From ff84547670f8049db206d9b3f16281b774903483 Mon Sep 17 00:00:00 2001
From: pandeymangg <anshuman.pandey9999@gmail.com>
Date: Tue, 21 Jul 2026 11:44:58 +0530
Subject: [PATCH 1/5] restores default TLS validation in survey webview

---
 .../FormbricksSDK/WebView/SurveyWebView.swift |  9 ++--
 .../FormbricksSDKTests.swift                  | 49 +++++++++++++++++++
 2 files changed, 53 insertions(+), 5 deletions(-)

diff --git a/Sources/FormbricksSDK/WebView/SurveyWebView.swift b/Sources/FormbricksSDK/WebView/SurveyWebView.swift
index 671ccdd..d539ab5 100644
--- a/Sources/FormbricksSDK/WebView/SurveyWebView.swift
+++ b/Sources/FormbricksSDK/WebView/SurveyWebView.swift
@@ -92,11 +92,10 @@ extension SurveyWebView {
         }
         
         func webView(_ webView: WKWebView, didReceive challenge: URLAuthenticationChallenge, completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
-            if let serverTrust = challenge.protectionSpace.serverTrust {
-                completionHandler(.useCredential, URLCredential(trust: serverTrust))
-            } else {
-                 completionHandler(.useCredential, nil)
-            }
+            // Let the OS perform standard certificate-chain validation. Never force-trust
+            // arbitrary certificates, as that would disable TLS validation and expose the
+            // survey WebView traffic to man-in-the-middle interception.
+            completionHandler(.performDefaultHandling, nil)
         }
     }
 }
diff --git a/Tests/FormbricksSDKTests/FormbricksSDKTests.swift b/Tests/FormbricksSDKTests/FormbricksSDKTests.swift
index 83b9013..253d6f3 100644
--- a/Tests/FormbricksSDKTests/FormbricksSDKTests.swift
+++ b/Tests/FormbricksSDKTests/FormbricksSDKTests.swift
@@ -1,4 +1,5 @@
 import XCTest
+import WebKit
 @testable import FormbricksSDK
 
 final class FormbricksSDKTests: XCTestCase {
@@ -751,4 +752,52 @@ final class FormbricksSDKTests: XCTestCase {
 
         wait(for: [legacyExpectation, newExpectation], timeout: 2.0)
     }
+
+    /// Security regression guard: the survey WebView must delegate
+    /// TLS certificate validation to the OS and must never force-trust the
+    /// server certificate. Force-trusting any certificate disables chain
+    /// validation and exposes survey traffic to man-in-the-middle interception.
+    func testWebViewAuthChallengeUsesDefaultHandlingAndDoesNotForceTrust() {
+        let coordinator = SurveyWebView.Coordinator()
+        let webView = WKWebView()
+        let protectionSpace = URLProtectionSpace(
+            host: "example.com",
+            port: 443,
+            protocol: NSURLProtectionSpaceHTTPS,
+            realm: nil,
+            authenticationMethod: NSURLAuthenticationMethodServerTrust
+        )
+        let challenge = URLAuthenticationChallenge(
+            protectionSpace: protectionSpace,
+            proposedCredential: nil,
+            previousFailureCount: 0,
+            failureResponse: nil,
+            error: nil,
+            sender: NoopChallengeSender()
+        )
+
+        var capturedDisposition: URLSession.AuthChallengeDisposition?
+        var capturedCredential: URLCredential?
+        let handlerCalled = expectation(description: "completion handler called")
+        coordinator.webView(webView, didReceive: challenge) { disposition, credential in
+            capturedDisposition = disposition
+            capturedCredential = credential
+            handlerCalled.fulfill()
+        }
+        wait(for: [handlerCalled], timeout: 1.0)
+
+        XCTAssertEqual(capturedDisposition, .performDefaultHandling,
+                       "WebView must let the OS validate the certificate chain, not override it.")
+        XCTAssertNil(capturedCredential,
+                     "WebView must not supply a credential that force-trusts the server certificate (MITM risk).")
+    }
+}
+
+/// Minimal sender so a `URLAuthenticationChallenge` can be constructed in tests.
+/// The handler under test only inspects the disposition it hands back, so these
+/// callbacks intentionally do nothing.
+private final class NoopChallengeSender: NSObject, URLAuthenticationChallengeSender {
+    func use(_ credential: URLCredential, for challenge: URLAuthenticationChallenge) {}
+    func continueWithoutCredential(for challenge: URLAuthenticationChallenge) {}
+    func cancel(_ challenge: URLAuthenticationChallenge) {}
 }

