Exposing the Android file system to WebViews is security-sensitive.
Granting file access to WebViews, particularly through the file:// scheme, introduces a risk of local file inclusion vulnerabilities.
The severity of this risk depends heavily on the specific WebSettings configured. Overly permissive settings can allow malicious scripts
to access a wide range of local files, potentially exposing sensitive data such as Personally Identifiable Information (PII) or private application
data, leading to data breaches and other security compromises.
Ask Yourself Whether
- You open files that may be created or altered by external sources.
- You open arbitrary URLs from external sources.
There is a risk if you answered yes to any of these questions.
Recommended Secure Coding Practices
Avoid opening file:// URLs from external sources in WebView components. If your application accepts arbitrary URLs from external
sources, do not enable this functionality. Instead, utilize androidx.webkit.WebViewAssetLoader to access files, including assets and
resources, via http(s):// schemes.
For enhanced security, ensure that the options to load file:// URLs are explicitly set to false.
Sensitive Code Example
import android.webkit.WebView;
WebView webView = (WebView) findViewById(R.id.webview);
webView.getSettings().setAllowFileAccess(true); // Sensitive
webView.getSettings().setAllowContentAccess(true); // Sensitive
Compliant Solution
import android.webkit.WebView;
WebView webView = (WebView) findViewById(R.id.webview);
webView.getSettings().setAllowFileAccess(false);
webView.getSettings().setAllowContentAccess(false);
See
