Port MASTG-TEST-0010 and MASTG-TEST-0059 (by @guardsquare) #3112
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
serek8
changed the title
cpholguera
reviewed
Jan 17, 2025
cpholguera
requested changes
Jan 30, 2025
demos/android/MASVS-PLATFORM/MASTG-DEMO-0021/MASTG-DEMO-0021.md
Outdated
Show resolved
Hide resolved
cpholguera
changed the title
|
@serek8 please check the suggested changes. Thanks! |
Co-authored-by: Carlos Holguera <[email protected]>
Co-authored-by: Carlos Holguera <[email protected]>
…eeenshot prevention on Android
…failure condition
…eventing screenshots and screen recording
…updating type to include 'manual', refining steps for clarity, and improving overview descriptions for both Android and iOS.
…0290, add missing profile
There was a problem hiding this comment.
Pull Request Overview
This PR ports two legacy test cases (MASTG-TEST-0010 and MASTG-TEST-0059) by deprecating them and introducing new MASTG V2 versions that test for sensitive information exposure in auto-generated screenshots on Android and iOS platforms.
- Deprecates existing test cases MASTG-TEST-0010 (Android) and MASTG-TEST-0059 (iOS)
- Adds new comprehensive test cases MASTG-TEST-0289, MASTG-TEST-0290, and MASTG-TEST-0291 for screenshot security testing
- Introduces supporting materials including semgrep rules, demos, and best practices documentation
Reviewed Changes
Copilot reviewed 13 out of 15 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/android/MASVS-PLATFORM/MASTG-TEST-0010.md | Marks legacy Android screenshot test as deprecated |
| tests/ios/MASVS-PLATFORM/MASTG-TEST-0059.md | Marks legacy iOS screenshot test as deprecated |
| tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0289.md | New runtime verification test for Android screenshot protection |
| tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0291.md | New static analysis test for Android FLAG_SECURE usage |
| tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0290.md | New runtime verification test for iOS screenshot protection |
| rules/mastg-android-sensitive-data-in-screenshot.yml | Semgrep rules for detecting FLAG_SECURE usage patterns |
| demos/android/MASVS-PLATFORM/MASTG-DEMO-0061/* | Demo files showing FLAG_SECURE implementation and detection |
| knowledge/ios/MASVS-STORAGE/MASTG-KNOW-0099.md | Enhanced documentation about iOS screenshot storage mechanics |
| best-practices/MASTG-BEST-0014.md | New best practices guide for preventing screenshots |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
Co-authored-by: Copilot <[email protected]>
cpholguera
approved these changes
Aug 31, 2025
…into pr/serek8/3112
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes #2970 closes #2984.
This PR ports two legacy test cases (MASTG-TEST-0010 and MASTG-TEST-0059) by deprecating them and introducing new MASTG V2 versions that test for sensitive information exposure in auto-generated screenshots on Android and iOS platforms.
Changes