Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[MASWE-0007] Sensitive Data Stored Unencrypted in Shared Storage Requiring No User Interaction #2594

Merged
merged 39 commits into from
Jul 3, 2024
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
39 commits
Select commit Hold shift + click to select a range
0bc19a7
Add Risk and Tests for: Sensitive Data Stored Unencrypted in External…
serek8 Mar 5, 2024
af50568
Update risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unenc…
serek8 May 6, 2024
dc5a465
Fix spellings
serek8 Mar 5, 2024
e0ba4e1
Update tests and examples
serek8 May 7, 2024
7d23021
Update the title of a static test
serek8 May 7, 2024
d2df0de
Update examples and fix spellings
serek8 May 7, 2024
cc126f0
Added rules from Olivier
serek8 May 7, 2024
3cb96d2
Apply suggestions from code review
serek8 Jun 3, 2024
dfb01ff
Rename Sample to Demo
serek8 Jun 3, 2024
badad99
Update demo-2 with a reversed manifest file
serek8 Jun 3, 2024
5e5c8dc
Mention iOS in Risks
serek8 Jun 4, 2024
ac00a36
Update Demos with the MASTestApp
serek8 Jun 4, 2024
44b625b
Update demo-1
serek8 Jun 4, 2024
bdcea87
Add a new demo and refactor existing demos
serek8 Jun 5, 2024
1d0dbb6
Add a demo with listing all files
serek8 Jun 5, 2024
9ad1169
Fix the spelling errors
serek8 Jun 5, 2024
e8fab33
fix md lint issues
cpholguera Jun 7, 2024
e8093a9
fix md lint issues
cpholguera Jun 7, 2024
d79b2d8
update rules to remove false positive separating manifest from apis. …
cpholguera Jun 15, 2024
e17a638
minor corrections in android-data-unencrypted-shared-storage-no-user-…
cpholguera Jun 15, 2024
e7c2902
merge demo-4 into demo-1
cpholguera Jun 21, 2024
769257c
updated kotlin samples to include a password-like and API key-like st…
cpholguera Jun 21, 2024
709bfd4
Minor update to the risk mitigations paragraph.
cpholguera Jun 21, 2024
77ddf31
Updated tests titles and consolidated content. Additional content reg…
cpholguera Jun 21, 2024
247a928
Consolidated tests sections and linked to relevant techniques.
cpholguera Jun 21, 2024
858b4bd
Consolidated demos sections and titles. Added more details to the obs…
cpholguera Jun 21, 2024
81610ae
Remove SARIF support for now
cpholguera Jun 21, 2024
665171e
Merge branch 'master' of https://github.com/OWASP/owasp-mastg into pr…
cpholguera Jun 22, 2024
252ac64
Merge branch 'master' of https://github.com/OWASP/owasp-mastg into pr…
cpholguera Jun 23, 2024
7f4809c
fix paths to snippets
cpholguera Jun 23, 2024
dff1834
added one CWE and android risk maaping, some additional clarification…
cpholguera Jun 24, 2024
f68d567
Merge branch 'master' of https://github.com/OWASP/owasp-mastg into pr…
cpholguera Jun 24, 2024
d61e867
fix links to tools and tech
cpholguera Jun 24, 2024
99d0776
Merge branch 'master' of https://github.com/OWASP/owasp-mastg into pr…
cpholguera Jun 24, 2024
e373dcc
rename risk to weakness
cpholguera Jun 24, 2024
d44da95
move all to the weaknesses folder
cpholguera Jun 24, 2024
b8ad87d
Merge branch 'master' of https://github.com/OWASP/owasp-mastg into pr…
cpholguera Jun 24, 2024
b582669
Merge branch 'master' of https://github.com/OWASP/owasp-mastg into pr…
cpholguera Jun 24, 2024
edeee04
include link to frida and remove ref to run.sh from test
cpholguera Jun 24, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
updated kotlin samples to include a password-like and API key-like st…
…rings
  • Loading branch information
cpholguera committed Jun 21, 2024
commit 769257c4a801655ee8ff1d35db917bec65cef2dc
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ class MastgTest (private val context: Context){
fun mastgTestApi() {
val externalStorageDir = context.getExternalFilesDir(null)
val fileName = File(externalStorageDir, "secret.txt")
val fileContent = "Secret may use scoped storage depending on Android version"
val fileContent = "secr3tPa$$W0rd\n"

