...
Automatic detection of a call to the addJavascriptInterface() method in a WebView is straightforward. Similarly, it is straightforward to automatically ensure that the minimum API is set to JELLY_BEAN_MR1 in the app manifest. Automatic determination of whether the WebView could contain untrusted content may be impossible for some applications.
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| CodeSonar |
| JAVA.JS.RI | Risky JavaScript interface (Java) |
Related Guidelines
| [The CERT Oracle Secure Coding Standard for Java] | SEC05-J. Do not use reflection to increase accessibility of classes, methods, or fields |
...