From 4a7cfeed232e970d36db79b6b0240d996b502ff5 Mon Sep 17 00:00:00 2001
From: pandeymangg <anshuman.pandey9999@gmail.com>
Date: Tue, 21 Jul 2026 12:00:18 +0530
Subject: [PATCH 2/5] fix: harden survey webview (ENG-1811, ENG-1812, ENG-1813)

- ENG-1811: gate WKWebView.isInspectable behind #if DEBUG so the survey
  WebView is not inspectable in release builds.
- ENG-1812: restrict external URLs opened from survey content to http/https;
  refuse tel/sms/custom-app/file/javascript schemes.
- ENG-1813: base64-encode the survey payload before embedding it in the
  WebView HTML instead of splicing it into a JS template literal, removing
  the script-injection surface. Also drops the quote-mangling workaround
  that corrupted survey text containing double quotes.

Adds regression tests for ENG-1812 and ENG-1813 and updates the existing
WEBVIEW_DATA test to decode the base64 payload.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../WebView/FormbricksViewModel.swift         | 16 +++-
 .../FormbricksSDK/WebView/SurveyWebView.swift | 26 ++++++-
 .../FormbricksSDKTests.swift                  | 75 +++++++++++++++++--
 3 files changed, 103 insertions(+), 14 deletions(-)

diff --git a/Sources/FormbricksSDK/WebView/FormbricksViewModel.swift b/Sources/FormbricksSDK/WebView/FormbricksViewModel.swift
index 9500c14..3728a2b 100644
--- a/Sources/FormbricksSDK/WebView/FormbricksViewModel.swift
+++ b/Sources/FormbricksSDK/WebView/FormbricksViewModel.swift
@@ -10,7 +10,12 @@ final class FormbricksViewModel: ObservableObject {
         self.surveyId = surveyId
         if let webviewDataJson = WebViewData(workspaceResponse: workspaceResponse, surveyId: surveyId).getJsonString(),
            let surveyScriptUrl = FormbricksWorkspace.surveyScriptUrlString {
-            htmlString = htmlTemplate.replacingOccurrences(of: "{{WEBVIEW_DATA}}", with: webviewDataJson)
+            // Base64-encode the payload before injecting it into the HTML. Base64 output is
+            // limited to [A-Za-z0-9+/=], so survey content can no longer contain characters
+            // (backticks, `${...}`, quotes) that would break out of the surrounding JS string
+            // literal and execute as code. The WebView decodes it back to JSON at runtime.
+            let webviewDataBase64 = Data(webviewDataJson.utf8).base64EncodedString()
+            htmlString = htmlTemplate.replacingOccurrences(of: "{{WEBVIEW_DATA}}", with: webviewDataBase64)
                 .replacingOccurrences(of: "{{SURVEY_SCRIPT_URL}}", with: surveyScriptUrl)
         }
     }
@@ -33,7 +38,9 @@ private extension FormbricksViewModel {
             </body>
 
             <script type="text/javascript">
-                const json = `{{WEBVIEW_DATA}}`
+                // {{WEBVIEW_DATA}} is a base64-encoded JSON string (see FormbricksViewModel).
+                // Decode it as UTF-8 and parse it as JSON; it is never interpreted as code.
+                const json = new TextDecoder().decode(Uint8Array.from(atob("{{WEBVIEW_DATA}}"), c => c.charCodeAt(0)));
                 let surveyProps = '';
 
