MixinNetwork / MixinNetwork/flutter-plugins
[desktop_webview_window] No uri validation of incoming webmessages
@boyan01 is already working on this.
Since Dec 9, 2022.
- Dominant language
- C
- Stars
- 512
- Forks
- 292
- Avg merge
- 15h 8m
- Merged PRs (30d)
- 7
Description
Our latest pull #168 request added support for web messages from the flutter host process to the webview window and vice versa.
Messages received from the webview are currently not validated regarding the source uri as suggested in the documentation of the webview (https://learn.microsoft.com/de-de/microsoft-edge/webview2/reference/win32/icorewebview2?view=webview2-1.0.1418.22) under the paragraph concerning "add_WebMessageReceived".
For our application this doesnt matter, but it is a potential security issue and should be fixed by validating the source uri of incoming web messages.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.