| 278 | # ------------------------------------------------------------------ |
| 279 | |
| 280 | def check_dynamic_code(self) -> list: |
| 281 | checks = [ |
| 282 | { |
| 283 | "id": "DYN_DEXCLASSLOADER", |
| 284 | "title": "Dynamic DEX/Class Loading", |
| 285 | "severity": "HIGH", |
| 286 | "owasp": "M7: Insufficient Binary Protections", |
| 287 | "description": ( |
| 288 | "DexClassLoader, PathClassLoader, or InMemoryDexClassLoader loads " |
| 289 | "code at runtime from external sources. Malicious code could be " |
| 290 | "loaded if the source is attacker-controlled or poorly validated." |
| 291 | ), |
| 292 | "pattern": r'DexClassLoader|PathClassLoader|InMemoryDexClassLoader', |
| 293 | }, |
| 294 | { |
| 295 | "id": "DYN_RUNTIME_EXEC", |
| 296 | "title": "Runtime Command Execution", |
| 297 | "severity": "HIGH", |
| 298 | "owasp": "M4: Insufficient Input/Output Validation", |
| 299 | "description": ( |
| 300 | "Runtime.exec() or Runtime.getRuntime().exec() executes OS " |
| 301 | "commands. If any part of the command is derived from user input " |
| 302 | "or an external source, command injection is possible." |
| 303 | ), |
| 304 | "pattern": r'Runtime\.getRuntime\(\)\.exec|Runtime\.exec\(', |
| 305 | }, |
| 306 | { |
| 307 | "id": "DYN_PROCESS_BUILDER", |
| 308 | "title": "ProcessBuilder Command Execution", |
| 309 | "severity": "HIGH", |
| 310 | "owasp": "M4: Insufficient Input/Output Validation", |
| 311 | "description": ( |
| 312 | "ProcessBuilder constructs and launches OS processes. User-controlled " |
| 313 | "arguments can lead to command injection if not properly sanitised." |
| 314 | ), |
| 315 | "pattern": r'new\s+ProcessBuilder\s*\(', |
| 316 | }, |
| 317 | { |
| 318 | "id": "DYN_REFLECTION", |
| 319 | "title": "Reflection-Based Method Invocation", |
| 320 | "severity": "MEDIUM", |
| 321 | "owasp": "M7: Insufficient Binary Protections", |
| 322 | "description": ( |
| 323 | "getDeclaredMethod/getDeclaredField with invoke() can bypass access " |
| 324 | "controls and is commonly used to evade static analysis. Also " |
| 325 | "indicates potential for runtime code manipulation." |
| 326 | ), |
| 327 | "pattern": r'getDeclaredMethod|getDeclaredField|forName.*invoke', |
| 328 | }, |
| 329 | ] |
| 330 | return self._scan_pattern(checks) |
| 331 | |
| 332 | # ------------------------------------------------------------------ |
| 333 | # Insecure data storage |