Skip to main content

avoid-unrestricted-navigation

v1.38.0
warning
effort: 5m
pro+

Warns when WebViews allow users to navigate to any URL by clicking links or through JavaScript.

Allowing unrestricted navigation within an app's WebView introduces serious security risks. For instance, malicious elements like ads can redirect users to deceptive phishing pages. Because WebViews lack standard browser safety cues (like a visible URL bar), users are more likely to trust these fake sites.

Additionally, if the WebView loads a page with a Cross-Site Scripting (XSS) vulnerability, unrestricted navigation can broaden the attack's impact. Ultimately, this loss of contextual security makes it much harder for users to spot and avoid malicious content.

Example​

❌ Bad:

void fn() {
  WebViewController()
    // LINT: Avoid unrestricted navigation as it expands the attack surface to cross-site scripting (XSS) vulnerabilities.
    //  Consider preventing navigation to arbitrary URLs.
    ..setNavigationDelegate(NavigationDelegate());

  // LINT: Avoid unrestricted navigation as it expands the attack surface to cross-site scripting (XSS) vulnerabilities.
  //  Consider preventing navigation to arbitrary URLs.
  InAppWebViewSettings();

  // LINT: Avoid unrestricted navigation as it expands the attack surface to cross-site scripting (XSS) vulnerabilities.
  //  Consider preventing navigation to arbitrary URLs.
  InAppWebViewSettings(useShouldOverrideUrlLoading: false);

  // LINT: Avoid unrestricted navigation as it expands the attack surface to cross-site scripting (XSS) vulnerabilities.
  //  Consider preventing navigation to arbitrary URLs.
  HeadlessInAppWebView(InAppWebViewSettings(useShouldOverrideUrlLoading: false));
}

✅ Good:

void fn() {
  WebViewController()..setNavigationDelegate(
    NavigationDelegate(onNavigationRequest: () {
      ...
    })
  );

  InAppWebViewSettings(useShouldOverrideUrlLoading: true);

  HeadlessInAppWebView(InAppWebViewSettings(useShouldOverrideUrlLoading: true));
}
Last updated on