Repository navigation
Document web view security for untrusted code - #602
Merged
Merged
Conversation
The web view can load code from outside your app bundle: remote URLs, third-party scripts, inline or user-supplied HTML/JS. That code runs on the app's own origin and, in PHP mode, can reach the native bridge, so a malicious or compromised script has the same reach as your own code. Add a short callout to the Mobile v4 Web View page and a matching note in the v3 to v4 upgrade guide advising developers to treat the web view as an untrusted-code boundary and to prefer code shipped in their own app bundle. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds short web-view security guidance to the Mobile v4 docs in two places:
resources/views/docs/mobile/4/edge-components/web-view.md): a callout next to the existing "Locked down by default" note.resources/views/docs/mobile/4/getting-started/upgrade-guide.md): a short note in the "Upgrading To 4.0 From 3.x" section.Why: a web view runs on the app's own origin, so any script it loads runs with the app's privileges, and in PHP mode it can reach the native bridge and call native functions like the rest of the app. Loading code from outside the app bundle (remote URLs, third-party JavaScript, user-supplied HTML/JS) gives a malicious or compromised script that same reach. The docs didn't say this plainly, so this tells developers to treat the web view as an untrusted-code boundary and prefer loading only code that ships in their own app bundle.
Both additions follow each page's existing conventions (an
<aside>callout on the Web View page, a###subsection in the upgrade guide) and stay to a short paragraph plus a couple of bullets. Rendered both pages through the docs pipeline to confirm they parse and the links resolve.🤖 Generated with Claude Code