vetkit.cordova.config.navigation-any
The Cordova app lets its web view navigate to any URL (<allow-navigation href="*">). A malicious page loaded in the app gets access to the native plugin bridge.
Last updated:
Suite: Security
xml
The Cordova app lets its web view navigate to any URL (<allow-navigation href="*">). A malicious page loaded in the app gets access to the native plugin bridge.
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Restrict allow-navigation to the app's own HTTPS origins; open other links in the system browser.
References
Source: packages/engine/rules/sast/mobile.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.