Home/ Questions/Q 6619599
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-25T20:59:24+00:00

Is there a recommended way to remove access to unneeded PhoneGap APIs? For example

  • 0

Is there a recommended way to remove access to unneeded PhoneGap APIs?

For example our app does not need to access the contact database.

With normal web pages, an XSS vulnerability is sandboxed to only affect one site (the browser prevents any contagion to other sites). With a PhoneGap application, by default, an XSS vulnerability can access the contacts list or any other part of the PhoneGap API.

I want to avoid the Skype situation where an XSS vunerability in Skype allowed an attacker to copy the address books of their users: http://www.macnn.com/articles/11/09/20/users.address.books.could.be.copied/

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    In your app, under PhoneGap.plist/Plugins, remove any rows for plugins that are not needed – this will remove access from JavaScript.

    • 0