# Deep link data into code or markup

Deep-link or intent URL reaching eval, JS string, or HTML without escaping quotes or markup

_Area: Mobile app security. Seen in 3 disclosed reports; latest 2022-09-23. Updated 2026-11-02._

## How it works

A deep link, intent URL, or page metadata is treated as data but is placed into a context that parses it as code or markup. The assumption that breaks: the app assumes the URL is "just a string" and that its escaping helper makes it safe. In practice the string is concatenated into a JS `eval`/`stringByEvaluatingJavaScriptFromString` call, into a WebView URL, or into an HTML template, and the escaping used does not cover the characters that matter (quotes, parentheses, angle brackets). The attacker controls those characters, breaks out of the string or tag, and the app executes the result with its own privileges.

## Where it shows up

- Native code building a JS call from a URL argument, e.g. `handleDeepLink('%s')` [E2](https://bugbountylibrary.com/r/h1%3A79348.md)
- WebView loading a deep-link URL directly, with JavaScript enabled and `@JavascriptInterface` bridges exposed [E1](https://bugbountylibrary.com/r/h1%3A1343300.md)
- Reader/article renderers that rebuild HTML from scraped title, author, or byline fields [E3](https://bugbountylibrary.com/r/h1%3A176065.md)
- Escaping done with percent-escape helpers (`stringByAddingPercentEscapesUsingEncoding`) that leave quotes intact [E2](https://bugbountylibrary.com/r/h1%3A79348.md)
- Any `loadUrl`/`evaluateJavascript`/`stringByEvaluatingJavaScriptFromString` whose argument is built by concatenation

## How to review

The invariant: every attacker-influenced value must be encoded for the exact sink it enters, and the encoding must cover the delimiter characters of that sink.

- For a JS string literal, confirm single and double quotes, backslash, and newline are escaped, not just percent-encoded [E2](https://bugbountylibrary.com/r/h1%3A79348.md).
- For HTML, confirm `<`, `>`, `&`, and quotes are entity-encoded on every metadata field [E3](https://bugbountylibrary.com/r/h1%3A176065.md).
- For WebViews, check whether JS is enabled and whether bridges are attached to pages that can be reached by a deep link [E1](https://bugbountylibrary.com/r/h1%3A1343300.md).
- Trace the deep-link/intent handler to the sink; if any path reaches it without context-correct encoding, it is unsafe.
- Prefer passing data as arguments (JSON, `evaluateJavascript` with a serialized value) over string interpolation.

## How finders spotted it

- Read the Objective-C URL handler `-[SLAppDelegate handleURLEvent:withReplyEvent:]`, saw input interpolated into a JS format string, and checked which characters the chosen escape function actually escapes [E2](https://bugbountylibrary.com/r/h1%3A79348.md).
- Noticed a WebView loading deep-link URLs unsanitized while JS and native interfaces were enabled, then tested a quote/paren breakout through the URL parameter [E1](https://bugbountylibrary.com/r/h1%3A1343300.md).
- Reviewed the decompiled renderer class and saw title and author appended into HTML strings without encoding [E3](https://bugbountylibrary.com/r/h1%3A176065.md).

## Variants seen

- JS string-literal breakout in a desktop protocol handler [E2](https://bugbountylibrary.com/r/h1%3A79348.md)
- Unsanitized deep-link URL loaded into a bridged WebView [E1](https://bugbountylibrary.com/r/h1%3A1343300.md)
- HTML injection from scraped page metadata in a reader renderer [E3](https://bugbountylibrary.com/r/h1%3A176065.md)

## Impact and severity

Injection runs with the app's own JS/bridge privileges. In E1, bridge access (`NativeApp`) escalated a data leak to potential native code access, hitting confidentiality, integrity, and availability. E2 allowed posting messages as the user. E3 allowed HTML/JS injection into the reader. Severity rises with bridge exposure and with how much account data or native capability the WebView can reach [E1](https://bugbountylibrary.com/r/h1%3A1343300.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1343300.md
- E2: https://bugbountylibrary.com/r/h1%3A79348.md
- E3: https://bugbountylibrary.com/r/h1%3A176065.md