security: disable JavaScript in WebViews loading static content - #501
Open
diraol wants to merge 1 commit into
Open
security: disable JavaScript in WebViews loading static content#501diraol wants to merge 1 commit into
diraol wants to merge 1 commit into
Conversation
Disable JavaScript execution in all 3 WebView pages that load static server-rendered content (privacy policy, terms of use, FAQ). None of these pages use JavaScript — the mailto: handler in AboutPenhasPage works via NavigationDelegate at the Dart level, not via JS. Enabling JavaScript unnecessarily creates an XSS attack vector: if the server is compromised or traffic is intercepted (especially relevant given the absence of certificate pinning), malicious JavaScript could execute in the WebView context. Changes: - privacy_policy_page.dart: JavaScriptMode.unrestricted -> disabled - terms_of_use_page.dart: JavaScriptMode.unrestricted -> disabled - about_penhas_page.dart: JavaScriptMode.unrestricted -> disabled - webview_mocks.dart: FakeWebViewPlatform now exposes lastController; FakeWebViewController captures lastJavaScriptMode for assertions; added setPlatformNavigationDelegate override for AboutPenhasPage - Added testWidgets asserting JavaScriptMode.disabled in all 3 pages - Created about_penhas_page_test.dart (previously had no test coverage) Before: All WebViews used JavaScriptMode.unrestricted. After: All WebViews use JavaScriptMode.disabled. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
12 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
JavaScriptMode.disabled) in all 3 WebView pages that load static server-rendered content: privacy policy, terms of use, and FAQmailto:handler inAboutPenhasPageworks viaNavigationDelegateat the Dart level, not via JSAboutPenhasPagewhich previously had no tests at allFakeWebViewControllermock to captureJavaScriptModefor test assertionsSecurity context
Enabling JavaScript unnecessarily in WebViews creates an XSS attack vector. If the server is compromised or traffic is intercepted (the app currently lacks certificate pinning), malicious JavaScript could execute in the WebView context. This is especially concerning for PenhaS, a platform for women facing domestic violence — attackers may control the local network.
Changes
privacy_policy_page.dartJavaScriptMode.unrestricted→disabledterms_of_use_page.dartJavaScriptMode.unrestricted→disabledabout_penhas_page.dartJavaScriptMode.unrestricted→disabledwebview_mocks.dartFakeWebViewPlatformexposeslastController;FakeWebViewControllercaptureslastJavaScriptMode; addedsetPlatformNavigationDelegateoverrideprivacy_policy_page_test.darttestWidgetsassertingJavaScriptMode.disabledterms_of_use_page_test.darttestWidgetsassertingJavaScriptMode.disabledabout_penhas_page_test.dartBefore / After
Before: All 3 WebViews used
JavaScriptMode.unrestricted.AboutPenhasPagehad no tests.After: All 3 WebViews use
JavaScriptMode.disabled. 3 new tests prevent accidental re-enablement.Test plan
flutter test test/app/features/authentication/presentation/sign_in/privacy_policy/— passesflutter test test/app/features/authentication/presentation/sign_in/terms_of_use/— passesflutter test test/app/features/main_menu/presentation/pages/— passesflutter test— full suite, no regressions🤖 Generated with Claude Code