                 function onClose() {
@@ -130,7 +137,10 @@ private class WebViewData {
     func getJsonString() -> String? {
         do {
             let jsonData = try JSONSerialization.data(withJSONObject: data, options: [])
-            return String(data: jsonData, encoding: .utf8)?.replacingOccurrences(of: "\\\"", with: "'")
+            // Return valid JSON as-is. It is base64-encoded before being embedded in the
+            // WebView HTML, so there is no need to mangle embedded quotes here (doing so
+            // previously corrupted survey text that legitimately contained double quotes).
+            return String(data: jsonData, encoding: .utf8)
         } catch {
             Formbricks.logger?.error(error.message)
             return nil
diff --git a/Sources/FormbricksSDK/WebView/SurveyWebView.swift b/Sources/FormbricksSDK/WebView/SurveyWebView.swift
index d539ab5..0163775 100644
--- a/Sources/FormbricksSDK/WebView/SurveyWebView.swift
+++ b/Sources/FormbricksSDK/WebView/SurveyWebView.swift
@@ -25,9 +25,14 @@ struct SurveyWebView: UIViewRepresentable {
         webView.configuration.defaultWebpagePreferences.allowsContentJavaScript = true
         webView.isOpaque = false
         webView.backgroundColor = UIColor.clear
+        // Web Inspector is a debugging aid only; never expose the survey WebView
+        // to inspection in release builds (avoids leaking payload/responses and
+        // allowing DOM/JS tampering on production devices).
+        #if DEBUG
         if #available(iOS 16.4, *) {
             webView.isInspectable = true
         }
+        #endif
         webView.navigationDelegate = context.coordinator
         webView.uiDelegate = context.coordinator
         webView.scrollView.isScrollEnabled = false
@@ -105,11 +110,19 @@ extension SurveyWebView {
 final class JsMessageHandler: NSObject, WKScriptMessageHandler {
     
     let surveyId: String
-    
+
     init(surveyId: String) {
         self.surveyId = surveyId
     }
-   
+
+    /// Whether an external URL from survey content is safe to hand to the OS.
+    /// Only web links are allowed; other schemes (tel, sms, custom app deep links,
+    /// etc.) are refused so survey content cannot trigger unexpected native actions.
+    static func isAllowedExternalURL(_ url: URL) -> Bool {
+        guard let scheme = url.scheme?.lowercased() else { return false }
+        return scheme == "http" || scheme == "https"
+    }
+
     func userContentController(_ userContentController: WKUserContentController, didReceive message: WKScriptMessage) {
         Formbricks.logger?.debug(message.body)
         
@@ -130,8 +143,13 @@ final class JsMessageHandler: NSObject, WKScriptMessageHandler {
             
             /// Happens when the survey wants to open an external link in the default browser.
             case .onOpenExternalURL:
-                if let message = try? JSONDecoder().decode(OpenExternalUrlMessage.self, from: data), let url = URL(string:  message.onOpenExternalURLParams.url) {
-                    UIApplication.shared.open(url)
+                if let message = try? JSONDecoder().decode(OpenExternalUrlMessage.self, from: data),
+                   let url = URL(string: message.onOpenExternalURLParams.url) {
+                    if JsMessageHandler.isAllowedExternalURL(url) {
+                        UIApplication.shared.open(url)
+                    } else {
+                        Formbricks.logger?.warning("Blocked external URL with disallowed scheme: \(url.scheme ?? "nil")")
+                    }
                 }
                 
             /// Happens when the survey library fails to load.
diff --git a/Tests/FormbricksSDKTests/FormbricksSDKTests.swift b/Tests/FormbricksSDKTests/FormbricksSDKTests.swift
index 253d6f3..90c5850 100644
--- a/Tests/FormbricksSDKTests/FormbricksSDKTests.swift
+++ b/Tests/FormbricksSDKTests/FormbricksSDKTests.swift
@@ -546,19 +546,19 @@ final class FormbricksSDKTests: XCTestCase {
             return
         }
 
