rules-cordova

Cordova config.xml allows any URL to be opened externally (allow-intent href='*'). This allows the app to be redirected to open arbitrary URLs — including custom scheme handlers and malicious deep links — in the system browser. Enumerate the specific schemes and domains your app needs (e.g., 'https://*.example.com' and 'mailto:*').

cordova.exec() detected — Cordova native bridge call. Ensure the plugin and method name are from a trusted, maintained plugin. User-controlled data passed to cordova.exec() arguments can be misused if the native plugin does not validate inputs.

android:debuggable="true" in AndroidManifest.xml enables ADB-level debugging access to the app on any device, including production. Attackers with USB or ADB network access can dump memory, bypass authentication, and inspect WebView content. Remove this attribute — release builds set debuggable=false automatically when signed with a release key.

window.plugins is a legacy Cordova plugin namespace. Modern Cordova plugins register under cordova.plugins or expose a top-level global. Migrate to the plugin's current API and verify the plugin is actively maintained.

Cordova app index.html is missing a Content-Security-Policy meta tag. Without a CSP, any injected script in the WebView can call cordova.exec() and access native device APIs (camera, contacts, filesystem). Add a strict CSP: "default-src 'self'; script-src 'self'; object-src 'none'" and avoid 'unsafe-inline'.

Cordova config.xml allows navigation to any URL (allow-navigation href='*'). This permits WebView navigation to arbitrary attacker-controlled pages, enabling phishing, data exfiltration, and Cordova bridge abuse. Restrict allow-navigation to the exact origins your app navigates to, and use allow-intent for external URLs opened in the system browser.