针对Android WebView的跨站脚本攻击
Cross-site Scripting Attacks on Android WebView
摘要：
WebView是Android和iOS中必不可少的组件。它使应用程序能够显示来自在线资源的内容。它简化了执行网络请求、解析数据和渲染数据的任务。WebView使用许多API，可以与WebView内部的Web内容进行交互。在本文中，我们讨论了针对Android WebView的跨站脚本攻击或XSS攻击。跨站脚本（XSS）是Web应用程序中常见的一种漏洞。此漏洞使攻击者能够通过HttpClient API在受害者的WebView中运行恶意代码。使用此恶意代码，攻击者可以窃取受害者的凭据，例如cookie。浏览器用来保护这些凭据的访问控制策略（即同源策略）可以通过利用XSS漏洞绕过。
英文摘要：
WebView is an essential component in Android and iOS. It enables applications to display content from on-line resources. It simplifies task of performing a network request, parsing the data and rendering it. WebView uses a number of APIs which can interact with the web contents inside WebView. In the current paper, Cross-site scripting attacks or XSS attacks specific to Android WebView are discussed. Cross site scripting (XSS) is a type of vulnerability commonly found in web applications. This vulnerability makes it possible for attackers to run malicious code into victim's WebView,through HttpClient APIs. Using this malicious code, the attackers can steal the victim's credentials, such as cookies. The access control policies (that is,the same origin policy) employed by the browser to protect those credentials can be bypassed by exploiting the XSS vulnerability.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
