Enable Sandboxed JavaScript Injection Data Theorem finding

[utsavDave97]

• Hello, we have a Data theorem finding for our app for Enable Sandboxed JavaScript Injection the following code:

-[_TtC18MedalliaDigitalSDK27LoadSingleResourceOperation start]
-[_TtC18MedalliaDigitalSDK27MDUIModalFormViewController .cxx_destruct]
-[_TtC18MedalliaDigitalSDK27MDUIModalFormViewController initWithCoder:]
@"/Users/jenkins/workspace/igital_Mobile_MobileSDK-iOS_v4.4@2/MobileSDK/Components/Form/MDUIBaseFormViewController+Communicator.swift"
@" getDeviceData was called "
@"NebulaForm.setDeviceData('"
-[_OBJC_CLASS_$_NSBundle mainBundle]
-[_OBJC_CLASS_$_NSBundle bundleIdentifier]
-[(id) evaluateJavaScript:completionHandler:]

We are using medallia-digital-ios-sdk (4.5.1)

Recommendation:

When injecting JavaScript into a web page, utilize the iOS 14 APIs that allow sandboxed JavaScript execution. To do so, pass a WKContentWorld instance for the App JavaScript to execute within, which ensures code isolation from third-party JavaScript.

I was wondering if this is something which could be fixed. Thank you.

[OriMedallia]

Hi,

Please contact your Digital Expert with all the information including a video of the all the information you can share about this. Once the Digital Expert raises a ticket, we'll be able to prioritize it for the team.

Thanks, Ori

[utsavDave97]

@OriMedallia Thank you for your comment. Would you happen to know whats the tech risk for this finding?

[OriMedallia]

We'll have to investigate once a ticket is raised, but I can tell you that we have this code from day 1 (over 6 years, hundreds of customers are using it and we never had any issues.

In the investigation we'll check the option to start using WKContentWorld for iOS 14 and above

[utsavDave97]

@OriMedallia True that. Thank you again. Let me see about ticket. Appreciate it.

[utsavDave97]

@OriMedallia Also, would you happen to know how to raise a ticket?

[OriMedallia]

@utsavDave97 Please contact your Medallia Digital Expert. He's your company's contact person. Let me know the name of the company and the app you're working on and I'll try to help on my side as well.