Update Demos with the MASTestApp

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-shared-storage-no-user-interaction/android-data-unencrypted-shared-storage-no-user-interaction-frida/demo-1/MastgTest.kt

@@ -0,0 +1,31 @@
+package org.owasp.mastestapp
+
+import android.content.Context
+import android.os.Environment
+import android.util.Log
+import java.io.File
+import java.io.FileOutputStream
+import java.io.IOException
+
+class MastgTest (private val context: Context){
+
+ fun mastgTest(): String {
+
+ val externalStorageDir = Environment.getExternalStorageDirectory()
+
+ val fileName = File(externalStorageDir, "secret.txt")
+ val fileContent = "Secret not using scoped storage"
+
+ try {
+ FileOutputStream(fileName).use { output ->
+ output.write(fileContent.toByteArray())
+ Log.d("WriteExternalStorage", "File written to external storage successfully.")
+ }
+ } catch (e: IOException) {
+ Log.e("WriteExternalStorage", "Error writing file to external storage", e)
+ return "ERROR!!\n\nError writing file to external storage. Do you have the MANAGE_EXTERNAL_STORAGE permission in the manifest and it's granted in 'All files access'?"
+ }
+
+ return "SUCCESS!!\n\nFile $fileName with content $fileContent saved to $externalStorageDir"
+ }
+}

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-shared-storage-no-user-interaction/android-data-unencrypted-shared-storage-no-user-interaction-frida/demo-1/output.txt

