Cross-Site Scripting (ARCH8101)
Key kotlin.security.xss · Severity error · Category security · CWE CWE-79
Flags WebView HTML/JavaScript sinks (loadData, loadDataWithBaseURL, evaluateJavascript) fed with interpolated data, and javaScriptEnabled = true on a WebView.
Incorrect
Section titled “Incorrect”webView.loadData("<h1>$userName</h1>", "text/html", "utf-8")Correct
Section titled “Correct”webView.loadData("<h1>${Html.escapeHtml(userName)}</h1>", "text/html", "utf-8")Escape data before it reaches an HTML/JS sink; keep JavaScript disabled unless the page needs it.