From b1d1fa9e5a32b6ca8343307e13d6ab8738d57b6b Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sun, 19 Apr 2026 01:27:54 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH]=20Fi?= =?UTF-8?q?x=20XSS=20in=20WebView=20communication?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Migrated from `injectJavaScript` string interpolation to the secure `postMessage` API for communicating between React Native and the Tesseract OCR WebViews in `HomeScreen.tsx` and `ShiftScreen.tsx` to prevent script injection attacks. Co-authored-by: TargetMisser <52361977+TargetMisser@users.noreply.github.com> --- .jules/sentinel.md | 4 ++++ src/screens/HomeScreen.tsx | 16 +++++++--------- src/screens/ShiftScreen.tsx | 17 +++++++---------- 3 files changed, 18 insertions(+), 19 deletions(-) create mode 100644 .jules/sentinel.md diff --git a/.jules/sentinel.md b/.jules/sentinel.md new file mode 100644 index 0000000..a17fbc6 --- /dev/null +++ b/.jules/sentinel.md @@ -0,0 +1,4 @@ +## 2025-02-17 - React Native WebView XSS via injectJavaScript +**Vulnerability:** Constructing stringified JavaScript payloads and inserting them directly via `WebView.injectJavaScript` inside `HomeScreen.tsx` and `ShiftScreen.tsx` (e.g. `window.runTesseract(${JSON.stringify(base64Json)});`) is susceptible to Cross-Site Scripting (XSS). +**Learning:** `injectJavaScript` behaves like `eval()` in a web context. If the data being injected isn't strictly controlled or escaped properly, a malicious payload inside an image base64 sequence or filename could theoretically escape the JSON string context and execute arbitrary JavaScript. +**Prevention:** Always use the postMessage API bridge for communicating between the React Native layer and the WebView. Establish event listeners (`window.addEventListener('message', ...)`) in the WebView's HTML template and invoke `webViewRef.current.postMessage(data)` from React Native. diff --git a/src/screens/HomeScreen.tsx b/src/screens/HomeScreen.tsx index 8475bcb..0fe4421 100644 --- a/src/screens/HomeScreen.tsx +++ b/src/screens/HomeScreen.tsx @@ -42,6 +42,11 @@ const weatherMap: Record = { const engineHtml = `