@@ -1,27 +1,75 @@
-[WARNING] Opening a file from external storage at: /storage/emulated/0/Android/data/com.gs.owasp_storage_app1/files/secret.json
+[WARNING] Opening a file from external storage at: /storage/emulated/0/secret.txt
 Invoked from: java.lang.Exception
  at libcore.io.Linux.open(Native Method)
  at libcore.io.ForwardingOs.open(ForwardingOs.java:167)
  at libcore.io.BlockGuardOs.open(BlockGuardOs.java:252)
  at libcore.io.ForwardingOs.open(ForwardingOs.java:167)
- at android.app.ActivityThread$AndroidOs.open(ActivityThread.java:7581)
+ at android.app.ActivityThread$AndroidOs.open(ActivityThread.java:7255)
  at libcore.io.IoBridge.open(IoBridge.java:482)
  at java.io.FileOutputStream.<init>(FileOutputStream.java:235)
  at java.io.FileOutputStream.<init>(FileOutputStream.java:186)
- at com.gs.owasp_storage_app1.MainActivity.runOwasp(MainActivity.kt:155)
- at com.gs.owasp_storage_app1.MainActivity.onCreate$lambda$1(MainActivity.kt:36)
- at com.gs.owasp_storage_app1.MainActivity.$r8$lambda$He9NTWO6dCDqltooAd5-9ovuSZ8(Unknown Source:0)
- at com.gs.owasp_storage_app1.MainActivity$$ExternalSyntheticLambda1.onClick(Unknown Source:2)
- at android.view.View.performClick(View.java:7201)
- at com.google.android.material.button.MaterialButton.performClick(MaterialButton.java:1218)
- at android.view.View.performClickInternal(View.java:7170)
- at android.view.View.access$3500(View.java:806)
- at android.view.View$PerformClick.run(View.java:27562)
- at android.os.Handler.handleCallback(Handler.java:883)
- at android.os.Handler.dispatchMessage(Handler.java:100)
- at android.os.Looper.loop(Looper.java:214)
- at android.app.ActivityThread.main(ActivityThread.java:7682)
+ at org.owasp.mastestapp.MastgTest.mastgTest(MastgTest.kt:20)
+ at org.owasp.mastestapp.MainActivityKt$MyScreenContent$1$1$1.invoke(MainActivity.kt:73)
+ at org.owasp.mastestapp.MainActivityKt$MyScreenContent$1$1$1.invoke(MainActivity.kt:71)
+ at androidx.compose.foundation.ClickablePointerInputNode$pointerInput$3.invoke-k-4lQ0M(Clickable.kt:987)
+ at androidx.compose.foundation.ClickablePointerInputNode$pointerInput$3.invoke(Clickable.kt:981)
+ at androidx.compose.foundation.gestures.TapGestureDetectorKt$detectTapAndPress$2$1.invokeSuspend(TapGestureDetector.kt:255)
+ at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33)
+ at kotlinx.coroutines.DispatchedTaskKt.resume(DispatchedTask.kt:177)
+ at kotlinx.coroutines.DispatchedTaskKt.dispatch(DispatchedTask.kt:166)
+ at kotlinx.coroutines.CancellableContinuationImpl.dispatchResume(CancellableContinuationImpl.kt:474)
+ at kotlinx.coroutines.CancellableContinuationImpl.resumeImpl(CancellableContinuationImpl.kt:508)
+ at kotlinx.coroutines.CancellableContinuationImpl.resumeImpl$default(CancellableContinuationImpl.kt:497)
+ at kotlinx.coroutines.CancellableContinuationImpl.resumeWith(CancellableContinuationImpl.kt:368)
+ at androidx.compose.ui.input.pointer.SuspendingPointerInputModifierNodeImpl$PointerEventHandlerCoroutine.offerPointerEvent(SuspendingPointerInputFilter.kt:665)
+ at androidx.compose.ui.input.pointer.SuspendingPointerInputModifierNodeImpl.dispatchPointerEvent(SuspendingPointerInputFilter.kt:544)
+ at androidx.compose.ui.input.pointer.SuspendingPointerInputModifierNodeImpl.onPointerEvent-H0pRuoY(SuspendingPointerInputFilter.kt:566)
+ at androidx.compose.foundation.AbstractClickablePointerInputNode.onPointerEvent-H0pRuoY(Clickable.kt:947)
+ at androidx.compose.foundation.AbstractClickableNode.onPointerEvent-H0pRuoY(Clickable.kt:795)
+ at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:317)
+ at androidx.compose.ui.input.pointer.Node.dispatchMainEventPass(HitPathTracker.kt:303)
+ at androidx.compose.ui.input.pointer.NodeParent.dispatchMainEventPass(HitPathTracker.kt:185)
+ at androidx.compose.ui.input.pointer.HitPathTracker.dispatchChanges(HitPathTracker.kt:104)
+ at androidx.compose.ui.input.pointer.PointerInputEventProcessor.process-BIzXfog(PointerInputEventProcessor.kt:113)
+ at androidx.compose.ui.platform.AndroidComposeView.sendMotionEvent-8iAsVTc(AndroidComposeView.android.kt:1576)
+ at androidx.compose.ui.platform.AndroidComposeView.handleMotionEvent-8iAsVTc(AndroidComposeView.android.kt:1527)
+ at androidx.compose.ui.platform.AndroidComposeView.dispatchTouchEvent(AndroidComposeView.android.kt:1466)
+ at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:3060)
+ at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2755)
+ at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:3060)
+ at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2755)
+ at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:3060)
+ at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2755)
+ at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:3060)
+ at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2755)
+ at com.android.internal.policy.DecorView.superDispatchTouchEvent(DecorView.java:465)
+ at com.android.internal.policy.PhoneWindow.superDispatchTouchEvent(PhoneWindow.java:1849)
+ at android.app.Activity.dispatchTouchEvent(Activity.java:3993)
+ at com.android.internal.policy.DecorView.dispatchTouchEvent(DecorView.java:423)
+ at android.view.View.dispatchPointerEvent(View.java:13674)
+ at android.view.ViewRootImpl$ViewPostImeInputStage.processPointerEvent(ViewRootImpl.java:5482)
+ at android.view.ViewRootImpl$ViewPostImeInputStage.onProcess(ViewRootImpl.java:5285)
+ at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:4788)
+ at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:4841)
+ at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:4807)
+ at android.view.ViewRootImpl$AsyncInputStage.forward(ViewRootImpl.java:4947)
+ at android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:4815)
+ at android.view.ViewRootImpl$AsyncInputStage.apply(ViewRootImpl.java:5004)
+ at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:4788)
+ at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:4841)
+ at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:4807)
+ at android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:4815)
+ at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:4788)
+ at android.view.ViewRootImpl.deliverInputEvent(ViewRootImpl.java:7505)
+ at android.view.ViewRootImpl.doProcessInputEvents(ViewRootImpl.java:7474)
+ at android.view.ViewRootImpl.enqueueInputEvent(ViewRootImpl.java:7435)
+ at android.view.ViewRootImpl$WindowInputEventReceiver.onInputEvent(ViewRootImpl.java:7630)
+ at android.view.InputEventReceiver.dispatchInputEvent(InputEventReceiver.java:188)
+ at android.os.MessageQueue.nativePollOnce(Native Method)
+ at android.os.MessageQueue.next(MessageQueue.java:336)
+ at android.os.Looper.loop(Looper.java:174)
+ at android.app.ActivityThread.main(ActivityThread.java:7356)
  at java.lang.reflect.Method.invoke(Native Method)
- at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:516)
- at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:950)
+ at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:492)
+ at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:930)
 

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-shared-storage-no-user-interaction/android-data-unencrypted-shared-storage-no-user-interaction-frida/demo-1/run.sh

@@ -8,6 +8,6 @@
 
 frida \
  -U \
- -f com.gs.owasp_storage_app2 \
+ -f org.owasp.mastestapp \
  -l script.js \
  -o output.txt

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-shared-storage-no-user-interaction/android-data-unencrypted-shared-storage-no-user-interaction-static/demo-1/MastgTest.kt

