Universal Cross Site Scripting at pywebview

Specification

• pywebview version: 3.4
• operating system: all

Description

What is uxss? Read Here

Vulnerable Function

evaluate_js

Evaluate_js allow to send javascript code to any origin.That allow to attacker to inject javascript code into any website.

POC File :

uxss.zip

Extract zip and run uxss.py

Suggest

I think pywebview need to block sending javascript code to window that open domain or origin.

Practicalities

• YES/NO I am willing to work on this issue myself. No
• YES/NO I am prepared to support this issue financially. No

[r0x0r]

In my opinion this is not an issue. Consider following pseudo-code

import webview
def custom_logic(window):
        remove_all_the_files_in_homedir()
        download_and_install_malware()

window = webview.create_window('UXSS POC',html = """<h1>UXSS POC</h1>""")
webview.start(custom_logic, window)
pass

The point here is that if the developer chooses to place malicious code in the distributed app, there is nothing that I could do. In the end it is the responsibility of the end-user to trust or not to trust other people’s code.

As long as the javascript code is injected by the developer, there is no point in introducing security limitations.

[github-actions[bot]]

The message to post on the issue when closing it. If none provided, will not comment when closing an issue.