-        // Extract the JSON payload between backticks in `const json = `...``
-        guard let markerRange = html.range(of: "const json = `") else {
+        // The payload is base64-encoded and embedded as atob("...") (see ENG-1813).
+        // Extract the base64 blob, decode it, and parse the JSON.
+        guard let markerRange = html.range(of: "atob(\"") else {
             XCTFail("Marker not found")
             return
         }
         let start = markerRange.upperBound
-        guard let end = html[start...].firstIndex(of: "`") else {
-            XCTFail("End backtick not found")
+        guard let end = html[start...].firstIndex(of: "\"") else {
+            XCTFail("End quote not found")
             return
         }
-        let jsonSubstring = html[start..<end]
-        let jsonString = String(jsonSubstring)
-        guard let data = jsonString.data(using: .utf8),
+        let base64String = String(html[start..<end])
+        guard let data = Data(base64Encoded: base64String),
               let object = try? JSONSerialization.jsonObject(with: data) as? [String: Any] else {
             XCTFail("Invalid JSON in WEBVIEW_DATA")
             return
@@ -791,6 +791,67 @@ final class FormbricksSDKTests: XCTestCase {
         XCTAssertNil(capturedCredential,
                      "WebView must not supply a credential that force-trusts the server certificate (MITM risk).")
     }
+
+    /// Security regression guard (ENG-1812): external URLs coming from survey
+    /// content must be restricted to web schemes. Other schemes (tel, sms, custom
+    /// app deep links, file, javascript, etc.) must be refused so survey content
+    /// cannot trigger unexpected native actions.
+    func testExternalURLSchemeAllowlist() {
+        // Allowed
+        for allowed in ["https://formbricks.com", "http://example.com/path?q=1", "HTTPS://UPPER.example"] {
+            let url = URL(string: allowed)!
+            XCTAssertTrue(JsMessageHandler.isAllowedExternalURL(url), "\(allowed) should be allowed")
+        }
+        // Blocked
+        for blocked in ["tel:+123456789", "sms:+123456789", "mailto:a@b.com",
+                        "facetime:a@b.com", "file:///etc/passwd", "javascript:alert(1)",
+                        "whatsapp://send?text=hi", "myapp://do-something"] {
+            let url = URL(string: blocked)!
+            XCTAssertFalse(JsMessageHandler.isAllowedExternalURL(url), "\(blocked) should be blocked")
+        }
+    }
+
+    /// Security regression guard (ENG-1813): the survey payload must be embedded in
+    /// the WebView HTML as a base64 blob, never spliced raw into a JS template
+    /// literal. Base64 output cannot contain backticks, `${...}`, or quotes, so
+    /// survey content can no longer break out of the string literal and run as code.
+    func testWebViewPayloadIsBase64EncodedNotRawTemplateLiteral() {
+        let config = FormbricksConfig.Builder(appUrl: appUrl, workspaceId: workspaceId)
+            .setLogLevel(.debug)
+            .service(mockService)
+            .build()
+        Formbricks.setup(with: config)
+
+        Formbricks.surveyManager?.refreshWorkspaceIfNeeded(force: true)
+        let loaded = expectation(description: "Env loaded")
+        DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) { loaded.fulfill() }
+        wait(for: [loaded])
+
+        guard let workspace = Formbricks.surveyManager?.workspaceResponse else {
+            XCTFail("Missing workspaceResponse"); return
+        }
+        guard let html = FormbricksViewModel(workspaceResponse: workspace, surveyId: surveyID).htmlString else {
+            XCTFail("Missing htmlString"); return
+        }
+
+        // The old raw-template-literal injection must be gone.
+        XCTAssertFalse(html.contains("const json = `"),
+                       "Payload must not be spliced into a JS template literal (script-injection risk).")
+
+        // The payload must be delivered via atob("...") and the blob must be pure base64.
+        guard let start = html.range(of: "atob(\"")?.upperBound,
+              let end = html[start...].firstIndex(of: "\"") else {
+            XCTFail("Base64 payload marker not found"); return
+        }
+        let blob = String(html[start..<end])
+        XCTAssertFalse(blob.isEmpty, "Payload blob should not be empty")
+        let base64Charset = CharacterSet(charactersIn: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=")
+        XCTAssertTrue(blob.unicodeScalars.allSatisfy { base64Charset.contains($0) },
+                      "Embedded payload must be pure base64 — no characters that could break out of the JS string.")
+        // And it must decode back to valid JSON.
+        XCTAssertNotNil(Data(base64Encoded: blob).flatMap { try? JSONSerialization.jsonObject(with: $0) },
+                        "Base64 payload must decode to valid JSON.")
+    }
 }
 
 /// Minimal sender so a `URLAuthenticationChallenge` can be constructed in tests.

