| 414 | # ------------------------------------------------------------------ |
| 415 | |
| 416 | def check_logging(self) -> list: |
| 417 | checks = [ |
| 418 | { |
| 419 | "id": "LOG_SENSITIVE", |
| 420 | "title": "Sensitive Data in Log Statement", |
| 421 | "severity": "MEDIUM", |
| 422 | "owasp": "M6: Inadequate Privacy Controls", |
| 423 | "description": ( |
| 424 | "Log.d/e/i/v/w() call contains keywords suggesting sensitive data " |
| 425 | "(password, token, key, secret, auth, credential). Log output is " |
| 426 | "accessible to other apps via logcat on unpatched or rooted devices." |
| 427 | ), |
| 428 | "pattern": r'Log\s*\.[devwiDEVWI]\s*\(.*(?:password|passwd|secret|token|apikey|api_key|auth|credential|ssn|cvv)', |
| 429 | }, |
| 430 | { |
| 431 | "id": "LOG_SYSOUT", |
| 432 | "title": "System.out.println in Production Code", |
| 433 | "severity": "LOW", |
| 434 | "owasp": "M6: Inadequate Privacy Controls", |
| 435 | "description": ( |
| 436 | "System.out.println() output appears in logcat on debug builds " |
| 437 | "and is a common source of accidental data leakage. Remove or " |
| 438 | "guard with BuildConfig.DEBUG." |
| 439 | ), |
| 440 | "pattern": r'System\.out\.print', |
| 441 | }, |
| 442 | { |
| 443 | "id": "LOG_STACKTRACE", |
| 444 | "title": "printStackTrace() Leaks Stack Information", |
| 445 | "severity": "LOW", |
| 446 | "owasp": "M6: Inadequate Privacy Controls", |
| 447 | "description": ( |
| 448 | "printStackTrace() prints internal class names, method names, and " |
| 449 | "file paths to logcat, aiding reverse engineering and revealing " |
| 450 | "architectural details to attackers." |
| 451 | ), |
| 452 | "pattern": r'printStackTrace\s*\(\s*\)', |
| 453 | }, |
| 454 | ] |
| 455 | return self._scan_pattern(checks) |
| 456 | |
| 457 | # ------------------------------------------------------------------ |
| 458 | # Intent security |