Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

WebView setJavaScriptEnabled and JavaScript on site

I have web view in my app. I can see warnings in IDE. "Using setJavaScriptEnabled can introduce XSS vulnerabilities" for code

webView.getSettings().setJavaScriptEnabled(true);

So, after googling I have advice: "If your app really doesn’t require JavaScript usage within a WebView then don’t call setJavaScriptEnabled(true)"

As I understood, I do not need to enable JS for my WebView if I do not have a need to interact with this WebView with using JS. (inject some JS in WebView and handle JS events in my Android side code). But, does this means that all JS on this website will work in my WebView. I mean, if a site contains some JS for let's say some animation. Will this animation work in my WebView without enabling of this setting. Thanks a lot.

like image 620
Дмитро Яковлєв Avatar asked Jul 14 '26 10:07

Дмитро Яковлєв


1 Answers

The instruction:

webView.getSettings().setJavaScriptEnabled(true);

Disable Javascript in the webview, so if you put 3 sites,2, etc. does not matter because the javascript was disabled in the webview. The webview is like chrome, firefox, or another. In other words you are disable javascript in the web browser.

like image 197
josedlujan Avatar answered Jul 20 '26 16:07

josedlujan



Donate For Us

If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!