From cfb58e4c8636eda59dfca31ac3d15bf64df4274b Mon Sep 17 00:00:00 2001
From: pandeymangg <anshuman.pandey9999@gmail.com>
Date: Tue, 21 Jul 2026 12:03:29 +0530
Subject: [PATCH 3/5] chore: silence unused-parameter warning in auth-challenge
 handler

The challenge parameter is unused now that the handler always performs
default TLS handling; name it _ to satisfy SonarQube.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 Sources/FormbricksSDK/WebView/SurveyWebView.swift | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Sources/FormbricksSDK/WebView/SurveyWebView.swift b/Sources/FormbricksSDK/WebView/SurveyWebView.swift
index 0163775..bfa170e 100644
--- a/Sources/FormbricksSDK/WebView/SurveyWebView.swift
+++ b/Sources/FormbricksSDK/WebView/SurveyWebView.swift
@@ -96,7 +96,7 @@ extension SurveyWebView {
             completionHandler()
         }
         
-        func webView(_ webView: WKWebView, didReceive challenge: URLAuthenticationChallenge, completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
+        func webView(_ webView: WKWebView, didReceive _: URLAuthenticationChallenge, completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
             // Let the OS perform standard certificate-chain validation. Never force-trust
             // arbitrary certificates, as that would disable TLS validation and expose the
             // survey WebView traffic to man-in-the-middle interception.

From 28ba576b53c72180702c8b4461dac4053915116a Mon Sep 17 00:00:00 2001
From: pandeymangg <anshuman.pandey9999@gmail.com>
Date: Tue, 21 Jul 2026 17:42:01 +0530
Subject: [PATCH 4/5] fix: enforce external-URL allowlist on direct WebView
 navigation (ENG-1812)

Review found the scheme allowlist was only checked in the onOpenExternalURL
JS-bridge path. Direct navigation from survey markup (<a href="tel:...">,
window.location, meta refresh, form POST) bypassed it and reached WKWebView's
native scheme handling.

Add decidePolicyForNavigationAction to the Coordinator: only the in-memory
survey document loads in-frame; every other navigation is cancelled and routed
through the shared openExternalURL helper (http/https opened, everything else
blocked). The allowlist is now enforced on both the bridge and direct navigation.

Tests:
- navigation policy (about:blank/nil load in-frame; web + non-web schemes do not)
- non-serverTrust auth challenges also use .performDefaultHandling
- quotes and angle brackets in survey content survive the base64 round-trip
  (guards the removed \"->' mangling)
- dedupe the atob(...) payload extraction into one helper

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../FormbricksSDK/WebView/SurveyWebView.swift |  44 ++++++-
 .../FormbricksSDKTests.swift                  | 114 +++++++++++++++---
 2 files changed, 135 insertions(+), 23 deletions(-)

diff --git a/Sources/FormbricksSDK/WebView/SurveyWebView.swift b/Sources/FormbricksSDK/WebView/SurveyWebView.swift
index bfa170e..3aa9256 100644
--- a/Sources/FormbricksSDK/WebView/SurveyWebView.swift
+++ b/Sources/FormbricksSDK/WebView/SurveyWebView.swift
@@ -102,6 +102,25 @@ extension SurveyWebView {
             // survey WebView traffic to man-in-the-middle interception.
             completionHandler(.performDefaultHandling, nil)
         }
+
+        func webView(_ webView: WKWebView, decidePolicyFor navigationAction: WKNavigationAction, decisionHandler: @escaping (WKNavigationActionPolicy) -> Void) {
+            let url = navigationAction.request.url
+            // The survey is an in-memory document (loaded via loadHTMLString) rendered by the
+            // JS library; it never legitimately navigates its own frame. Allow that base
+            // document, and treat any other navigation — a link tap, window.location, meta
+            // refresh or form submit from survey markup — as an attempt to leave the survey.
+            // Route those through the same http/https allowlist as the JS bridge so a
+            // `<a href="tel:...">` (etc.) can't reach WKWebView's native scheme handling and
+            // trigger unexpected native actions.
+            if JsMessageHandler.shouldAllowInWebViewNavigation(to: url) {
+                decisionHandler(.allow)
+            } else {
+                decisionHandler(.cancel)
+                if let url {
+                    JsMessageHandler.openExternalURL(url)
+                }
+            }
+        }
     }
 }
 
@@ -123,6 +142,25 @@ final class JsMessageHandler: NSObject, WKScriptMessageHandler {
         return scheme == "http" || scheme == "https"
     }
 
