Metadata

ID: dart-security/insecure-webview-settings

Language: Dart

Severity: Warning

Category: Security

CWE: 749

Description

Enabling allowUniversalAccessFromFileURLs or allowFileAccessFromFileURLs on a Flutter WebView lets remote or local content read arbitrary local files and bypass the same-origin policy. An attacker who can load content into the WebView can then read app data and other files on the device and exfiltrate them.

These settings are disabled by default for a reason. Leave them at their secure defaults (false) unless a specific feature strictly requires file access from file URLs, and prefer serving assets through a safer channel instead.

Non-Compliant Code Examples

void main() {
  final controller = WebViewController(
    allowUniversalAccessFromFileURLs: true,
    allowFileAccessFromFileURLs: true,
  );
  controller.allowUniversalAccessFromFileURLs = true;
  allowFileAccessFromFileURLs = true;
}

Compliant Code Examples

void main() {
  final controller = WebViewController(
    allowUniversalAccessFromFileURLs: false,
    allowFileAccessFromFileURLs: false,
    javaScriptEnabled: true,
  );
  controller.allowUniversalAccessFromFileURLs = false;
  allowFileAccessFromFileURLs = false;
  allowCookies = true;
}

Seamless integrations. Try Datadog Code Security

Datadog Code Security