Insecure Use of Language/Framework API

Using APIs securely

About insecure use of language/framework APIs

What is insecure use of language/framework APIs?

Insecure use of language or framework API refers to a security vulnerability that arises when an application uses an API in an unsafe or insecure manner. This can result in unintended behavior or access, which can be exploited by attackers to gain unauthorized access, steal data, or perform other malicious actions.

This type of vulnerability can arise due to a lack of understanding on the part of the developer, or it can result from the use of outdated or deprecated APIs that are no longer considered secure.

What is the impact of insecure use of language/framework APIs?

Insecure use of language/framework APIs can have a wide-ranging impact, depending on the type of vulnerability and the attacker's goals.

Here are some potential impacts of insecure use of language or framework API:

• Unauthorized access: An attacker may be able to gain unauthorized access to a system or application, giving them access to sensitive data or functionality.
• Data theft: An attacker may be able to steal data from the system, including personally identifiable information, financial data, or other sensitive data.
• Denial of service: An attacker may be able to launch a denial-of-service attack by exploiting vulnerabilities in the API.
• System compromise: In some cases, a successful attack on an insecure API can lead to a complete compromise of the system, allowing the attacker to take full control.

How to prevent the insecure use of language/Framework APIs?

Here are some measures that can help prevent insecure use of language or framework API:

• Use secure APIs: Use up-to-date and secure APIs that are well-maintained and well-documented. This can help prevent the use of deprecated APIs that are no longer considered secure.
• Regular security audits: Regularly audit your system and application for security vulnerabilities, including insecure use of language or framework API vulnerabilities. Use automated tools and manual testing to identify potential issues and fix them before they can be exploited.
• Education and training: Educate your development team about the risks of insecure use of language or framework API and the measures that can be taken to prevent them. Ensure that everyone on the team is aware of secure coding practices and understands the importance of security in application development.

Option A: Disable dangerous WebView settings

WebView allows enabling JavasScript which can be abused to gain access to the app's data.

1. Go through the issues that GuardRails identified in the PR/MR.

2. Identify the following patterns:

   WebView webview = new WebView(this);
   webview.getSettings().setJavaScriptEnabled(true);
   setContentView(webview);
   webview.loadUrl("https://www.example.com/");

3. If it's not needed then disable JavaScript, otherwise ensure that:

   • JavaScript and HTML are loaded locally from the app data directory or trusted servers.
   • That any communication to trusted servers is encrypted with TLS.

4. Test it and ensure the functionality works as expected

5. Ship it 🚢 and relax 🌴