commit | 8d3f86bfae1918ba2420653dd2f6f5ab922e9e9b | [log] [tgz] |
---|---|---|
author | Ross Donald <rossdonald97@users.noreply.github.com> | Tue Jul 31 16:21:07 2018 +0200 |
committer | Jan Piotrowski <piotrowski+github@gmail.com> | Tue Jul 31 16:21:07 2018 +0200 |
tree | 6fd302263a97d0a0b8fb3e396e974ad821b6981d | |
parent | aed9b33e69da6a444b3dbb82a61dd0a371c1699b [diff] |
Clarify unconfigured Intent Whitelist behaviour (#26) * Incorrect default value listing for Intents Within the "Intent Whitelist" subheading the statement saying that the default blocks all external URLs is incorrect. Currently a newly generated Cordova project actually allows http://*/*, https://*/*, tel:*, sms:*, mailto:*, geo:* and depending on platform may include items such as market:* too. These would be classed as external URLs so I'd say the documentation should say that all URLs are allowed and advise developers to manually put in their own intent declarations that narrow this down. * Changed wording in intent description due to ambiguity Removed using the term 'default' from the Intent whitelist description and instead explained that simply with a blank file what would occur. This was due to difficulties when deciding whether default meant blank config.xml or whether a newly generated Cordova project could instead be classed as default. A newly generated project actually allows *all* URLs instead of none. * some more docs wrangling
This plugin implements a whitelist policy for navigating the application webview on Cordova 4.0
:warning: Report issues on the Apache Cordova issue tracker
You can install whitelist plugin with Cordova CLI, from npm:
$ cordova plugin add cordova-plugin-whitelist $ cordova prepare
Controls which URLs the WebView itself can be navigated to. Applies to top-level navigations only.
By default navigations are only allowed to file://
URLs. To allow others URLs, you must add <allow-navigation>
tags to your config.xml
:
<!-- Allow links to example.com --> <allow-navigation href="http://example.com/*" /> <!-- Wildcards are allowed for the protocol, as a prefix to the host, or as a suffix to the path --> <allow-navigation href="*://*.example.com/*" /> <!-- A wildcard can be used to whitelist the entire network, over HTTP and HTTPS. *NOT RECOMMENDED* --> <allow-navigation href="*" /> <!-- The above is equivalent to these three declarations --> <allow-navigation href="http://*/*" /> <allow-navigation href="https://*/*" /> <allow-navigation href="data:*" />
Quirks: on Android it also applies to iframes for non-http(s) schemes.
Controls which URLs the app is allowed to ask the system to open.
In config.xml
, add <allow-intent>
tags, like this:
<!-- Allow links to web pages to open in a browser --> <allow-intent href="http://*/*" /> <allow-intent href="https://*/*" /> <!-- Allow links to example.com to open in a browser --> <allow-intent href="http://example.com/*" /> <!-- Wildcards are allowed for the protocol, as a prefix to the host, or as a suffix to the path --> <allow-intent href="*://*.example.com/*" /> <!-- Allow SMS links to open messaging app --> <allow-intent href="sms:*" /> <!-- Allow tel: links to open the dialer --> <allow-intent href="tel:*" /> <!-- Allow geo: links to open maps --> <allow-intent href="geo:*" /> <!-- Allow all unrecognized URLs to open installed apps *NOT RECOMMENDED* --> <allow-intent href="*" />
Without any <allow-intent>
tags, no requests to external URLs are allowed. However, the default Cordova application includes a quite liberal set of allow-intent
entries by default. It is advised to narrow this down based on each app's needs.
On Android, this equates to sending an intent of type BROWSEABLE.
This whitelist does not apply to plugins, only hyperlinks and calls to window.open()
.
Controls which network requests (images, XHRs, etc) are allowed to be made (via cordova native hooks).
Note: We suggest you use a Content Security Policy (see below), which is more secure. This whitelist is mostly historical for webviews which do not support CSP.
In config.xml
, add <access>
tags, like this:
<!-- Allow images, xhrs, etc. to google.com --> <access origin="http://google.com" /> <access origin="https://google.com" /> <!-- Access to the subdomain maps.google.com --> <access origin="http://maps.google.com" /> <!-- Access to all the subdomains on google.com --> <access origin="http://*.google.com" /> <!-- Enable requests to content: URLs --> <access origin="content:///*" /> <!-- Don't block any requests --> <access origin="*" />
Without any <access>
tags, only requests to file://
URLs are allowed. However, the default Cordova application includes <access origin="*">
by default.
Note: Whitelist cannot block network redirects from a whitelisted remote website (i.e. http or https) to a non-whitelisted website. Use CSP rules to mitigate redirects to non-whitelisted websites for webviews that support CSP.
Quirk: Android also allows requests to https://ssl.gstatic.com/accessibility/javascript/android/ by default, since this is required for TalkBack to function properly.
Controls which network requests (images, XHRs, etc) are allowed to be made (via webview directly).
On Android and iOS, the network request whitelist (see above) is not able to filter all types of requests (e.g. <video>
& WebSockets are not blocked). So, in addition to the whitelist, you should use a Content Security Policy <meta>
tag on all of your pages.
On Android, support for CSP within the system webview starts with KitKat (but is available on all versions using Crosswalk WebView).
Here are some example CSP declarations for your .html
pages:
<!-- Good default declaration: * gap: is required only on iOS (when using UIWebView) and is needed for JS->native communication * https://ssl.gstatic.com is required only on Android and is needed for TalkBack to function properly * Disables use of eval() and inline scripts in order to mitigate risk of XSS vulnerabilities. To change this: * Enable inline JS: add 'unsafe-inline' to default-src * Enable eval(): add 'unsafe-eval' to default-src --> <meta http-equiv="Content-Security-Policy" content="default-src 'self' data: gap: https://ssl.gstatic.com; style-src 'self' 'unsafe-inline'; media-src *"> <!-- Allow everything but only from the same origin and foo.com --> <meta http-equiv="Content-Security-Policy" content="default-src 'self' foo.com"> <!-- This policy allows everything (eg CSS, AJAX, object, frame, media, etc) except that * CSS only from the same origin and inline styles, * scripts only from the same origin and inline styles, and eval() --> <meta http-equiv="Content-Security-Policy" content="default-src *; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'"> <!-- Allows XHRs only over HTTPS on the same domain. --> <meta http-equiv="Content-Security-Policy" content="default-src 'self' https:"> <!-- Allow iframe to https://cordova.apache.org/ --> <meta http-equiv="Content-Security-Policy" content="default-src 'self'; frame-src 'self' https://cordova.apache.org">