摘要
隨著智慧型手機的發展與普及，開發APP所要關注的不僅僅只是功能，還要考慮到開發效率、使用流暢度等。以往的APP需針對不同的平台再次撰寫，混合模式移動應用（hybrid APP）發展的出現則解決了跨平台的問題。基於HTML5開發的APP擁有低成本、高開發效率，還同時兼具了Native APP的特質。眾所皆知的是Web很容易受到注入代碼的攻擊，而基於HTML5所開發的APP繼承了跨平台等優點，卻將容易受到注入攻擊（Injection attack）的特性也囊括在內。因此本篇論文對HTML5 APP進行系統的研究以評估基於HTML5技術開發的手機APP安全性是否可靠，本論文提出基於HTML5行動裝置所開發的APP進行檢測，第一檢測前端是否有潛在被注入的攻擊點；第二是針對開發者是否有宣告多餘的權限或安裝不必要的插件。對開發者而言可以透過我們的分析結果進行修改，讓自己的APP更加安全。研究結果表明，許多以基於HTML5開發的APP的確存在著漏洞的問題，並且宣告的權限與安裝的插件並不是全部都在程式中使用。
並列摘要
Smartphones have become more and more popular recently, to develop an APP is not only focus on features but also considering efficiency of development and fluency etc. In the past, APP needs to be developed for different platforms. It is inefficient. Hybrid APP can solve the cross-platfom problems, APP based on HTML5 is low cost, high development efficiency, has and with characteristics of Native APP. As well known, Web is easily attacked by the Code Injection. APP based on HTML5 inherits the benefit of cross-platfom, but has the shortcoming of Code Injection. Therefore, this paper develops a system to evaluate the security of HTML5-based Mobile APP. The detection system is divided into two parts: first is to analyze whether the APP has any injection channel or not. Users can download APP and detect it by our system, and check up the leaks on web page; second is evaluating whether APP declares more permission in AndroidManifest and install more plugin in APP or not. Our system also shows the results on web page to let users know the dangers. We detected more vulnerabilities existing in HTML5-based Mobile APP, many APPs declare permission and install plugin, which doesn't used in APP.