+    /// Whether a WebView navigation to `url` may proceed in-place. Only the in-memory
+    /// survey document (`about:blank`, i.e. loaded with a nil base URL) loads in-frame;
+    /// every other navigation is handled as an external link (see `openExternalURL`).
+    static func shouldAllowInWebViewNavigation(to url: URL?) -> Bool {
+        guard let scheme = url?.scheme?.lowercased() else { return true }
+        return scheme == "about"
+    }
+
+    /// Opens an external URL through the http/https allowlist, or blocks and logs it.
+    /// Shared by the JS bridge (`onOpenExternalURL`) and the navigation delegate so the
+    /// scheme allowlist is enforced on both paths.
+    static func openExternalURL(_ url: URL) {
+        guard isAllowedExternalURL(url) else {
+            Formbricks.logger?.warning("Blocked external URL with disallowed scheme: \(url.scheme ?? "nil")")
+            return
+        }
+        UIApplication.shared.open(url)
+    }
+
     func userContentController(_ userContentController: WKUserContentController, didReceive message: WKScriptMessage) {
         Formbricks.logger?.debug(message.body)
         
@@ -145,11 +183,7 @@ final class JsMessageHandler: NSObject, WKScriptMessageHandler {
             case .onOpenExternalURL:
                 if let message = try? JSONDecoder().decode(OpenExternalUrlMessage.self, from: data),
                    let url = URL(string: message.onOpenExternalURLParams.url) {
-                    if JsMessageHandler.isAllowedExternalURL(url) {
-                        UIApplication.shared.open(url)
-                    } else {
-                        Formbricks.logger?.warning("Blocked external URL with disallowed scheme: \(url.scheme ?? "nil")")
-                    }
+                    JsMessageHandler.openExternalURL(url)
                 }
                 
             /// Happens when the survey library fails to load.
diff --git a/Tests/FormbricksSDKTests/FormbricksSDKTests.swift b/Tests/FormbricksSDKTests/FormbricksSDKTests.swift
index 90c5850..96a2116 100644
--- a/Tests/FormbricksSDKTests/FormbricksSDKTests.swift
+++ b/Tests/FormbricksSDKTests/FormbricksSDKTests.swift
@@ -547,18 +547,8 @@ final class FormbricksSDKTests: XCTestCase {
         }
 
         // The payload is base64-encoded and embedded as atob("...") (see ENG-1813).
-        // Extract the base64 blob, decode it, and parse the JSON.
-        guard let markerRange = html.range(of: "atob(\"") else {
-            XCTFail("Marker not found")
-            return
-        }
-        let start = markerRange.upperBound
-        guard let end = html[start...].firstIndex(of: "\"") else {
-            XCTFail("End quote not found")
-            return
-        }
-        let base64String = String(html[start..<end])
-        guard let data = Data(base64Encoded: base64String),
+        guard let blob = webviewDataBase64(from: html),
+              let data = Data(base64Encoded: blob),
               let object = try? JSONSerialization.jsonObject(with: data) as? [String: Any] else {
             XCTFail("Invalid JSON in WEBVIEW_DATA")
             return
@@ -758,6 +748,22 @@ final class FormbricksSDKTests: XCTestCase {
     /// server certificate. Force-trusting any certificate disables chain
     /// validation and exposes survey traffic to man-in-the-middle interception.
     func testWebViewAuthChallengeUsesDefaultHandlingAndDoesNotForceTrust() {
+        assertChallengeUsesDefaultHandling(authenticationMethod: NSURLAuthenticationMethodServerTrust)
+    }
+
+    /// The challenge handler is now unconditional (always `.performDefaultHandling`).
+    /// Guard that non-serverTrust challenges (HTTP Basic auth, client-certificate) also
+    /// fall through to OS default handling rather than being answered with a credential.
+    func testWebViewAuthChallengeUsesDefaultHandlingForNonServerTrustChallenges() {
+        assertChallengeUsesDefaultHandling(authenticationMethod: NSURLAuthenticationMethodHTTPBasic)
+        assertChallengeUsesDefaultHandling(authenticationMethod: NSURLAuthenticationMethodClientCertificate)
+    }
+
+    private func assertChallengeUsesDefaultHandling(
+        authenticationMethod: String,
+        file: StaticString = #filePath,
+        line: UInt = #line
+    ) {
         let coordinator = SurveyWebView.Coordinator()
         let webView = WKWebView()
         let protectionSpace = URLProtectionSpace(
@@ -765,7 +771,7 @@ final class FormbricksSDKTests: XCTestCase {
             port: 443,
             protocol: NSURLProtectionSpaceHTTPS,
             realm: nil,
-            authenticationMethod: NSURLAuthenticationMethodServerTrust
+            authenticationMethod: authenticationMethod
         )
         let challenge = URLAuthenticationChallenge(
             protectionSpace: protectionSpace,
@@ -787,9 +793,34 @@ final class FormbricksSDKTests: XCTestCase {
         wait(for: [handlerCalled], timeout: 1.0)
 