try {
FileOutputStream(fileName).use { output ->
Expand All @@ -47,7 +47,7 @@ class MastgTest (private val context: Context){
textUri?.let {
val outputStream: OutputStream? = resolver.openOutputStream(it)
outputStream?.use {
it.write("Secret data".toByteArray())
it.write("MAS_API_KEY=8767086b9f6f976g-a8df76\n".toByteArray())
it.flush()
}
Log.d("MediaStore", "File written to external storage successfully.")
Expand Down
Original file line number Diff line number Diff line change
@@ -1 +1 @@
Secret may use scoped storage depending on Android version
secr3tPa$$W0rd
Original file line number Diff line number Diff line change
@@ -1 +1 @@
Secret data
MAS_API_KEY=8767086b9f6f976g-a8df76
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ class MastgTest (private val context: Context){
fun mastgTestApi() {
val externalStorageDir = context.getExternalFilesDir(null)
val fileName = File(externalStorageDir, "secret.txt")
val fileContent = "Secret may use scoped storage depending on Android version"
val fileContent = "secr3tPa$$W0rd\n"

try {
FileOutputStream(fileName).use { output ->
Expand All @@ -46,7 +46,7 @@ class MastgTest (private val context: Context){
textUri?.let {
val outputStream: OutputStream? = resolver.openOutputStream(it)
outputStream?.use {
it.write("Secret data".toByteArray())
it.write("MAS_API_KEY=8767086b9f6f976g-a8df76\n".toByteArray())
it.flush()
}
Log.d("MediaStore", "File written to external storage successfully.")
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ class MastgTest (private val context: Context){
val externalStorageDir = context.getExternalFilesDir(null)

val fileName = File(externalStorageDir, "secret.txt")
val fileContent = "Secret may use scoped storage depending on Android version"
val fileContent = "secr3tPa$$W0rd\n"

try {
FileOutputStream(fileName).use { output ->
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -27,12 +27,12 @@ public final String mastgTest() {
try {
FileOutputStream fileOutputStream = new FileOutputStream(fileName);
FileOutputStream output = fileOutputStream;
byte[] bytes = "Secret may use scoped storage depending on Android version".getBytes(Charsets.UTF_8);
byte[] bytes = "secr3tPa$$W0rd\n".getBytes(Charsets.UTF_8);
Intrinsics.checkNotNullExpressionValue(bytes, "this as java.lang.String).getBytes(charset)");
output.write(bytes);
Log.d("WriteExternalStorage", "File written to external storage successfully.");
CloseableKt.closeFinally(fileOutputStream, null);
return "SUCCESS!!\n\nFile " + fileName + " with content Secret may use scoped storage depending on Android version saved to " + externalStorageDir;
return "SUCCESS!!\n\nFile " + fileName + " with content secr3tPa$$W0rd\n saved to " + externalStorageDir;
} catch (IOException e) {
Log.e("WriteExternalStorage", "Error writing file to external storage", e);
return "ERROR!!\n\nError writing file to external storage";
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ class MastgTest (private val context: Context){
textUri?.let {
val outputStream: OutputStream? = resolver.openOutputStream(it)
outputStream?.use {
it.write("Secret data".toByteArray())
it.write("MAS_API_KEY=8767086b9f6f976g-a8df76\n".toByteArray())
it.flush()
}
Log.d("MediaStore", "File written to external storage successfully.")
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ public final String mastgTest() {
if (outputStream != null) {
OutputStream outputStream2 = outputStream;
OutputStream it = outputStream2;
byte[] bytes = "Secret data".getBytes(Charsets.UTF_8);
byte[] bytes = "MAS_API_KEY=8767086b9f6f976g-a8df76\n".getBytes(Charsets.UTF_8);
Intrinsics.checkNotNullExpressionValue(bytes, "this as java.lang.String).getBytes(charset)");
it.write(bytes);
it.flush();
Expand Down