1841
[[UIApplication sharedApplication] openURL:url];
Application URL Handler
Example Language: (Bad)
- (BOOL)application:(UIApplication *)application handleOpenURL:(NSURL *)url {
if (!url) {
return NO;
}
NSString *action = [url host];
if([action isEqualToString: @"replaceFileText"]) {
NSDictionary *dict = [self parseQueryStringExampleFunction:[url query]];
//this function will write contents to a specified file
FileObject *objectFile = [self writeToFile:[dict objectForKey: @"file"] withText:[dict objectForKey: @"text"]];
}
return YES;
}
The handler has no restriction on who can use its functionality. The handler can be invoked using
any method that invokes the URL handler such as the following malicious iframe embedded on a
web page opened by Safari.
Example Language: HTML (Attack)
<iframe src="appscheme://replaceFileText?file=Bookmarks.dat&text=listOfMaliciousWebsites">
The attacker can host a malicious website containing the iframe and trick users into going to
the site via a crafted phishing email. Since Safari automatically executes iframes, the user is
not prompted when the handler executes the iframe code which automatically invokes the URL
handler replacing the bookmarks file with a list of malicious websites. Since replaceFileText is a
potentially dangerous action, an action that modifies data, there should be a sanity check before
the writeToFile:withText: function.
Example 2:
These Android and iOS applications intercept URL loading within a WebView and perform special
actions if a particular URL scheme is used, thus allowing the Javascript within the WebView to
communicate with the application:
Example Language: Java (Bad)
// Android
@Override
public boolean shouldOverrideUrlLoading(WebView view, String url){
if (url.substring(0,14).equalsIgnoreCase("examplescheme:")){
if(url.substring(14,25).equalsIgnoreCase("getUserInfo")){
writeDataToView(view, UserData);
return false;
}
else{
return true;
}
}
}
Example Language: Objective-C (Bad)
// iOS
-(BOOL) webView:(UIWebView *)exWebView shouldStartLoadWithRequest:(NSURLRequest *)exRequest navigationType:
(UIWebViewNavigationType)exNavigationType
{
NSURL *URL = [exRequest URL];
if ([[URL scheme] isEqualToString:@"exampleScheme"])
CWE Version 4.14
CWE-940: Improper Verification of Source of a Communication Channel
CWE-940: Improper Verification of Source of a Communication Channel