Port MASTG v1->v2 MASTG-TEST-0002: Testing Local Storage for Input Validation (android) (by @appknox) #3328

jeel38 · 2025-06-10T08:06:16Z

This PR ports MASTG-TEST-0002 from version 1 to version 2, creating a new test for detecting use of local storage for input validation in Android applications. The focus shifts from general local storage testing to specifically checking for integrity validation when reading from SharedPreferences.

Deprecates the old MASTG-TEST-0002 and creates MASTG-TEST-0288 as the new version
Implements static analysis detection for SharedPreferences usage without integrity checks
Provides demonstration code showing both vulnerable and secure patterns using HMAC validation

File	Description
tests/android/MASVS-CODE/MASTG-TEST-0002.md	Marks the original test as deprecated with reference to new version
tests-beta/android/MASVS-CODE/MASTG-TEST-0288.md	New test specification for detecting `SharedPreferences` without integrity validation
rules/mastg-android-local-storage-input-validation.yml	Semgrep rule to detect insecure `SharedPreferences` usage patterns
demos/android/MASVS-CODE/MASTG-DEMO-0061/	Complete demonstration including vulnerable code, and analysis output

Co-authored-by: pruDhv! <[email protected]>

jeel38 · 2025-06-10T08:26:01Z

@cpholguera, upon adding the depreciation note, getting branch gets a conflict

cpholguera · 2025-06-10T08:30:01Z

Maybe the branch was a bit old. We added "profiles" now for all tests. I fixed the conflict for you

Please add profiles to tests-beta/android/MASVS-CODE/MASTG-TEST-0281.md as well

cpholguera · 2025-06-10T08:31:56Z

The new profiles (previously known as "levels") are defined here: https://docs.google.com/document/d/1paz7dxKXHzAC9MN7Mnln1JiZwBNyg7Gs364AJ6KudEs/edit?usp=sharing

jeel38 · 2025-06-10T08:42:56Z

Maybe the branch was a bit old. We added "profiles" now for all tests. I fixed the conflict for you

Please add profiles to tests-beta/android/MASVS-CODE/MASTG-TEST-0281.md as well

Done

jeel38 · 2025-06-10T08:45:17Z

@cpholguera please review it

cpholguera · 2025-06-10T08:46:00Z

Please fix the issues reported by Copilot in section "Comments suppressed due to low confidence (5)"

Also, I agree with Copilot's comment about:

"The output file shows usages of the input validation using putString and getString in the code."

The phrasing is misleading: this test detects storage/retrieval calls, not input validation.

If you're conducting a pentest, would you report this as an issue? "The app uses putString() and getString()." The same goes for an automated security testing tool, would you like it to report this? Wouldn't that be noisy / lots of false positives?

cpholguera · 2025-06-10T11:51:49Z

There's another problem that will probably be solved when you fix the copilot issues. Are you able to read these logs?

https://github.com/OWASP/owasp-mastg/actions/runs/15554645412/job/43792346017?pr=3328

ERROR - Error reading page 'MASTG/demos/android/MASVS-CODE/MASTG-DEMO-0054/MASTG-DEMO-0054.md': Snippet at path '../../../../rules/mastg-android-local-storage-for-input-validation.yml' could not be found

jeel38 · 2025-08-11T09:50:55Z

@cpholguera please check

Copilot

Pull Request Overview

This PR ports MASTG-TEST-0002 from version 1 to version 2, creating a new test for detecting use of local storage for input validation in Android applications. The focus shifts from general local storage testing to specifically checking for integrity validation when reading from SharedPreferences.

Deprecates the old MASTG-TEST-0002 and creates MASTG-TEST-0288 as the new version
Implements static analysis detection for SharedPreferences usage without integrity checks
Provides demonstration code showing both vulnerable and secure patterns using HMAC validation

Reviewed Changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

File	Description
tests/android/MASVS-CODE/MASTG-TEST-0002.md	Marks the original test as deprecated with reference to new version
tests-beta/android/MASVS-CODE/MASTG-TEST-0288.md	New test specification for detecting SharedPreferences without integrity validation
rules/mastg-android-local-storage-input-validation.yml	Semgrep rule to detect insecure SharedPreferences usage patterns
demos/android/MASVS-CODE/MASTG-DEMO-0061/	Complete demonstration including vulnerable Java code, secure Kotlin implementation, and analysis output

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-08-31T18:30:21Z

tests/android/MASVS-CODE/MASTG-TEST-0002.md

@@ -9,6 +9,9 @@ masvs_v1_levels:
 - L1
 - L2
 profiles: [L1, L2]
+status: deprecated
+covered_by: [MASTG-TEST-0281]


The deprecation references MASTG-TEST-0281, but the actual replacement test created in this PR is MASTG-TEST-0288. This should be corrected to reference the correct test ID.

