPreferences()
style: secondary
start: 0
end: 28
? |
let prefs2 = WKPreferences()
prefs2.isFraudulentWebsiteWarningEnabled = true
prefs2.isFraudulentWebsiteWarningEnabled = false
: labels:
- source: prefs2.isFraudulentWebsiteWarningEnabled = false
style: primary
start: 78
end: 127
- source: prefs2
style: secondary
start: 78
end: 84
- source: prefs2.isFraudulentWebsiteWarningEnabled
style: secondary
start: 78
end: 118
- source: isFraudulentWebsiteWarningEnabled
style: secondary
start: 85
end: 118
- source: .isFraudulentWebsiteWarningEnabled
style: secondary
start: 84
end: 118
- source: 'false'
style: secondary
start: 122
end: 127
- source: prefs2
style: secondary
start: 4
end: 10
- source: prefs2
style: secondary
start: 4
end: 10
- source: let prefs2 = WKPreferences()
style: secondary
start: 0
end: 28
10 changes: 10 additions & 0 deletions tests/swift/swift-webview-config-allows-js-open-windows-swift-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
id: swift-webview-config-allows-js-open-windows-swift
valid:
- |
let prefs2 = WKPreferences()
prefs2.JavaScriptCanOpenWindowsAutomatically = true
prefs2.JavaScriptCanOpenWindowsAutomatically = false
invalid:
- |
let prefs = WKPreferences()
prefs.JavaScriptCanOpenWindowsAutomatically = true
13 changes: 13 additions & 0 deletions tests/swift/swift-webview-config-fraudulent-site-warning-swift-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
id: swift-webview-config-fraudulent-site-warning-swift
valid:
- |
let prefs = WKPreferences()
prefs.isFraudulentWebsiteWarningEnabled = true
invalid:
- |
let prefs2 = WKPreferences()
prefs2.isFraudulentWebsiteWarningEnabled = true
prefs2.isFraudulentWebsiteWarningEnabled = false
- |
let prefs2 = WKPreferences()
prefs2.isFraudulentWebsiteWarningEnabled = false