Allowing javascript to open windows is dangerous

문서 > Datadog 보안 > Code Security > Static Code Analysis (SAST) > SAST 규칙 > Allowing javascript to open windows is dangerous

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

ID: swift-security/webview-config

Language: Unknown

Severity: Error

Category: Security

CWE: 272

Description

Allowing WKWebView to open new windows automatically via WKPreferences.javaScriptCanOpenWindowsAutomatically = true violates least-privilege and can enable abusive pop-ups, phishing flows, and other unwanted navigation. Unless there’s a clear, justified need, keep this disabled to reduce attack surface and improve user trust. If opening windows is required, gate it behind explicit user gestures and tight navigation policies (e.g., allowlists, WKNavigationDelegate) to contain risk.

Non-Compliant Code Examples

let prefs = WKPreferences()
// ruleid: swift-webview-config-allows-js-open-windows
prefs.JavaScriptCanOpenWindowsAutomatically  = true
let config = WKWebViewConfiguration()
config.defaultWebpagePreferences = prefs

WKWebView(frame: .zero, configuration: config)

let prefs2 = WKPreferences()
prefs2.JavaScriptCanOpenWindowsAutomatically  = true
// okid: swift-webview-config-allows-js-open-windows
prefs2.JavaScriptCanOpenWindowsAutomatically  = false
let config = WKWebViewConfiguration()
config.defaultWebpagePreferences = prefs2

WKWebView(frame: .zero, configuration: config)

Compliant Code Examples

import WebKit

// Create a preferences object for the webview.
let webPreferences = WKPreferences()

// COMPLIANT: Explicitly disable the ability for JavaScript to open windows
// automatically. This prevents pop-ups and other potentially malicious behavior,
// adhering to the principle of least privilege.
webPreferences.javaScriptCanOpenWindowsAutomatically = false

// Create a webview configuration.
let webConfiguration = WKWebViewConfiguration()
webConfiguration.preferences = webPreferences

// Initialize the WKWebView with the secure configuration.
let webView = WKWebView(frame: .zero, configuration: webConfiguration)

print("WKWebView configured securely.")