Suggested change

covered_by: [MASTG-TEST-0281]

covered_by: [MASTG-TEST-0288]

Copilot · 2025-08-31T18:30:21Z

rules/mastg-android-local-storage-input-validation.yml

+      - pattern: new SecureSharedPreferences($CONTEXT, false)
+


The pattern only detects SecureSharedPreferences with false parameter, but the rule description mentions detecting SharedPreferences usage without integrity checks. This pattern is too narrow and won't catch standard SharedPreferences.getString() calls or other SharedPreferences access patterns that lack integrity validation.

Suggested change

- pattern: new SecureSharedPreferences($CONTEXT, false)

- pattern: $SP.getString($KEY, $DEFAULT)

- pattern: $SP.getInt($KEY, $DEFAULT)

- pattern: $CONTEXT.getSharedPreferences($NAME, $MODE)

Please test properly before adding this Copilot suggestion to validate if it makes sense and works.

cpholguera · 2025-06-10T08:35:52Z

tests-beta/android/MASVS-CODE/MASTG-TEST-0281.md

+
+## Steps
+
+1. Run a static analysis tool such as @MASTG-TOOL-0110 on the code and look for uses of the `putString` and `getString`.


https://mas.owasp.org/MASTG/techniques/android/MASTG-TECH-0014/

This is an old file

cpholguera · 2025-09-03T08:01:23Z

rules/mastg-android-local-storage-input-validation.yml

+      - pattern: new SecureSharedPreferences($CONTEXT, false)
+


Please test properly before adding this Copilot suggestion to validate if it makes sense and works.

cpholguera · 2025-09-06T08:00:08Z

demos/android/MASVS-CODE/MASTG-DEMO-0061/MASTG-DEMO-0061.md

+
+### Evaluation
+
+The test fails as the code does not use an `HMAC` integrity check together with `SharedPreferences` data.


Please describe how, because of this, an attacker can exploit the app. Use references to techniques when possible.

jeel38 and others added 9 commits June 3, 2025 18:18

demo added draft

86aa179

fix grammar

69ebf81

mastgTest file update

8c4060b

updated test file

96a766f

Update tests-beta/android/MASVS-CODE/MASTG-TEST-0281.md

3e1c45a

Co-authored-by: pruDhv! <[email protected]>

updated changes

2a90252

updated changes

d31713c

updated changes done

970f558

updated changes test file

a323683

Merge branch 'master' into MASTG-TEST-0002_draft

16acaa0

added profiles

e1a0099

cpholguera requested a review from Copilot June 10, 2025 08:36

This comment was marked as outdated.

Sign in to view

cpholguera added Android MASVS-CODE MASTG Refactor changes-requested labels Jun 10, 2025

jeel38 and others added 5 commits July 31, 2025 17:45

Updated-Demo

3bb04a9

Updated-Demo-fix

bcaec04

internal-comment-completed

2a4b407

Updated Demo

fce6000

deleted old demo

4ba84d9

cpholguera added changes-done and removed changes-requested labels Aug 12, 2025

cpholguera requested a review from Copilot August 31, 2025 18:29

Copilot AI reviewed Aug 31, 2025

View reviewed changes

Merge branch 'master' into MASTG-TEST-0002_draft

c6b5232

cpholguera requested changes Sep 6, 2025

View reviewed changes

-      - pattern: new SecureSharedPreferences($CONTEXT, false)
+      - pattern: $SP.getString($KEY, $DEFAULT)
+      - pattern: $SP.getInt($KEY, $DEFAULT)
+      - pattern: $CONTEXT.getSharedPreferences($NAME, $MODE)


		## Steps

		1. Run a static analysis tool such as @MASTG-TOOL-0110 on the code and look for uses of the `putString` and `getString`.


		### Evaluation

		The test fails as the code does not use an `HMAC` integrity check together with `SharedPreferences` data.

Uh oh!

Port MASTG v1->v2 MASTG-TEST-0002: Testing Local Storage for Input Validation (android) (by @appknox) #3328

Are you sure you want to change the base?

Port MASTG v1->v2 MASTG-TEST-0002: Testing Local Storage for Input Validation (android) (by @appknox) #3328

Uh oh!

Conversation

jeel38 commented Jun 10, 2025 • edited by cpholguera Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jeel38 commented Jun 10, 2025

Uh oh!

cpholguera commented Jun 10, 2025

Uh oh!

cpholguera commented Jun 10, 2025

Uh oh!

This comment was marked as outdated.

Uh oh!

jeel38 commented Jun 10, 2025

Uh oh!

jeel38 commented Jun 10, 2025

Uh oh!

cpholguera commented Jun 10, 2025

Uh oh!

cpholguera commented Jun 10, 2025

Uh oh!

jeel38 commented Aug 11, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Aug 31, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 31, 2025

Choose a reason for hiding this comment

Uh oh!

cpholguera Sep 3, 2025

Choose a reason for hiding this comment

Uh oh!

cpholguera Jun 10, 2025

Choose a reason for hiding this comment

Uh oh!

jeel38 Sep 12, 2025

Choose a reason for hiding this comment

Uh oh!

cpholguera Sep 3, 2025

Choose a reason for hiding this comment

Uh oh!

cpholguera Sep 6, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jeel38 commented Jun 10, 2025 •

edited by cpholguera

Loading