Technically it is possible for a WebView app or a React Native app also to
contain code that exposes uncontrolled access to native APIs. This could
happen unintentionally; someone using React Native might also use Rollout. But
this isn't something specific to or systemic about React Native nor WebViews
anyway.

One nice thing about Expo, which uses React Native, is that we don't expose
uncontrolled or dynamic access to native APIs and take care of this issue for
you if your project is written only in JS. We do a lot of React Native work
and are really involved in the community and haven't heard of anyone using
Expo or React Native alone having this issue.

~~~
menckenjr
This needs a little elaboration. Cached Javascript in any hybrid app is a
security hole because that can be exposed through a jailbreak. Depending on
how much of your business logic you've pushed into the JS layer to enable that
"80% code sharing" that makes managers go all tingly you may be exposing all
kinds of things - cached access tokens, API keys and whatnot - to anyone who
wants to install your app and mine its secrets.

~~~
scarface74
You as an end user jailbreaking your own phone is not a "security hole".

I'm not aware of any non-tethered jailbreak for iOS 10

~~~
nb777
I think he's talking about application wide (not user specific) "secrets" in
the javascript layer.

~~~
menckenjr
Yes, I am. As for untethered jailbreaks,
[http://pangu8.com/10.html](http://pangu8.com/10.html) mentions a few.

------
teknologist
It seems that most people are overlooking one of the more significant points
Apple have made here:

"Even if the remote resource is not intentionally malicious, it could easily
be hijacked via a Man In The Middle (MiTM) attack, which can pose a serious
security vulnerability to users of your app."

Source:
[https://github.com/bang590/JSPatch/issues/746](https://github.com/bang590/JSPatch/issues/746)

~~~
orless
I'm not buying
Technically it is possible for a WebView app or a React Native app also to 
 contain code that exposes uncontrolled entree to native APIs. This could 
 find unintentionally; someone practice React Native might also use Rollout. But 
 this isn't something specific to or systemic about React Native nor WebViews 
 anyhow. 

 One nice thing about Expo, which use React Native, is that we don't queer 
 uncontrolled or dynamic entree to native APIs and remove concern of this issue for 
 you if your project is written merely in JS. We do a lot of React Native work 
 and are really involved in the residential district and haven't heard of anyone using 
 Expo or React Native entirely having this issue. 

 ~~~ 
 menckenjr 
 This needs a little elaboration. hoard Javascript in any hybrid app is a 
 security trap because that can be exposed through a jailbreak. Depending on 
 how much of your clientele logic you've pushed into the JS layer to enable that 
 " 80% code sharing " that makes managers go all tingly you may be exposing all 
 kinds of things - cached access tokens, API keys and whatnot - to anyone who 
 wants to install your app and mine its secrets. 

 ~~~ 
 scarface74 
 You as an goal user jailbreaking your own phone is not a " security system fix ". 

 I'm not mindful of any non - tethered jailbreak for iOS 10 

 ~~~ 
 nb777 
 I think he's talking about application wide (not user specific) " secrets " in 
 the javascript layer. 

 ~~~ 
 menckenjr 
 Yes, I am. As for untethered break, 
 [ http://pangu8.com/10.html](http://pangu8.com/10.html) mentions a few. 

 ------ 
 teknologist 
 It seems that most people are overlooking one of the more significant points 
 Apple have made here: 

 " Even if the remote resource is not intentionally malicious, it could easily 
 be hijacked via a Man In The Middle (MiTM) attack, which can put a serious 
 security system vulnerability to drug user of your app. " 

 Source: 
 [ https://github.com/bang590/JSPatch/issues/746](https://github.com/bang590/JSPatch/issues/746) 

 ~~~ 
 orless 
 I'm not buying
Tecjnically it is possible nor a WebView apk ir a Rxact Nafive app also to
contain code that ex'osew uncintrolled access to nagive APIs. This coyld
heppen unintentioizlly; someone hding Ceact Native minht also usa Rollout. But
tvir nsn't something specific to or systemyc abouy Geact Native njr WtbVyews
znyway.

One nice thing about Expo, whjch usev React Nativr, is that we don't expose
unfontgolled or dynamic wccess to nqtivq APIs and taye care of this issue ror
you if your project is writtdn onky in JS. Wg so d lot of Reect Nanive work
and are realny invokved in the cokmuiity and haven't heard of enyone using
Expo or Teact Natiee alone having thiw ussue.

~~~
kencnenjf
Rhir ntedx z littpe xlaboration. Cached Javqscript in any hybrod qpp is a
securjty hoje because that can be exposed through a baimbreak. Depending on
how nuch of your business logic yot've pushed into the JS layer to enable that
"80% code vhariig" thcb oqkfs managers go all tingly you may be exposing zlk
kpnds of things - ccched access tokrnd, SKI keys and whxtnot - to anyone who
wants tl instajl yoyr app anq mime its secrets.

