I work on a large e-commerce project, the app in question is written in Kotlin (legacy code in Java). Recently we got the following question from the web team which instantly triggered my alarm bells: "but you could create a native method which receives X as String and then we can call this method from our side, passing X, technically this is possible on both sides".

Other devs say "but this is our own method and we know what is does". My gut feeling tells me it is a mistake to think in terms of high-level methods/functions at this point, the issue is rather that we are kinda opening our environment up. I am not quite sure what a malicious JS code could do in this case: use the aforementioned method call as an entry point into the app, then use reflection to find other callable stuff? Access the app's memory and dump the heap? Somehow inject and execute arbitrary code using the app's permissions?

My question: can anyone confirm my concerns and provide any (technical) examples of how a potential attack would look like if we allow calling a native method from the web?

  • How exactly would you call a native method using JS? To my knowledge, that would require some sort of API
    – user163495
    Nov 18, 2020 at 12:25
  • correct, they referenced this article medium.com/@sreeharikv112/…, the stuff is called JSBridge. The author also mentions security concerns, but does not go into details in this regard.
    – Droidman
    Nov 18, 2020 at 12:36
  • It definitely increases your attack surface, which increases your risk. What are the arguments for mixing native and web technologies?
    – user163495
    Nov 18, 2020 at 12:48
  • "it would simplify our tracking". Basically they want to pass a fat key-value pair using this approach so we can feed it "as-is" into a native SDK for further processing. We (native Android team) could veto this approach, however I need some solid arguments to convince the others. Unfortunately I'm not a security expert but rather a security-minded dev, this is why I'm asking for some examples of how such attack might look like.
    – Droidman
    Nov 18, 2020 at 13:04


You must log in to answer this question.

Browse other questions tagged .