| 334 | # ------------------------------------------------------------------ |
| 335 | |
| 336 | def check_data_storage(self) -> list: |
| 337 | checks = [ |
| 338 | { |
| 339 | "id": "STORAGE_WORLD_READ", |
| 340 | "title": "World-Readable File Created", |
| 341 | "severity": "HIGH", |
| 342 | "owasp": "M9: Insecure Data Storage", |
| 343 | "description": ( |
| 344 | "MODE_WORLD_READABLE makes files readable by all apps on the device. " |
| 345 | "Deprecated since API 17 and disallowed on modern Android, but " |
| 346 | "still a critical data exposure risk on older devices." |
| 347 | ), |
| 348 | "pattern": r'MODE_WORLD_READABLE', |
| 349 | }, |
| 350 | { |
| 351 | "id": "STORAGE_WORLD_WRITE", |
| 352 | "title": "World-Writable File Created", |
| 353 | "severity": "HIGH", |
| 354 | "owasp": "M9: Insecure Data Storage", |
| 355 | "description": ( |
| 356 | "MODE_WORLD_WRITEABLE makes files writable by all apps on the device, " |
| 357 | "allowing malicious apps to tamper with the data." |
| 358 | ), |
| 359 | "pattern": r'MODE_WORLD_WRITEABLE', |
| 360 | }, |
| 361 | { |
| 362 | "id": "STORAGE_SQLITE_RAW", |
| 363 | "title": "Possible SQL Injection in SQLite Query", |
| 364 | "severity": "HIGH", |
| 365 | "owasp": "M4: Insufficient Input/Output Validation", |
| 366 | "description": ( |
| 367 | "rawQuery() or execSQL() called with string concatenation (+). " |
| 368 | "If any concatenated value originates from user input or external " |
| 369 | "data, SQL injection is possible." |
| 370 | ), |
| 371 | "pattern": r'rawQuery\s*\(.*\+|execSQL\s*\(.*\+', |
| 372 | }, |
| 373 | { |
| 374 | "id": "STORAGE_CLIPBOARD", |
| 375 | "title": "Data Written to Clipboard", |
| 376 | "severity": "MEDIUM", |
| 377 | "owasp": "M6: Inadequate Privacy Controls", |
| 378 | "description": ( |
| 379 | "Data written to ClipboardManager is accessible to any app with " |
| 380 | "FOREGROUND permission. Avoid storing sensitive data (passwords, " |
| 381 | "tokens, PII) in the clipboard." |
| 382 | ), |
| 383 | "pattern": r'setPrimaryClip\s*\(|ClipboardManager', |
| 384 | }, |
| 385 | { |
| 386 | "id": "STORAGE_EXTERNAL", |
| 387 | "title": "Sensitive Data on External Storage", |
| 388 | "severity": "MEDIUM", |
| 389 | "owasp": "M9: Insecure Data Storage", |
| 390 | "description": ( |
| 391 | "Data written to external storage is readable by any app with " |
| 392 | "READ_EXTERNAL_STORAGE permission. Do not store sensitive data " |
| 393 | "on SD card or external volumes." |