Port MASTG-TEST-0025: Testing for Injection Flaws (android) (by @appknox) #3424

ScreaMy7 · 2025-08-12T06:12:11Z

Copilot

Pull Request Overview

This PR ports MASTG-TEST-0025 to the new V2 format as MASTG-TEST-0288, focusing on SQL injection vulnerabilities in Android ContentProviders. The change deprecates the old test and introduces a new version with updated testing methodology.

Deprecates MASTG-TEST-0025 and creates MASTG-TEST-0288 as its replacement
Introduces a Semgrep rule to detect SQL injection patterns in ContentProvider implementations
Adds comprehensive demo code showing vulnerable ContentProvider with SQL injection via URI path segments

Reviewed Changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

File	Description
tests/android/MASVS-CODE/MASTG-TEST-0025.md	Marks the original test as deprecated with reference to new version
tests-beta/android/MASVS-CODE/MASTG-TEST-0288.md	New test specification for SQL injection in ContentProvider
rules/mastg-android-sql-injection-contentprovider.yml	Semgrep rule to detect unsafe URI path usage in SQL queries
demos/android/MASVS-CODE/MASTG-DEMO-0061/	Complete demo implementation with vulnerable code and test execution

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

rules/mastg-android-sql-injection-contentprovider.yml

tests-beta/android/MASVS-CODE/MASTG-TEST-0288.md

serek8

I left a couple comments in the files. Please have a look.

demos/android/MASVS-CODE/MASTG-DEMO-0061/MainActivityKt_reversed.java

serek8 · 2025-09-01T07:12:33Z

rules/mastg-android-sql-injection-contentprovider.yml

+    message: "Possible SQL Injection: Unvalidated user input from `Uri.getPathSegments()` used in `SQLiteQueryBuilder.appendWhere()"
+    patterns:
+      - pattern: |
+          $QB.appendWhere("..." + $VAR);


Should we also add functions such as rawQuery and execSQL? Are there more similar functions?

This generates a lot of false positives, the vulnerability comes from how that text is constructed as its concatenation based unlike the path based used here.

The test should cover all API that can lead to SQL injection. The title points at an overall issue too. Android doc mentions it here. Can you also add Best practices about using PreparedStatement

tests/android/MASVS-CODE/MASTG-TEST-0025.md

tests-beta/android/MASVS-CODE/MASTG-TEST-0288.md

demos/android/MASVS-CODE/MASTG-DEMO-0061/MASTG-DEMO-0061.md

ScreaMy7 · 2025-09-26T07:02:37Z

@serek8 ,
I made the changes as requested, please review.

demos/android/MASVS-CODE/MASTG-DEMO-0062/MASTG-DEMO-0062.md

tests-beta/android/MASVS-CODE/MASTG-TEST-0292.md

demos/android/MASVS-CODE/MASTG-DEMO-0062/MASTG-DEMO-0062.md

serek8

We still need to add best practices about Prepared Statements because they were present in MASTG-TEST-0025.md that we want to deprecate. We don't want to loose this information. Apart from that, let's fix the linter errors, everything else looks good.

serek8 · 2026-01-26T11:16:22Z

@ScreaMy7 did you have some time to have a look at it?

ScreaMy7 · 2026-01-27T07:00:19Z

@serek8 I have added the changes.

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 11 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

demos/android/MASVS-CODE/MASTG-DEMO-00XX/MASTG-DEMO-00XX.md

tests-beta/android/MASVS-CODE/MASTG-TEST-02XX.md

demos/android/MASVS-CODE/MASTG-DEMO-00XX/MASTG-DEMO-00XX.md

techniques/android/MASTG-TECH-XXXX.md

tests-beta/android/MASVS-CODE/MASTG-TEST-02XX.md

best-practices/MASTG-BEST-XXXX.md

demos/android/MASVS-CODE/MASTG-DEMO-00XX/MASTG-DEMO-00XX.md

serek8

The content looks good. Please fix the building/linter issues.

ScreaMy7 · 2026-02-03T11:28:52Z

The error is related dead links in other test files, not related with this PR.

best-practices/MASTG-BEST-XXXX.md

serek8 · 2026-02-04T12:15:06Z

@ScreaMy7 can you please add AndroidManifest.xml to the Demo? Without that the Provider won't work.

cpholguera · 2026-02-04T12:05:38Z

best-practices/MASTG-BEST-XXXX.md

@@ -0,0 +1,23 @@
+---
+title: Prevent SQL Injection in ContentProviders


Suggested change

title: Prevent SQL Injection in ContentProviders

title: Prevent SQL Injection in Content Providers

cpholguera · 2026-02-04T12:06:15Z

demos/android/MASVS-CODE/MASTG-DEMO-00XX/MASTG-DEMO-00XX.md

@@ -0,0 +1,41 @@
+---
+platform: android
+title: Injection flaws in Android Content providers


Suggested change

title: Injection flaws in Android Content providers

title: Injection Flaws in Android Content Providers

cpholguera · 2026-02-04T12:07:48Z

techniques/android/MASTG-TECH-XXXX.md

@@ -0,0 +1,83 @@
+---
+title: Testing Content URI Injection and Path-Segment Abuse


