Zennoxa Shield
Rules / Dart
SHIELD-DART-004

WebView JavaScript injection

highDartCWE-79CVSS 8.1

What it detects

Evaluating or running JavaScript built from variables inside a WebView enables script injection.

How to fix

JSON-encode values passed into WebView JavaScript and avoid injecting raw user input.

Vulnerable — Shield flags thisprofile_webview.dart
import 'package:webview_flutter/webview_flutter.dart';

Future<void> greetUser(WebViewController controller, String userName) async {
  // Script injection: userName is spliced into the executed JavaScript
  await controller.evaluateJavascript("renderGreeting($userName)");
}
Fixed — scans cleanprofile_webview.dart
import 'dart:convert';
import 'package:webview_flutter/webview_flutter.dart';

Future<void> greetUser(WebViewController controller, String userName) async {
  final safeName = jsonEncode(userName); // alice -> "alice", quotes escaped
  await controller.evaluateJavascript('renderGreeting(' + safeName + ')');
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-DART-004, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-DART-004: WebView JavaScript injection — Zennoxa Shield