Skip to content

Commit 352e94f

Browse files
committed
Fix format
1 parent 85787db commit 352e94f

File tree

1 file changed

+8
-8
lines changed

1 file changed

+8
-8
lines changed

tests-beta/android/MASVS-PLATFORM/MASTG-TEST-02te.md

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ profiles: [L1, L2]
1010

1111
## Overview
1212

13-
Android apps that have WebViews may also have WebViewNative bridges. These bridges can be added via the `addJavascriptInterface` method in the `WebView` class. They enable two-way communication: native code can pass data to the WebView, and JavaScript in the WebView can call into native code. Any website loaded inside the WebView, including those outside the organization's control, can access these bridges (if configured) whenever JavaScript is enabled with `setJavaScriptEnabled(true)`.
13+
Android apps that use WebViews may also include WebViewNative bridges. These bridges can be added via the `addJavascriptInterface` method in the `WebView` class. They enable two-way communication: native code can pass data to the WebView, and JavaScript in the WebView can call into native code. Any website loaded inside the WebView, including those outside the organization's control, can access these bridges (if configured) whenever JavaScript is enabled with `setJavaScriptEnabled(true)`.
1414

1515
The weakness could become a vulnerability if the WebView allows unencrypted (non-TLS) traffic (i.e., HTTPS) in combination with an XSS attack. Please refer to @MASTG-TEST-0235 to evaluate cleartext traffic.
1616

@@ -27,25 +27,25 @@ The weakness could become a vulnerability if the WebView allows unencrypted (non
2727

2828
1. Use a tool like @MASTG-TOOL-0110 to search for references to:
2929

30-
- the `setJavaScriptEnabled` method
31-
- the `addJavascriptInterface` method
32-
- the `@JavascriptInterface` annotation
30+
- the `setJavaScriptEnabled` method
31+
- the `addJavascriptInterface` method
32+
- the `@JavascriptInterface` annotation
3333

3434
## Observation
3535

3636
The output should contain a list of WebView instances, including the following methods and their arguments:
3737

38-
- `setJavaScriptEnabled`
39-
- `addJavascriptInterface` and their associated classes
40-
- `@JavascriptInterface` and their associated methods
38+
- `setJavaScriptEnabled`
39+
- `addJavascriptInterface` and their associated classes
40+
- `@JavascriptInterface` and their associated methods
4141

4242
## Evaluation
4343

4444
**Fail:**
4545

4646
The test fails automatically if all the following are true:
4747

48-
- the application is targeting API level 16 or lower.
48+
- The application is targeting API level 16 or lower.
4949
- `addJavascriptInterface` is used at least once.
5050

5151
The test also fails automatically if all the following are true:

0 commit comments

Comments
 (0)