Security
Understand how EasyCord protects native hardware and application data from malicious scripts.
Overview
Hybrid applications expose native operating system capabilities to a web view. If an attacker injects malicious JavaScript into the web view (e.g., via Cross-Site Scripting), they could theoretically access the camera, read local files, or execute native code.
EasyCord mitigates these risks using a capability-based allowlist, strict iframe isolation, and origin locking.
Capability-Based Allowlist
The EasyCord Bridge rejects all native method invocations unless the method string explicitly exists in easycord_permissions.yaml.
If an attacker injects a script that calls window.easycord.call('deleteDatabase'), the bridge blocks the call and throws a MethodNotAllowedError if deleteDatabase is not whitelisted.
Example Configuration
# Only these methods execute natively. All others fail immediately.
permissions:
- getBatteryLevel
- camera_takePhoto
- fs_readFileSecure Storage
Browsers store window.localStorage and IndexedDB data in plain text on the device filesystem. Rooted or compromised devices can extract this data.
EasyCord provides a Secure Storage API that encrypts data using the native iOS Keychain and Android Keystore.
// Encrypts and stores the token securely in the native OS Keychain
await window.easycord.secureStorage.setItem('auth_token', 'secret_token');For applications that cannot easily migrate off window.localStorage, EasyCord includes a Transparent LocalStorage Interceptor. When enabled in easycord_permissions.yaml, EasyCord overrides the window.localStorage object globally and routes all synchronous calls to the encrypted native keychain.
WebView Origin Locking
EasyCord natively intercepts all navigation requests within the WebView.
If a user clicks an external link (e.g., https://example.com), the WebView blocks the navigation. The native bridge strictly binds to your application's initial origin domain (e.g., localhost or your bundled assets:// scheme). This prevents attackers from redirecting the WebView to a malicious origin while retaining bridge access.
Iframe Isolation
Third-party iframes (such as advertisements, support chat widgets, or embedded videos) run within the same WebView.
To prevent third-party iframes from accessing native hardware, EasyCord injects the window.easycord API exclusively into the main frame (forMainFrameOnly: true). Scripts executing inside iframes cannot invoke native methods.
Path Traversal Protection
Native plugins that read or write files (FileSystem, SQLite, Audio, OTA Updates) perform strict boundary checks.
The FileSystem API rejects any file path that attempts to traverse outside the sandboxed Application Documents directory. The OTA Manager mitigates Zip Slip attacks by verifying the extraction path of every file inside downloaded update archives.
Content Security Policy (CSP)
Configure a strict Content Security Policy in your index.html.
Because EasyCord injects the bridge directly via native OS APIs, it does not require external script tags. You can restrict script execution entirely to your own domain.
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:;">