What is the purpose of whitelisting in Phonegap? Is there a way around it?

Question

I am using the new phonegap 1.5.0 (which is confusingly renamed cordova despite no mention of the rename on the phonegap site), and I'm finding that the white-listing feature on iOS is quite restrictive. I understand that having a whitelist is more secure in that it only allows trusted domains, but what if you want to load urls that have been loaded dynamically? You don't know exactly which domain will be loading, so you can't put it on the whitelist. An example use-case would be ad-serving and opening privacy policies.

Why is the whitelist mandatory, and is there a way around it?

Answer 1

What is the purpose of whitelisting in Phonegap?

As you guessed, it's a security measure. Specifically, it's meant to prevent cross-site scripting attacks as detailed on the Security page of the PhoneGap wiki.

Why is the whitelist mandatory, and is there a way around it?

The question linked by Robert Harvey in the comments explains how to get around it. In short, add an entry to the whitelist with the value * to allow access to any URL. (Think thrice before doing that, though -- make sure you understand the danger that the whitelist is there to mitigate.)