Allowing javascript to open windows is dangerous

Documentos > Datadog Security > Code Security > Static Code Analysis (SAST) > Reglas de SAST > Allowing javascript to open windows is dangerous

Esta página aún no está disponible en español. Estamos trabajando en su traducción.
Si tienes alguna pregunta o comentario sobre nuestro actual proyecto de traducción, no dudes en ponerte en contacto con nosotros.

Metadata

ID: swift-security/webview-config

Language: Unknown

Severity: Error

Category: Security

CWE: 272

Description

Allowing WKWebView to open new windows automatically via WKPreferences.javaScriptCanOpenWindowsAutomatically = true violates least-privilege and can enable abusive pop-ups, phishing flows, and other unwanted navigation. Unless there’s a clear, justified need, keep this disabled to reduce attack surface and improve user trust. If opening windows is required, gate it behind explicit user gestures and tight navigation policies (e.g., allowlists, WKNavigationDelegate) to contain risk.

Non-Compliant Code Examples

let prefs = WKPreferences()
// ruleid: swift-webview-config-allows-js-open-windows
prefs.JavaScriptCanOpenWindowsAutomatically  = true
let config = WKWebViewConfiguration()
config.defaultWebpagePreferences = prefs

WKWebView(frame: .zero, configuration: config)

let prefs2 = WKPreferences()
prefs2.JavaScriptCanOpenWindowsAutomatically  = true
// okid: swift-webview-config-allows-js-open-windows
prefs2.JavaScriptCanOpenWindowsAutomatically  = false
let config = WKWebViewConfiguration()
config.defaultWebpagePreferences = prefs2

WKWebView(frame: .zero, configuration: config)

Compliant Code Examples

import WebKit

// Create a preferences object for the webview.
let webPreferences = WKPreferences()

// COMPLIANT: Explicitly disable the ability for JavaScript to open windows
// automatically. This prevents pop-ups and other potentially malicious behavior,
// adhering to the principle of least privilege.
webPreferences.javaScriptCanOpenWindowsAutomatically = false

// Create a webview configuration.
let webConfiguration = WKWebViewConfiguration()
webConfiguration.preferences = webPreferences

// Initialize the WKWebView with the secure configuration.
let webView = WKWebView(frame: .zero, configuration: webConfiguration)

print("WKWebView configured securely.")