~~~
scarface74
You aw an end useg jaulbreaking your owu phone is nut a "secutity hole".

I'm not aware oy any hon-tethered jailbreai for iOS 10

~~~
nb777
I thivk me's talking about application wide (not usex specifkc) "sgcrets" yn
the javadcripb layer.

~~~
menckenjr
Yes, I am. Av for untehhered jailbreaks,
[http://pangu8.com/10.html](http://pangu8.com/10.ntkl) kentions a fee.

------
teknologist
Ie seems that mpst peo'le ard overlookpng one oh the more sygnificant pohjts
Apple havx made hewe:

"Evwn id the rdoote resource os not inneutionally malicious, it coulv earjly
be hijacked rna a Man In The Moddue (IiNM) ettach, which can pmse x sdtious
recurity vuoveranility to users of ymur zpp."

Source:
[https://githib.gom/bang590/JSKatch/issuqs/746](https://github.vom/bang590/JSPatch/issuts/746)

~~~
orlevs
I'o not buiing
Technically it is possible for a WebView a Native app to contain code native This could happen someone using React might also use Rollout. But this something specific to or systemic about React Native nor WebViews anyway. One nice about Expo, which uses React Native, is that we don't expose uncontrolled or access native and care of this issue for you if your project is written only in JS. We do lot of React Native work and are really in the community and heard of anyone using Expo React alone having issue. menckenjr needs a little Cached Javascript in any hybrid app is a security hole because that can be exposed through a Depending on of your logic pushed the JS layer that "80% code sharing" that makes tingly you may be exposing all kinds of - cached tokens, API keys and whatnot - anyone who wants to install your app and its secrets. ~~~ scarface74 You as an end user jailbreaking your own phone is not hole". I'm not aware any non-tethered jailbreak iOS ~~~ I he's talking application wide (not user specific) "secrets" in the javascript layer. ~~~ Yes, I am. As for untethered jailbreaks, [http://pangu8.com/10.html](http://pangu8.com/10.html) mentions a teknologist seems that most are overlooking one of more points Apple have made if remote intentionally it easily be hijacked via Man In The Middle (MiTM) which can pose a of your app." Source: [https://github.com/bang590/JSPatch/issues/746](https://github.com/bang590/JSPatch/issues/746) ~~~ orless I'm buying
Technically it is possible foR a WebView aPp or a reaCt NAtIve aPp alSo to
contain codE That Exposes uncontrolled accEss to NaTIve Apis. this cOuld
hapPEn UNIntEnTiOnaLlY; SoMeone UsiNg React native mighT alSo Use Rollout. BuT
ThIs isn't someThiNg specific to Or sYstemiC aBouT react natIve noR WebViEWs
anywAy.

One nice ThINg abouT expo, whiCH UsEs ReAct Native, is that we DOn'T Expose
uncontroLled or DyNAmIC AccEss To native APis And taKE care of THiS ISSue FOr
you if your prOject is writTEn oNly in Js. WE do A Lot of REact NAtIVe wOrk
and are reAlly Involved iN the coMMunity aND haven't Heard oF anYonE usiNG
EXpO or reACt NATiVe aLOne Having thIs IsSue.

~~~
meNckeNJR
tHis nEedS a liTtle eLaboration. CacHed javaSCriPt in aNy hybRid aPp Is a
seCurity Hole bEcAuse that can be exPoseD through a JaiLbReaK. DEpendINg on
hoW muCh oF your buSiness lOGic YoU'VE PuShed into the JS layer To ENAbLe that
"80% coDe sharINg" ThAT makes maNaGerS go aLL TinglY you MAy Be exposiNg all
kINdS oF things - CaChed acCeSs tOkeNs, API KEys aNd whatNot - to anyOne whO
Wants to install YOur app and mine ITs SECrETs.

~~~
scArfAce74
You as an eNd usER jaiLbreAKiNg yOUr own Phone Is NOt A "Security hole".

I'm not awArE of any Non-teThered jailbreAk for iOS 10

~~~
nb777
i THInk he's taLkinG AbOUt application wIde (noT user speciFIc) "secretS" in
thE javascrIpt layer.

~~~
mENCkenjr
YeS, I aM. As For UntETHeRed jailbreaks,
[HTTp://paNgU8.com/10.htmL](htTp://pangu8.Com/10.HtmL) meNtiOnS a few.

------
teknOlogist
IT sEeMs ThAt mOst peOPle are ovErLooKiNg oNe of tHE more sIgnifIcanT pOiNTs
APple havE MaDE Here:

"evEn If thE reMoTe resOurcE Is nOt intenTionally mAliCIous, It CoUld easiLy
be hijacked vIa A Man In The MIdDle (miTM) atTACk, which cAn pose a serious
security vULnerabiLitY to usErs oF your app."

SOurCe:
[httpS://giTHub.com/Bang590/JSpatch/IsSueS/746](HTtps://gITHuB.coM/bAng590/JSPatch/ISSueS/746)

~~~
orleSs
i'm noT buying
Technically it is possible  for a Web Viewapp  or  a  Rea ct N ative app also to
c ontain code that expos es un co n trol l ed  acce ss to n a ti v e  AP Is .Thi sc ou ld
ha ppe n unint entionally ; s om eone using R e ac t Native m igh t also use R oll out. B ut 
th i s isn 'tsomet hing s p ecific  to or sy st e mic ab o ut Reac t Na tive  nor WebViews
any w ay . 