@@ -0,0 +1,39 @@
+package org.owasp.mastestapp
+
+import android.content.ContentValues
+import android.util.Log
+import android.content.Context
+import android.os.Environment
+import android.provider.MediaStore
+import java.io.OutputStream
+
+class MastgTest (private val context: Context){
+
+ fun mastgTest(): String {
+ try {
+ val resolver = context.contentResolver
+ val contentValues = ContentValues().apply {
+ put(MediaStore.MediaColumns.DISPLAY_NAME, "secretFile.txt")
+ put(MediaStore.MediaColumns.MIME_TYPE, "text/plain")
+ put(MediaStore.MediaColumns.RELATIVE_PATH, Environment.DIRECTORY_DOWNLOADS)
+ }
+ val textUri = resolver.insert(MediaStore.Downloads.EXTERNAL_CONTENT_URI, contentValues)
+
+ textUri?.let {
+ val outputStream: OutputStream? = resolver.openOutputStream(it)
+ outputStream?.use {
+ it.write("Secret data".toByteArray())
+ it.flush()
+ }
+ Log.d("MediaStore", "File written to external storage successfully.")
+ return "SUCCESS!!\n\nMediaStore inserted to $textUri"
+ } ?: run {
+ Log.e("MediaStore", "Error inserting URI to MediaStore.")
+ return "FAILURE!!\n\nMediaStore couldn't insert data."
+ }
+ } catch (exception: Exception) {
+ Log.e("MediaStore", "Error writing file to URI from MediaStore", exception)
+ return "FAILURE!!\n\nMediaStore couldn't insert data."
+ }
+ }
+}

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-shared-storage-no-user-interaction/android-data-unencrypted-shared-storage-no-user-interaction-static/demo-1/MastgTest_reversed.java

@@ -0,0 +1,46 @@
+package org.owasp.mastestapp;
+
+import android.content.Context;
+import android.os.Environment;
+import android.util.Log;
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import kotlin.Metadata;
+import kotlin.io.CloseableKt;
+import kotlin.jvm.internal.Intrinsics;
+import kotlin.text.Charsets;
+
+/* compiled from: MastgTest.kt */
+@Metadata(d1 = {"\u0000\u0018\n\u0002\u0018\u0002\n\u0002\u0010\u0000\n\u0000\n\u0002\u0018\u0002\n\u0002\b\u0002\n\u0002\u0010\u000e\n\u0000\b\u0007\u0018\u00002\u00020\u0001B\r\u0012\u0006\u0010\u0002\u001a\u00020\u0003¢\u0006\u0002\u0010\u0004J\u0006\u0010\u0005\u001a\u00020\u0006R\u000e\u0010\u0002\u001a\u00020\u0003X\u0082\u0004¢\u0006\u0002\n\u0000¨\u0006\u0007"}, d2 = {"Lorg/owasp/mastestapp/MastgTest;", "", "context", "Landroid/content/Context;", "(Landroid/content/Context;)V", "mastgTest", "", "app_debug"}, k = 1, mv = {1, 9, 0}, xi = 48)
+/* loaded from: classes4.dex */
+public final class MastgTest {
+ public static final int $stable = 8;
+ private final Context context;
+
+ public MastgTest(Context context) {
+ Intrinsics.checkNotNullParameter(context, "context");
+ this.context = context;
+ }
+
+ public final String mastgTest() {
+ File externalStorageDir = Environment.getExternalStorageDirectory();
+ File fileName = new File(externalStorageDir, "secret.txt");
+ try {
+ FileOutputStream fileOutputStream = new FileOutputStream(fileName);
+ try {
+ FileOutputStream output = fileOutputStream;
+ byte[] bytes = "Secret not using scoped storage".getBytes(Charsets.UTF_8);
+ Intrinsics.checkNotNullExpressionValue(bytes, "this as java.lang.String).getBytes(charset)");
+ output.write(bytes);
+ Log.d("WriteExternalStorage", "File written to external storage successfully.");
+ CloseableKt.closeFinally(fileOutputStream, null);
+ return "File " + fileName + " with content Secret not using scoped storage saved to " + externalStorageDir;
+ } finally {
+ }
+ } catch (IOException e) {
+ Log.e("WriteExternalStorage", "Error writing file to external storage", e);
+ return "Error writing file to external storage. Do you have the MANAGE_EXTERNAL_STORAGE permission in the manifest and it's granted?";
+ }
+ }
+}

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-shared-storage-no-user-interaction/android-data-unencrypted-shared-storage-no-user-interaction-static/demo-1/demo.md

@@ -7,11 +7,11 @@ code: [kotlin]
 
 ### Demo
 
-{{ use-of-external-store.kt }}
+{{ MastgTest.kt }}
 
 ### Steps
 
-Let's run our semgrep rule against the sample code.
+Let's run our semgrep rule against the reversed java code.
 
 {{ ../rules/mastg-android-data-unencrypted-external.yml }}