Security vulnerabilities and automated fixes for weex issues
1 post found
A critical open redirect vulnerability was discovered in `weex/src/index.we` where the `onclick()` handler passed raw user input directly to `navigator.push()` without any URL validation. An attacker could supply a `javascript:` URI or a phishing URL, causing the app to navigate to arbitrary destinations. The fix adds a strict `https?://` protocol check before any navigation occurs.