Suggested change

title: Testing Content URI Injection and Path-Segment Abuse

title: Content Providers URI Injection and Path-Segment Abuse

This needs a better title and potentially must be split in 2 techniques

tests-beta/android/MASVS-CODE/MASTG-TEST-02XX.md

cpholguera · 2026-02-04T12:16:44Z

tests-beta/android/MASVS-CODE/MASTG-TEST-02XX.md

+platform: android
+id: MASTG-TEST-02XX
+type: [static]
+weakness: MASWE-0086


Link MASTG-KNOW

@cpholguera There is no MASTG-KNOW related to this, should I create a new MASTG-KNOW.md file?

cpholguera · 2026-02-04T12:18:22Z

best-practices/MASTG-BEST-XXXX.md

+title: Prevent SQL Injection in ContentProviders
+alias: prevent-sqli-contentprovider
+id: MASTG-BEST-XXXX
+platform: android


Map to knowledge

ScreaMy7 added 5 commits August 6, 2025 11:52

draft

0661ed6

md fix

200cd94

small fix

ef93867

fix test-beta

ff67773

added weakness

28a04d4

cpholguera added the changes-done label Aug 12, 2025

OWASP deleted a comment from Kubabajura Aug 26, 2025

cpholguera requested review from Copilot and serek8 August 30, 2025 07:59

Copilot AI reviewed Aug 31, 2025

View reviewed changes

rules/mastg-android-sql-injection-contentprovider.yml Outdated Show resolved Hide resolved

tests-beta/android/MASVS-CODE/MASTG-TEST-0288.md Show resolved Hide resolved

serek8 suggested changes Sep 1, 2025

View reviewed changes

serek8 reviewed Sep 1, 2025

View reviewed changes

tests-beta/android/MASVS-CODE/MASTG-TEST-0288.md Show resolved Hide resolved

demos/android/MASVS-CODE/MASTG-DEMO-0061/MASTG-DEMO-0061.md Outdated Show resolved Hide resolved

ScreaMy7 added 2 commits September 12, 2025 14:33

added fix and best practise

903768b

another fix

52a416d

ScreaMy7 requested a review from serek8 September 12, 2025 14:35

serek8 reviewed Sep 26, 2025

View reviewed changes

demos/android/MASVS-CODE/MASTG-DEMO-0062/MASTG-DEMO-0062.md Outdated Show resolved Hide resolved

serek8 reviewed Sep 26, 2025

View reviewed changes

tests-beta/android/MASVS-CODE/MASTG-TEST-0292.md Outdated Show resolved Hide resolved

serek8 reviewed Sep 26, 2025

View reviewed changes

demos/android/MASVS-CODE/MASTG-DEMO-0062/MASTG-DEMO-0062.md Outdated Show resolved Hide resolved

cpholguera reviewed Sep 26, 2025

View reviewed changes

demos/android/MASVS-CODE/MASTG-DEMO-0062/MASTG-DEMO-0062.md Outdated Show resolved Hide resolved

added new tech and outputs.

40896f1

cpholguera requested a review from serek8 November 7, 2025 11:14

serek8 suggested changes Jan 13, 2026

View reviewed changes

ScreaMy7 added 2 commits January 26, 2026 16:55

lint fix and added Prepared statement

3e352f6

lint fix

ff3d8c6

cpholguera requested a review from Copilot January 27, 2026 07:08

Copilot started reviewing on behalf of cpholguera January 27, 2026 07:09 View session

cpholguera requested a review from serek8 January 27, 2026 07:09

Copilot AI reviewed Jan 27, 2026

View reviewed changes

spell fix

9eecdbe

serek8 approved these changes Jan 29, 2026

View reviewed changes

cpholguera added 2 commits February 3, 2026 12:45

Merge branch 'master' into injection-flaw-draft

20208db

Merge branch 'master' into injection-flaw-draft

c366d16

cpholguera reviewed Feb 3, 2026

View reviewed changes

best-practices/MASTG-BEST-XXXX.md Outdated Show resolved Hide resolved

Fix lint issue

f078291

cpholguera requested changes Feb 4, 2026

View reviewed changes

Merge branch 'master' into injection-flaw-draft

b3e356a

		@@ -0,0 +1,23 @@
		---
		title: Prevent SQL Injection in ContentProviders

	title: Prevent SQL Injection in ContentProviders
	title: Prevent SQL Injection in Content Providers

	title: Injection flaws in Android Content providers
	title: Injection Flaws in Android Content Providers

		@@ -0,0 +1,83 @@
		---
		title: Testing Content URI Injection and Path-Segment Abuse

	title: Testing Content URI Injection and Path-Segment Abuse
	title: Content Providers URI Injection and Path-Segment Abuse

Uh oh!

Port MASTG-TEST-0025: Testing for Injection Flaws (android) (by @appknox) #3424

Are you sure you want to change the base?

Port MASTG-TEST-0025: Testing for Injection Flaws (android) (by @appknox) #3424

Uh oh!

Conversation

ScreaMy7 commented Aug 12, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

serek8 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

serek8 Sep 26, 2025 • edited by cpholguera Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ScreaMy7 commented Sep 26, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

serek8 left a comment

Choose a reason for hiding this comment

Uh oh!

serek8 commented Jan 26, 2026

Uh oh!

ScreaMy7 commented Jan 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

serek8 left a comment

Choose a reason for hiding this comment

Uh oh!

ScreaMy7 commented Feb 3, 2026

Uh oh!

Uh oh!

serek8 commented Feb 4, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ScreaMy7 Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

serek8 left a comment •

edited

Loading

serek8 Sep 26, 2025 •

edited by cpholguera

Loading

ScreaMy7 Feb 9, 2026 •

edited

Loading