Allowing WKWebView to open new windows automatically via WKPreferences.javaScriptCanOpenWindowsAutomatically = true violates least-privilege and can enable abusive pop-ups, phishing flows, and other unwanted navigation. Unless there’s a clear, justified need, keep this disabled to reduce attack surface and improve user trust. If opening windows is required, gate it behind explicit user gestures and tight navigation policies (e.g., allowlists, WKNavigationDelegate) to contain risk.
importWebKit// Create a preferences object for the webview.letwebPreferences=WKPreferences()// COMPLIANT: Explicitly disable the ability for JavaScript to open windows// automatically. This prevents pop-ups and other potentially malicious behavior,// adhering to the principle of least privilege.webPreferences.javaScriptCanOpenWindowsAutomatically=false// Create a webview configuration.letwebConfiguration=WKWebViewConfiguration()webConfiguration.preferences=webPreferences// Initialize the WKWebView with the secure configuration.letwebView=WKWebView(frame:.zero,configuration:webConfiguration)print("WKWebView configured securely.")
원활한 통합. Datadog Code Security 사용해 보기
Datadog Code Security
이 규칙을 사용해 Datadog Code Security로 코드 분석해 보기
이 규칙의 사용법
1
2
rulesets:- swift-security # Rules to enforce Swift security.
리포지토리 루트에서 위의 콘텐츠를 사용해 static-analysis.datadog.yml 생성
Datadog의 무료 IDE Plugins를 사용하거나 Code Security 스캔을 CI 파이프라인에 추가