java-webview-cross-app-scripting-mining

Read-only mining codemod for SonarSource rule javasecurity:S7606 — WebViews should not be vulnerable to cross-app scripting attacks (Beta).

It scans Java source and emits metrics only; it never modifies code (return null).
Findings are high-signal review candidates surfaced by AST pattern matching — they are
not proven vulnerabilities. A static mining pass cannot prove an end-to-end taint flow
from an untrusted source to the sink, so confirm data flow before remediating.

What it detects

Android WebView load/evaluate sinks fed by dynamic data.

Sinks:

• WebView.loadUrl / loadData / loadDataWithBaseURL / evaluateJavascript / postUrl / addJavascriptInterface (webview-like receiver)

Emission rule: Only emits when an argument is dynamic.

Metric: java-webview-cross-app-scripting-mining

Security standards

• CWE-79 (Cross-site Scripting)
• OWASP ASVS 4.0: 5.3.3
• OWASP Mobile Top 10 2024: M4
• OWASP Top 10 2021: A3
• OWASP Top 10: A7
• PCI DSS 3.2: 6.5.7
• PCI DSS 4.0: 6.2.4
• STIG ASD V5R3: V-222602, V-222609

Run locally

bash
Copy
cd codemods/java-security-blocker-mining/java-webview-cross-app-scripting-mining
npm test

# Scan a target project (read-only; emits metrics, leaves source unchanged)
npx codemod@latest workflow run \
  -w codemods/java-security-blocker-mining/java-webview-cross-app-scripting-mining/workflow.yaml \
  --target /path/to/java/project

Part of the java-security-blocker-mining suite covering 19 blocker-severity
Java vulnerability rules. Each codemod is read-only and emits a single named metric.