         XCTAssertEqual(capturedDisposition, .performDefaultHandling,
-                       "WebView must let the OS validate the certificate chain, not override it.")
+                       "WebView must let the OS validate the challenge (\(authenticationMethod)), not override it.",
+                       file: file, line: line)
         XCTAssertNil(capturedCredential,
-                     "WebView must not supply a credential that force-trusts the server certificate (MITM risk).")
+                     "WebView must not supply a credential for \(authenticationMethod) (MITM / force-trust risk).",
+                     file: file, line: line)
+    }
+
+    /// Security regression guard (ENG-1812): the allowlist must be enforced on *direct*
+    /// WebView navigation (a `<a href>`, `window.location`, meta-refresh or form POST from
+    /// survey markup), not only the JS bridge. Only the in-memory survey document loads
+    /// in-frame; every other navigation is cancelled and routed through the http/https
+    /// allowlist, so `tel:`/`sms:`/custom schemes can't reach WKWebView's native handling.
+    func testWebViewNavigationPolicyOnlyLoadsInMemoryDocumentInFrame() {
+        // The survey's own in-memory document (about:blank, i.e. nil base URL) loads in-frame.
+        XCTAssertTrue(JsMessageHandler.shouldAllowInWebViewNavigation(to: URL(string: "about:blank")))
+        XCTAssertTrue(JsMessageHandler.shouldAllowInWebViewNavigation(to: nil))
+
+        // Nothing else navigates in-frame — including web links (they open externally instead).
+        for external in ["https://formbricks.com", "http://example.com/x",
+                         "tel:+123456789", "sms:+1", "mailto:a@b.com", "facetime:a@b.com",
+                         "itms-apps://apple.com", "myapp://do-something"] {
+            XCTAssertFalse(JsMessageHandler.shouldAllowInWebViewNavigation(to: URL(string: external)!),
+                           "\(external) must not load in the survey frame")
+        }
+
+        // Of the cancelled navigations, only http/https are actually opened; the rest are blocked.
+        XCTAssertTrue(JsMessageHandler.isAllowedExternalURL(URL(string: "https://formbricks.com")!))
+        XCTAssertFalse(JsMessageHandler.isAllowedExternalURL(URL(string: "tel:+123456789")!))
     }
 
     /// Security regression guard (ENG-1812): external URLs coming from survey
@@ -839,11 +870,9 @@ final class FormbricksSDKTests: XCTestCase {
                        "Payload must not be spliced into a JS template literal (script-injection risk).")
 
