VNX-749: Dangerous capability exposed to WebView JavaScript

Reports dangerous operations (commands, file writes and deletes, reflection, SQL, SMS, component launches, device identifiers) performed inside Android @JavascriptInterface methods, which any script in the WebView can call.

Field	Value
Rule ID	`VNX-749`
Severity	High
SARIF level	`error`
Kind	`sast`
Languages	Java, Kotlin
CWE	CWE-749
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:H/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:H/DI:H/EX:H/EC:N/P:H`
Tags	`dangerous-method` `android` `webview` `javascript-interface` `cwe-749`
Source	`internal/sast/rules/vnx-749.rego`

Overview

VNX-749 maps to CWE-749: Exposed Dangerous Method or Function. A method annotated @JavascriptInterface can be called by every script in a WebView that has the bridge registered with addJavascriptInterface. The rule reports these calls when they appear inside such a method, in Java or Kotlin:

commands: Runtime.exec, ProcessBuilder
file writes and deletes: FileOutputStream, FileWriter, openFileOutput, Files.write/delete/move/copy, File.delete()
loading or invoking code: Class.forName, getMethod, Method.invoke, DexClassLoader, System.loadLibrary
SQL: execSQL, rawQuery
SMS: sendTextMessage
launching components: startActivity, startService, sendBroadcast
device identifiers and location: getDeviceId, getLine1Number, getLastKnownLocation

What Gets Flagged

@JavascriptInterface
public String run(String cmd) throws IOException {
    Process p = Runtime.getRuntime().exec(cmd);       // FLAGGED
    ...
}

@JavascriptInterface
fun open(url: String) {
    context.startActivity(Intent(Intent.ACTION_VIEW, Uri.parse(url)))  // FLAGGED
}

Not reported: bridge methods that only return values, log, or show UI. Also not reported: the same calls in methods without the annotation, test code and comments. VNX-ANDROID-002 reports a bridge registered on a WebView that loads untrusted content.

Remediation

Expose only narrow operations, and validate every argument inside the bridge method.
Never load remote or user-controlled content into a WebView that has a bridge.

References

CWE-749: Exposed Dangerous Method or Function

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-749
// nosec vnx-749

Or record an ignore rule: vulnetix ignore add --rule vnx-749 --reason "...". See Suppressing findings.