From 290e32fb45b5168ec54d7af72d4f6e43f71a6e56 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sat, 18 Apr 2026 01:28:32 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH]=20Fi?= =?UTF-8?q?x=20XSS=20vulnerability=20in=20WebView?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replaced the vulnerable `injectJavaScript` string interpolation approach with the much safer `postMessage` protocol when passing data from React Native to the WebView OCR engines. This prevents arbitrary JavaScript execution even if malicious payloads are supplied. Co-authored-by: TargetMisser <52361977+TargetMisser@users.noreply.github.com> --- .jules/sentinel.md | 4 ++++ src/screens/HomeScreen.tsx | 26 +++++++++++++++++--------- src/screens/ShiftScreen.tsx | 28 ++++++++++++++++++---------- 3 files changed, 39 insertions(+), 19 deletions(-) create mode 100644 .jules/sentinel.md diff --git a/.jules/sentinel.md b/.jules/sentinel.md new file mode 100644 index 0000000..5e48b43 --- /dev/null +++ b/.jules/sentinel.md @@ -0,0 +1,4 @@ +## 2024-05-20 - WebView XSS Prevention +**Vulnerability:** String interpolation used in `injectJavaScript` to pass data to a WebView, allowing potential Cross-Site Scripting (XSS). +**Learning:** Even with stringified JSON, `injectJavaScript` executes the result directly in the context of the page, potentially allowing attackers to execute arbitrary JavaScript if the input contains malicious escape sequences. +**Prevention:** Use `webViewRef.current.postMessage(data)` and listen for the `message` event inside the WebView (`window.addEventListener('message', ...)`). diff --git a/src/screens/HomeScreen.tsx b/src/screens/HomeScreen.tsx index 8475bcb..e841fee 100644 --- a/src/screens/HomeScreen.tsx +++ b/src/screens/HomeScreen.tsx @@ -42,6 +42,22 @@ const weatherMap: Record = { const engineHtml = `