According to Cure53, our current use of WebViews leaves open the possibility of an HTTP leak, akin to the following:
<em style="background: url('https://leak-here.com/test')">hello</em>One proposed solution was a content security policy, possibly implemented via a meta tag. The closest a CSP can come to this would be banning user created style attributes entirely. If we're okay with that, then a CSP is the perfect solution.
If we are not okay with that, then our next best bet is CSS sanitization, which is much more involved.
There may be other ways this could be addressed, let me know your thoughts or if you have alternative measures you'd like to discuss.
According to Cure53, our current use of WebViews leaves open the possibility of an HTTP leak, akin to the following:
One proposed solution was a content security policy, possibly implemented via a meta tag. The closest a CSP can come to this would be banning user created style attributes entirely. If we're okay with that, then a CSP is the perfect solution.
If we are not okay with that, then our next best bet is CSS sanitization, which is much more involved.
There may be other ways this could be addressed, let me know your thoughts or if you have alternative measures you'd like to discuss.