Not sure how it was evaluated dynamically that URL is not validated against an allowlist. This is a dynamic test so maybe it would be better to open a malicious URL and then see if shouldOverrideUrlLoading and shouldInterceptRequest block the request to prove validation. The same with the content. Maybe we can try to have a website with some SQL/JS injection and then see if it's blocked? Not sure exactly how we can demo it dynamically but for now the evaluation looks more related to static testing. cc: @cpholguera
Originally posted by @serek8 in #3570
Originally posted by @serek8 in #3570