Allowing javascript to open windows is dangerous

Docs > Plateforme de sécurité Datadog > Code Security > Static Code Analysis (SAST) > Règles SAST > Allowing javascript to open windows is dangerous

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

ID: swift-security/webview-config

Language: Unknown

Severity: Error

Category: Security

CWE: 272

Description

Allowing WKWebView to open new windows automatically via WKPreferences.javaScriptCanOpenWindowsAutomatically = true violates least-privilege and can enable abusive pop-ups, phishing flows, and other unwanted navigation. Unless there’s a clear, justified need, keep this disabled to reduce attack surface and improve user trust. If opening windows is required, gate it behind explicit user gestures and tight navigation policies (e.g., allowlists, WKNavigationDelegate) to contain risk.

Non-Compliant Code Examples

let prefs = WKPreferences()
// ruleid: swift-webview-config-allows-js-open-windows
prefs.JavaScriptCanOpenWindowsAutomatically  = true
let config = WKWebViewConfiguration()
config.defaultWebpagePreferences = prefs

WKWebView(frame: .zero, configuration: config)

let prefs2 = WKPreferences()
prefs2.JavaScriptCanOpenWindowsAutomatically  = true
// okid: swift-webview-config-allows-js-open-windows
prefs2.JavaScriptCanOpenWindowsAutomatically  = false
let config = WKWebViewConfiguration()
config.defaultWebpagePreferences = prefs2

WKWebView(frame: .zero, configuration: config)

Compliant Code Examples

import WebKit

// Create a preferences object for the webview.
let webPreferences = WKPreferences()

// COMPLIANT: Explicitly disable the ability for JavaScript to open windows
// automatically. This prevents pop-ups and other potentially malicious behavior,
// adhering to the principle of least privilege.
webPreferences.javaScriptCanOpenWindowsAutomatically = false

// Create a webview configuration.
let webConfiguration = WKWebViewConfiguration()
webConfiguration.preferences = webPreferences

// Initialize the WKWebView with the secure configuration.
let webView = WKWebView(frame: .zero, configuration: webConfiguration)

print("WKWebView configured securely.")