Comments (8)
The rest of the app should be safe from any code running within a webview, there's no way for the webview to communicate with the RN code outside unless you build it. However, often even allowing the attacker to take complete control of the webview could be bad, you may be allowing the webview to communicate back up with the RN app in ways you wouldn't want an attacker to have arbitrary control over. You may also be displaying the webview in such a way that an attacker with control of it could make it seem like your app was doing things (maybe asking for passwords) when in fact the code running in the webview was doing that. Finally, there are sometimes vulnerabilities found in iOS and Android, at least with web browsers the user has to actually visit the page controlled by the attacker (or a page containing an ad controlled by the attacker :( ) for something bad to happen, but depending on how you're using the webview it may be possible to force content in it remotely (for example I'm using this for an email client, so anyone can send an HTML email and have it displayed which would be very bad if there were a way of exploiting browser vulnerabilities).
from react-native-html-webview.
One of the differences was that I supported setting html as a string, they added that though :)
Remaining differences:
- Links clicks don't cause it to navigate away, they just pass the url to the onLink callback
autoHeight
option disables scrolling and sets the height of the view to the height of its contents (this is useful when it's already in a scrollview along with other components)- Build in HTML sanitization (removes tags and attributes not in a whitelist, including all scripts)
Basically it's aimed at a use case where you want to render some (possibly untrusted) HTML in your app. Probably at some point it will be possibly to lose the custom Objective C bit and use the stock React Native webview underneath.
from react-native-html-webview.
Now that you're recommending on your README for people to use <WebView>
, does that mean that the differences you've mentioned above no longer apply?
from react-native-html-webview.
The bundled webview can't do those things out of the box but it's now got the capability to add them fairly easily I think. And since including a library that adds native code is a pain I think it's probably worth doing that. I might re-release this library as a wrapper round the built in WebView sometime soon.
from react-native-html-webview.
@almost Slightly tangential question stemming from my not understanding the RN security model: what's the worst that could happen if you execute untrusted JS within this module? Is it that the scripts within the page would run in the same environment as your RN code?
If so, in general, what's the harm in running arbitrary JS within a RN webview? How would that be any more dangerous than navigating to a malicious page in Safari?
from react-native-html-webview.
Yikes, sorry for the wall of text! I need to use more paragraphs :)
from react-native-html-webview.
@almost thanks for the rigorous response!
So to make sure I understand correctly, in summary, the only real risks to my RN app are:
- the webview could mimic my app, tricking users into provided data in the malicious webview
- the webview could trigger unexpected behavior in the RN app if the message-passing system I write isn't robust or limited enough
- general security issues with the webview itself
Is that about right? Thanks again for that breakdown!
from react-native-html-webview.
Yes, thanks, that's a good summary!
from react-native-html-webview.
Related Issues (16)
- `unknown` has no propType for native prop `AIBHTMLWebView.disableScroll` of native type `BOOL`\n stack HOT 3
- Display image from local system HOT 2
- Android support? HOT 2
- Invail directory HOT 1
- Width of webview?
- Can I use it in android? HOT 2
- Its dont work HOT 2
- libAIBHTMLWebView.a do not exists!
- Couldn't get it working with my project HOT 1
- Cannot run on IOS HOT 4
- That problem has been solved, and now there is a new problem. I hope you can help me to solve the next.
- Error when including into project. HOT 8
- Images are not contained in container HOT 7
- Content comes out blank ?
- My app crashed after I require the component .How to solve the problem?(react 0.10.0-rc) HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from react-native-html-webview.