1566
The method in this example is declared public and therefore is exposed to any class in the
application. Deleting a database should be considered a critical operation within an application
and access to this potentially dangerous method should be restricted. Within Java this can be
accomplished simply by declaring the method private thereby exposing it only to the enclosing
class as in the following example.
Example Language: Java (Good)
private void removeDatabase(String databaseName) {
try {
Statement stmt = conn.createStatement();
stmt.execute("DROP DATABASE " + databaseName);
} catch (SQLException ex) {...}
}
Example 2:
These Android and iOS applications intercept URL loading within a WebView and perform special
actions if a particular URL scheme is used, thus allowing the Javascript within the WebView to
communicate with the application:
Example Language: Java (Bad)
// Android
@Override
public boolean shouldOverrideUrlLoading(WebView view, String url){
if (url.substring(0,14).equalsIgnoreCase("examplescheme:")){
if(url.substring(14,25).equalsIgnoreCase("getUserInfo")){
writeDataToView(view, UserData);
return false;
}
else{
return true;
}
}
}
Example Language: Objective-C (Bad)
// iOS
-(BOOL) webView:(UIWebView *)exWebView shouldStartLoadWithRequest:(NSURLRequest *)exRequest navigationType:
(UIWebViewNavigationType)exNavigationType
{
NSURL *URL = [exRequest URL];
if ([[URL scheme] isEqualToString:@"exampleScheme"])
{
NSString *functionString = [URL resourceSpecifier];
if ([functionString hasPrefix:@"specialFunction"])
{
// Make data available back in webview.
UIWebView *webView = [self writeDataToView:[URL query]];
}
return NO;
}
return YES;
}
A call into native code can then be initiated by passing parameters within the URL:
Example Language: JavaScript (Attack)
window.location = examplescheme://method?parameter=value
CWE Version 4.14
CWE-749: Exposed Dangerous Method or Function
CWE-749: Exposed Dangerous Method or Function