---
title: Avoid insecure WebView file-access settings
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > Code Security > Static Code Analysis (SAST) > SAST
  Rules > Avoid insecure WebView file-access settings
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Avoid insecure WebView file-access settings

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Metadata{% #metadata %}

**ID:** `dart-security/insecure-webview-settings`

**Language:** Dart

**Severity:** Warning

**Category:** Security

**CWE**: [749](https://cwe.mitre.org/data/definitions/749.html)

## Description{% #description %}

Enabling allowUniversalAccessFromFileURLs or allowFileAccessFromFileURLs on a Flutter WebView lets remote or local content read arbitrary local files and bypass the same-origin policy. An attacker who can load content into the WebView can then read app data and other files on the device and exfiltrate them.

These settings are disabled by default for a reason. Leave them at their secure defaults (false) unless a specific feature strictly requires file access from file URLs, and prefer serving assets through a safer channel instead.

## Non-Compliant Code Examples{% #non-compliant-code-examples %}

```dart
void main() {
  final controller = WebViewController(
    allowUniversalAccessFromFileURLs: true,
    allowFileAccessFromFileURLs: true,
  );
  controller.allowUniversalAccessFromFileURLs = true;
  allowFileAccessFromFileURLs = true;
}
```

## Compliant Code Examples{% #compliant-code-examples %}

```dart
void main() {
  final controller = WebViewController(
    allowUniversalAccessFromFileURLs: false,
    allowFileAccessFromFileURLs: false,
    javaScriptEnabled: true,
  );
  controller.allowUniversalAccessFromFileURLs = false;
  allowFileAccessFromFileURLs = false;
  allowCookies = true;
}
```
  Seamless integrations. Try Datadog Code SecurityDatadog Code Security 
{% icon name="icon-external-link" /%}