Zennoxa Shield
Rules / Kotlin
SHIELD-KOTLIN-018

WebView JavaScript enabled with file access

highKotlinCWE-749CVSS 6.5

What it detects

Enabling JavaScript together with file access on a WebView can allow local file exfiltration by malicious scripts.

How to fix

Disable file access for WebViews that render remote content and only enable JavaScript when strictly required.

Vulnerable — Shield flags thisHelpViewer.kt
import android.webkit.WebView

fun showHelp(webView: WebView, remoteUrl: String) {
    webView.settings.javaScriptEnabled = true
    webView.settings.allowFileAccess = true
    webView.loadUrl(remoteUrl)
}
Fixed — scans cleanHelpViewer.kt
import android.webkit.WebView

fun showHelp(webView: WebView, remoteUrl: String) {
    webView.settings.javaScriptEnabled = false
    webView.settings.allowFileAccess = false
    webView.settings.allowFileAccessFromFileURLs = false
    webView.loadUrl(remoteUrl)
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-KOTLIN-018, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-KOTLIN-018: WebView JavaScript enabled with file access — Zennoxa Shield