Extraneous Functionality

JavaScript Enable in a Webview

The mobile application has enabled JavaScript in WebView. By default, JavaScript is disabled in WebView, if enabled it can bring various JS-related security issues, such as Cross-Site Scripting (XSS) attacks.

Example of insecure code:

WebSettings settings = webView.getSettings();
settings.setJavaScriptEnabled(true);