Zennoxa Shield
Rules / Kotlin
SHIELD-KOTLIN-006

JavaScript injection via WebView loadUrl/evaluateJavascript

highKotlinCWE-79CVSS 8.1

What it detects

Concatenating or interpolating a variable into a WebView loadUrl('javascript:') or evaluateJavascript call enables JS injection.

How to fix

Never inject untrusted data into JavaScript; encode values or pass them via safe message channels.

Vulnerable — Shield flags thisWebJs.kt
fun greet(webView: WebView, name: String) {
    webView.loadUrl("javascript:showGreeting('$name')")
}
Fixed — scans cleanWebJs.kt
fun greet(webView: WebView, name: String) {
    val message = WebMessage(name)
    webView.postWebMessage(message, Uri.parse("https://example.com"))
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-KOTLIN-006, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-KOTLIN-006: JavaScript injection via WebView loadUrl/evaluateJavascript — Zennoxa Shield