CodeQL documentation
CodeQL resources

Android Webview debugging enabled

ID: java/android/webview-debugging-enabled Kind: path-problem Security severity: 7.2 Severity: warning Precision: high Tags: - security - external/cwe/cwe-489 Query suites: - java-code-scanning.qls - java-security-extended.qls - java-security-and-quality.qls

Click to see the query in the CodeQL repository

The WebView.setWebContentsDebuggingEnabled method enables or disables the contents of any WebView in the application to be debugged.

You should only enable debugging features during development. When you create a production build, you should disable it. If you enable debugging features, this can make your code vulnerable by adding entry points, or leaking sensitive information.

Recommendation

Ensure that debugging features are not enabled in production builds, such as by guarding calls to WebView.setWebContentsDebuggingEnabled(true) by a flag that is only enabled in debug builds.

Example

In the first (bad) example, WebView debugging is always enabled. whereas the GOOD case only enables it if the android:debuggable attribute is set to true.

// BAD - debugging is always enabled  WebView.setWebContentsDebuggingEnabled(true); // GOOD - debugging is only enabled when this is a debug build, as indicated by the debuggable flag being set. if (0 != (getApplicationInfo().flags & ApplicationInfo.FLAG_DEBUGGABLE)) {  WebView.setWebContentsDebuggingEnabled(true); }

References