| 459 | # ------------------------------------------------------------------ |
| 460 | |
| 461 | def check_intent_issues(self) -> list: |
| 462 | checks = [ |
| 463 | { |
| 464 | "id": "INTENT_PENDING_IMPLICIT", |
| 465 | "title": "Implicit PendingIntent", |
| 466 | "severity": "HIGH", |
| 467 | "owasp": "M4: Insufficient Input/Output Validation", |
| 468 | "description": ( |
| 469 | "PendingIntent wrapping an empty or implicit Intent can be " |
| 470 | "intercepted and filled by a malicious app, leading to privilege " |
| 471 | "escalation. Always use explicit intents with PendingIntent. " |
| 472 | "Requires FLAG_IMMUTABLE or FLAG_MUTABLE in Android 12+." |
| 473 | ), |
| 474 | "pattern": r'PendingIntent\s*\.\s*(?:getActivity|getBroadcast|getService)\s*\(.*new\s+Intent\s*\(\s*\)', |
| 475 | }, |
| 476 | { |
| 477 | "id": "INTENT_STICKY_BROADCAST", |
| 478 | "title": "Sticky Broadcast Used", |
| 479 | "severity": "MEDIUM", |
| 480 | "owasp": "M4: Insufficient Input/Output Validation", |
| 481 | "description": ( |
| 482 | "sendStickyBroadcast() is deprecated since API 21. Sticky broadcasts " |
| 483 | "linger in the system and any app can receive them at any time, " |
| 484 | "potentially exposing sensitive broadcast data." |
| 485 | ), |
| 486 | "pattern": r'sendStickyBroadcast\s*\(', |
| 487 | }, |
| 488 | ] |
| 489 | return self._scan_pattern(checks) |
| 490 | |
| 491 | # ------------------------------------------------------------------ |
| 492 | # Zip path traversal |