Zennoxa Shield
Rules / Dart
SHIELD-DART-014

WebView with unrestricted JavaScript mode

highDartCWE-749CVSS 7.4

What it detects

A WebView using unrestricted JavaScript mode exposes loaded content to full script execution and local access.

How to fix

Disable JavaScript unless required, restrict file access, and load only trusted content.

Vulnerable — Shield flags thishelp_view.dart
import 'package:webview_flutter/webview_flutter.dart';

Widget buildHelpView() {
  return WebView(
    initialUrl: 'https://help.example.com',
    javascriptMode: JavascriptMode.unrestricted,
  );
}
Fixed — scans cleanhelp_view.dart
import 'package:webview_flutter/webview_flutter.dart';

Widget buildHelpView() {
  return WebView(
    initialUrl: 'https://help.example.com',
    javascriptMode: JavascriptMode.disabled,
  );
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-DART-014, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-DART-014: WebView with unrestricted JavaScript mode — Zennoxa Shield