viewcontroller using a NULL baseURL argument with the loadHTMLString baseURL method : data theorem

Question

I am facing the problem "MyViewcontroller using a NULL baseURL argument with the loadHTMLString baseURL method : data theorem"- i have successfully completed my task and all are working fine.

The Issue was in the OSWAP security scan for vulnerability it shows the above error.

My code snippet:-

  NSString *aHtmlString = kEmptyString;

    // Getting the bool from configuration plist
    NSString *thePlistPath = [[NSBundle mainBundle] pathForResource:@"config" ofType:@"plist"];
    NSDictionary *theURLdata = [[NSDictionary alloc] initWithContentsOfFile:thePlistPath];
    is

ServerFAQAvailable = [[theURLdata valueForKey:kIsServerFAQAvailableKey] boolValue];

if (one || two || three) {
   aHtmlString = [self loadFAQFor];
} else {
  aHtmlString = [self loadFAQForwithout];
}
NSURL *baseURL = [NSURL fileURLWithPath:thePlistPath];

[self.faqWebView loadHTMLString:aHtmlString baseURL:baseURL];

Update:

if (one || two || three) {
       aHtmlString = [self loadFAQFor];
    } else {
      aHtmlString = [self loadFAQForwithout];
    }
    NSURL *baseURL = [NSURL fileURLWithPath:@"about:blank"];

    [self.faqWebView loadHTMLString:aHtmlString baseURL:baseURL];

Still shows me scan issue

I would start by logging the values of thePlistPath (and possibly theURLdata), and verifying that you actually have a file at the location pointed to by thePlistPath. If you don't, then [NSURL fileURLWithPath:thePlistPath]; will likely return nil and theURLdata will also likely be nil. — fullofsquirrels
– fullofsquirrels, Commented Jul 22, 2016 at 16:14
what is ee, yy and ii ? please use clear variable names, also what's the values of kConfigurationPlistName and kPlistFormType ? does that set the value of thePlistPath properly or is it Nil ? — Mostafa Berg
– Mostafa Berg, Commented Jul 25, 2016 at 10:50
@MostafaTorbjørnBerg hi that is the condition based variables in the loadFAQForewithout inside i am constructing the html .js and .css file — Arun
– Arun, Commented Jul 25, 2016 at 11:03
Two days only there i am available on next 48 hours . anybody need more information means feel free to ask . any hint will be help full . — Arun
– Arun, Commented Jul 26, 2016 at 7:05
have you tried just passing [NSURL new] in baseURL param. — Sunil Sharma
– Sunil Sharma, Commented Jul 27, 2016 at 18:35

Mike Sand · Accepted Answer · 2016-07-25 23:21:44Z

5

+25

The issue is the baseURL: parameter. BaseURL isn't needed for an html string, it is usually used for relative links. If all you're trying to do is show some html, are you sure you need it?

The security issue flagged makes sense (my understanding, roughly): If a webview's baseURL is set to the local file system, then a page loaded (eventually) through that webview could access local resources.

Try passing nil for baseURL: should silence this warning.

answered Jul 25, 2016 at 23:21

Mike Sand

2,76017 silver badges23 bronze badges

Sign up to request clarification or add additional context in comments.

9 Comments

Arun Over a year ago

Related url in that means What ? Could you please provided details

Arun Over a year ago

Relative path in the sense ?..., this is also relative path right [NSURL fileURLWithPath:@"about:blank"]

Arun Over a year ago

you have any suggestion on about giving relative path

Mike Sand Over a year ago

@Spynet ("about:blank" --I'm not sure how UIWebView handles that.) Regardless, a relative link is relative to the base URL. On the normal internet, if a webpage starts at "website.com/about" the BaseURL would be website.com and a relative link would be "/services"--don't need full address. But a URL can be for files and a base URL to the local directory. In this case, the webview gets special permission to read local files. If that html links to an external page, the UIWebView will still have that permission, and (apparently) that page could read local files-- this is the security issue.

Mike Sand Over a year ago

If do you want relative local-directory links, to get around the security issue you could implement the webview delegate and intercept clicked links, recreating the full relative path. If all you want to do is show local html, you don't need a base URL and set it to nil.

|

Muhammad Abdul Arif Sarker · Accepted Answer · 2016-07-28 04:35:31Z

1

baseURL should be [[NSBunld mainBunld] bunldPath], you can try like this..

NSString *path = [[NSBundle mainBundle]bundlePath];
NSString *htmlPath = [[NSBundle mainBundle] pathForResource:self.htmlName ofType:@"html"];
NSString *htmlContent = [NSString stringWithContentsOfFile:htmlPath encoding:NSUTF8StringEncoding error:nil];
[self.webView loadHTMLString:htmlContent baseURL:[NSURL fileURLWithPath:path]];

edited Jul 28, 2016 at 4:35

Muhammad Abdul Arif Sarker

1,2194 gold badges15 silver badges25 bronze badges

answered Jul 28, 2016 at 3:21

zoulin

111 bronze badge

1 Comment

Arun Over a year ago

Lastly i found the right answer is [NSURL URLWithString:@"about:blank"], Thanks a for the help man

Collectives™ on Stack Overflow

viewcontroller using a NULL baseURL argument with the loadHTMLString baseURL method : data theorem

2 Answers 2

9 Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

9 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related