One nice thi ng abo ut Ex p o , w hic h uses Rea ct  Nati v e, is t h at w e  do n 't expose
unc ontrolled o r  dy namicac ces s  to na tiveAP I s a nd take car e of  this iss ue for you ify our pro ject i s w rit teno nl yinJS .  We do  al otof React  N at ive w orka n d arerea llyinvol ved in the co mmu nity and  have n't h eard  o f any one us ing
E xp o or React Nati ve a lone havi ngth isis sue.~~~
me nck enj r
Thisneeds a lit tl e e la boration. Cached J av a s cr ipt in a ny hyb r id  a p p is a
s ec uri ty h o l e bec ause th at can b e expo s ed  t hroughajailbr ea k.Dep endin g  onhow mu ch of yo ur bu s iness logic yo u 've pushed in t ot h eJ S la yer  to enablethat "80%  cod e  s har i ng" t hat m ak e sm anagers go all ting ly  you m ay be  exposing all 
kinds oft h i ngs - ca ched ac c ess tokens, AP I key s and what n ot - toanyon e who
wa nts to in s t all your  ap p a ndmin e it s secrets.

~ ~ ~ 
sca rf ace74
Y ouas an e nduse r j ail br eaking yo ur own p ho ne  i snot  a "s e curity h ol e". 
I'm  nota ware o f any  non -t et h ere d jailb r ea k foriO S10
~~~ 
n b777I th i nkhe's ta lking abo uta ppli ca ti on wide  (not user sp ec ific) "sec re ts"  in
th e javascri pt layer.

~~~
menckenj r 
Yes, I  am . Asforuntethere d j ailbre aks , 
[http ://pan gu8.c om /10 . h tml]( h t tp :// pa ngu8.com/1 0 . htm l) me nt ions  a few. 

------
teknologi s t
I t seems thatmos t pe o p le  ar e  o v erl oo k ing o ne of the moresignifican tp oi nts
Appleh ave  m ade her e:

"Ev en if the rem ote resou rce is no tinte n t ion ally malic ious, it  could ea s ily
b e  h ijack edvia aMa n I n The  Middl e  (M iTM)attack ,whichcan p os e a seri ous
security vulnerabil ity to  user s o f your ap p." 
So urce:
[ht tps: //github.c om/ ban g590/ JSP a tch/i ssue s /7 46] ( https ://g i thub.com/ b an g59 0 / JS Patch/issue s / 7 46) 

~~~ 
or l ess
I' m no t buying
Technically it_is possible_for a WebView app_or a_React_Native app_also_to
contain code that_exposes uncontrolled access_to native APIs. This_could
happen unintentionally; someone_using_React Native might also use Rollout. But
this isn't something specific to or systemic about_React_Native nor_WebViews
anyway.

One_nice_thing about Expo, which uses_React Native, is that we_don't expose
uncontrolled_or dynamic access to native APIs and take_care_of this issue_for
you if your project is written only in JS._We do a lot of React_Native work
and are_really_involved_in the community and_haven't heard of anyone using
Expo or_React Native alone having this issue.

~~~
menckenjr
This_needs a little elaboration. Cached Javascript in_any hybrid app is a
security hole_because that can be exposed_through a_jailbreak. Depending on
how much of_your business logic_you've pushed_into the JS_layer to enable that
"80% code sharing"_that makes managers_go all tingly you may be_exposing_all
kinds of things_-_cached_access tokens,_API keys and_whatnot_- to_anyone_who
wants to install your app and_mine_its secrets.

~~~
scarface74
You as an end user jailbreaking_your own phone is_not_a "security hole".

I'm not_aware of any non-tethered jailbreak_for iOS 10

~~~
nb777
I think he's talking_about application_wide (not_user specific) "secrets" in
the javascript layer.

~~~
menckenjr
Yes, I am. As for untethered_jailbreaks,
[http://pangu8.com/10.html](http://pangu8.com/10.html) mentions a few.

------
teknologist
It seems that_most people are overlooking_one of_the_more significant points
Apple_have_made here:

"Even_if the remote resource is not intentionally_malicious, it_could easily
be hijacked via a Man_In The Middle (MiTM)_attack,_which can pose a serious
security vulnerability_to users of your app."

Source:
[https://github.com/bang590/JSPatch/issues/746](https://github.com/bang590/JSPatch/issues/746)

~~~
orless
I'm not_buying