{'fraction_non_alphanumeric': 0.0128, 'fraction_numerical': 0.0048, 'mean_word_length': 5.077669902912621, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Toward Automated Scanning for Code Injection Vulnerabilities in HTML5-Based Mobile Apps

HTML5 mobile apps are subject to code injection attacks in which malicious code can be injected through various channels and then executed. This paper presents an environment for scanning potential code injection vulnerabilities in HTML5 Android apps. Our environment performs a black-box test that injects traceable HTML tags into an app running on a hardware device or an emulator through internal channels and then observes if some of the injected tags have been invoked. A prototype is being developed based on our proof-of-concept.