         // The payload must be delivered via atob("...") and the blob must be pure base64.
-        guard let start = html.range(of: "atob(\"")?.upperBound,
-              let end = html[start...].firstIndex(of: "\"") else {
+        guard let blob = webviewDataBase64(from: html) else {
             XCTFail("Base64 payload marker not found"); return
         }
-        let blob = String(html[start..<end])
         XCTAssertFalse(blob.isEmpty, "Payload blob should not be empty")
         let base64Charset = CharacterSet(charactersIn: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=")
         XCTAssertTrue(blob.unicodeScalars.allSatisfy { base64Charset.contains($0) },
@@ -852,6 +881,55 @@ final class FormbricksSDKTests: XCTestCase {
         XCTAssertNotNil(Data(base64Encoded: blob).flatMap { try? JSONSerialization.jsonObject(with: $0) },
                         "Base64 payload must decode to valid JSON.")
     }
+
+    /// Regression guard (ENG-1813): removing the old `\"`->`'` mangling must not corrupt
+    /// survey content. The mock survey embeds HTML with double-quoted attributes
+    /// (`<p class="fb-editor-paragraph">`); after the base64 round-trip those double quotes
+    /// (and the angle brackets) must survive verbatim — not be rewritten to single quotes.
+    func testWebViewPayloadPreservesQuotesAndAngleBrackets() throws {
+        // Configure appUrl/workspaceId (the survey-script URL, and thus htmlString, need it).
+        Formbricks.setup(with: FormbricksConfig.Builder(appUrl: appUrl, workspaceId: workspaceId)
+            .service(mockService)
+            .build())
+
+        // Build the workspace straight from the fixture with `responseString` populated —
+        // getSurveyJson reads the raw survey JSON from it (the production APIClient path sets
+        // this; the mock service does not), so the survey's HTML question lands in the payload.
+        guard let fixtureUrl = Bundle.module.url(forResource: "Environment", withExtension: "json"),
+              let fixtureData = try? Data(contentsOf: fixtureUrl),
+              let raw = String(data: fixtureData, encoding: .utf8) else {
+            XCTFail("Missing Environment.json fixture"); return
+        }
+        var workspace = try JSONDecoder.iso8601Full.decode(WorkspaceResponse.self, from: fixtureData)
+        workspace.responseString = raw
+
+        guard let html = FormbricksViewModel(workspaceResponse: workspace, surveyId: surveyID).htmlString,
+              let blob = webviewDataBase64(from: html),
+              let data = Data(base64Encoded: blob),
+              let decoded = String(data: data, encoding: .utf8) else {
+            XCTFail("Could not decode WEBVIEW_DATA"); return
+        }
+
+        // Sanity: the survey's HTML question content actually made it into the payload.
+        XCTAssertTrue(decoded.contains("fb-editor-paragraph"),
+                      "survey HTML content should be present in the payload")
+
+        // Double quotes survive as JSON-escaped quotes (\"), i.e. the \"->' workaround is gone.
+        XCTAssertTrue(decoded.contains(#"class=\"fb-editor-paragraph\""#),
+                      "Double quotes in survey content must survive the round-trip (\\\"->' mangling must not return).")
+        XCTAssertFalse(decoded.contains("class='fb-editor-paragraph'"),
+                       "Survey content quotes must not be mangled into single quotes.")
+        // Angle brackets are delivered intact by base64 (they'd be a script-injection risk if raw).
+        XCTAssertTrue(decoded.contains("<p "),
+                      "Angle brackets in survey content must survive the base64 round-trip.")
+    }
+}
+
+/// Extracts the base64 survey payload embedded as `atob("...")` in the WebView HTML.
+private func webviewDataBase64(from html: String) -> String? {
+    guard let start = html.range(of: "atob(\"")?.upperBound,
+          let end = html[start...].firstIndex(of: "\"") else { return nil }
+    return String(html[start..<end])
 }
 
 /// Minimal sender so a `URLAuthenticationChallenge` can be constructed in tests.

From 12e17b2e4d8ad572e45170c78fbf0c5da2acd7c3 Mon Sep 17 00:00:00 2001
From: pandeymangg <anshuman.pandey9999@gmail.com>
Date: Wed, 22 Jul 2026 10:28:42 +0530
Subject: [PATCH 5/5] chore: silence unused-parameter warning in
 navigation-policy handler

The webView parameter is unused; name it _ to satisfy SonarCloud (same as
the auth-challenge handler).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 Sources/FormbricksSDK/WebView/SurveyWebView.swift | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Sources/FormbricksSDK/WebView/SurveyWebView.swift b/Sources/FormbricksSDK/WebView/SurveyWebView.swift
index 3aa9256..730f9f3 100644
--- a/Sources/FormbricksSDK/WebView/SurveyWebView.swift
+++ b/Sources/FormbricksSDK/WebView/SurveyWebView.swift
@@ -103,7 +103,7 @@ extension SurveyWebView {
             completionHandler(.performDefaultHandling, nil)
         }
 
-        func webView(_ webView: WKWebView, decidePolicyFor navigationAction: WKNavigationAction, decisionHandler: @escaping (WKNavigationActionPolicy) -> Void) {
+        func webView(_: WKWebView, decidePolicyFor navigationAction: WKNavigationAction, decisionHandler: @escaping (WKNavigationActionPolicy) -> Void) {
             let url = navigationAction.request.url
             // The survey is an in-memory document (loaded via loadHTMLString) rendered by the
             // JS library; it never legitimately navigates its own frame. Allow that base