Secure-Coding

Android WebView is one of those features that feels harmless right up until it becomes your app’s biggest security problem. If you render untrusted HTML, expose Java objects to JavaScript, or load mixed app and remote content into the same WebView, you are building an XSS target. The twist is that XSS in WebView is often worse than browser XSS, because the payload can sometimes reach native app capabilities. That changes the impact from “someone ran JavaScript in a page” to “someone ran JavaScript inside my app.” ...

Cross-site scripting is still one of the easiest ways to turn a tiny frontend mistake into a full account takeover. I’ve seen teams spend weeks hardening auth flows while leaving a innerHTML assignment sitting in a comment widget like a loaded gun. The tricky part is that “XSS payloads” are not all the same. Some rely on raw <script> injection. Some abuse HTML attributes. Some hide inside JavaScript URLs, SVG, Markdown, or template rendering. If you only block one shape, the others get through. ...

ServiceNow is one of those platforms where people assume the framework will save them. Sometimes it does. Sometimes it absolutely does not. I’ve seen teams build solid workflows, ACLs, and integrations, then quietly ship stored XSS through a widget, a Jelly page, or a badly handled g_form.addInfoMessage() call. The dangerous part is that ServiceNow mixes platform abstractions with plain old web rendering. If user-controlled data lands in HTML, JavaScript, or the DOM without the right encoding, you still have the same browser-side problem you’d have in any other app. ...