Port MASTG-TEST-0028: Testing for Testing Deep Links (android) (by @appknox) #3463

ScreaMy7 · 2025-09-18T14:39:14Z

tests-beta/android/MASVS-PLATFORM/MASTG-TEST-XXXA.md

cpholguera · 2025-09-21T08:51:50Z

tests/android/MASVS-PLATFORM/MASTG-TEST-0028.md

@ScreaMy7 ⚠️ PLEASE BE CAREFUL:

I see that a lot of the information contained in this test is being lost right now. Please consider porting it all:

What information is knowledge and belongs in https://mas.owasp.org/MASTG/knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0019/

What information describes best practices and should be added to a new MASTG-BEST-XXXX? (each test should have at least one best practice linked)

What techniques are here that don't have a MASTG-TECH-XXXX entry? e.g.

"Check for Deep Link Usage"

"Check for Correct Website Association"

"Monitoring Deep Links"

"Invoking Deep Links"

etc

What tools are used and don't have a MASTG-TOOL-XXXX entry? e.g. "Android App Link Verification Tester"

What tests are missing?

"Use of Unverified App Links"

"Use of Unverified Custom URL Schemes"

"Use of Verified App Links with Incorrect Website Association"

cpholguera · 2025-09-21T08:54:27Z

tests-beta/android/MASVS-PLATFORM/MASTG-TEST-XXXB.md

@@ -0,0 +1,24 @@
+---
+title: Deep Link Intent Filter Missing android:autoVerify


This should be "Use of Unverified App Links" plus an additional "Use of Unverified Custom URL Schemes" which is now missing.

cpholguera · 2025-09-21T08:58:34Z

Also please use "fake IDs" (e.g. MASTG-TEST-0x28-1, MASTG-TEST-0x28-2, MASTG-DEMO-00xx-1, MASTG-DEMO-00xx-2) until we're ready to merge, to avoid conflicts.

cpholguera · 2025-12-01T19:34:03Z

@ScreaMy7 any news on this?

ScreaMy7 · 2025-12-08T18:13:36Z

@cpholguera I have added new demos, a tool and the new technique also contain invoking and monitoring deeplinks. Please review.

Copilot

Pull request overview

This PR ports MASTG-TEST-0028 (Testing Deep Links on Android) from the legacy format to MASTG V2 structure. It deprecates the old test and creates three new focused tests covering different deep link security aspects, along with comprehensive supporting documentation.

Creates three new deep link security tests (MASTG-TEST-XXXA, MASTG-TEST-XXXB, MASTG-TEST-0295) covering WebView URL validation, autoVerify attribute, and custom URL schemes
Adds new technique document (MASTG-TECH-XXXX) with detailed procedures for deep link testing including verification, monitoring, and invocation
Provides three complete demos with Semgrep rules, sample code, and expected outputs

Reviewed changes

Copilot reviewed 25 out of 25 changed files in this pull request and generated 26 comments.

Show a summary per file

File	Description
tests/android/MASVS-PLATFORM/MASTG-TEST-0028.md	Marks the legacy test as deprecated with references to new replacement tests
tests-beta/android/MASVS-PLATFORM/MASTG-TEST-XXXA.md	New test for detecting unvalidated deep link URLs loaded into WebViews
tests-beta/android/MASVS-PLATFORM/MASTG-TEST-XXXB.md	New test for detecting missing android:autoVerify attribute in intent filters
tests-beta/android/MASVS-PLATFORM/MASTG-TEST-XXXC.md	New test (ID: MASTG-TEST-0295) for detecting use of unverified custom URL schemes
techniques/android/MASTG-TECH-XXXX.md	Comprehensive technique document covering deep link detection, validation, monitoring, and invocation
tools/android/MASTG-TOOL-014X.md	Documents the App Link Verification command-line tool
rules/mastg-android-unvalidated-deeplink-data.yml	Semgrep taint rule for detecting unvalidated deep link data flows to WebView
rules/mastg-android-custom-deeplink-scheme.yml	Semgrep rule for detecting custom URL schemes in intent filters
rules/mastg-android-autoverify-missing.yml	Semgrep rule for detecting missing autoVerify attribute
demos/android/MASVS-PLATFORM/MASTG-DEMO-XXXA/*	Complete demo for WebView deep link vulnerability with Kotlin source, reversed Java, manifest, and Semgrep output
demos/android/MASVS-PLATFORM/MASTG-DEMO-XXXB/*	Complete demo for missing autoVerify attribute with manifest and Semgrep output
demos/android/MASVS-PLATFORM/MASTG-DEMO-XXXC/*	Complete demo for custom URL scheme vulnerability with Kotlin source, reversed Java, manifest, and Semgrep output

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

tests-beta/android/MASVS-PLATFORM/MASTG-TEST-XXXB.md

techniques/android/MASTG-TECH-XXXX.md

demos/android/MASVS-PLATFORM/MASTG-DEMO-XXXC/MASTG-DEMO-XXXC.md

demos/android/MASVS-PLATFORM/MASTG-DEMO-XXXB/MASTG-DEMO-XXXB.md

tests-beta/android/MASVS-PLATFORM/MASTG-TEST-XXXA.md

demos/android/MASVS-PLATFORM/MASTG-DEMO-XXXC/MASTG-DEMO-XXXC.md

demos/android/MASVS-PLATFORM/MASTG-DEMO-XXXB/MASTG-DEMO-XXXB.md

demos/android/MASVS-PLATFORM/MASTG-DEMO-XXXA/MASTG-DEMO-XXXA.md

cpholguera · 2025-12-08T18:53:45Z

tests-beta/android/MASVS-PLATFORM/MASTG-TEST-XXXC.md

+
+## Steps
+
+1. Run a static analysis tool such as @MASTG-TOOL-0110 on the `AndroidManifest.xml` to list the `VIEW/BROWSABLE` intent-filters declaring non-HTTP(S) schemes.


No tools in tests.

Correct words "intent filter".

cpholguera · 2025-12-08T18:54:33Z

tests-beta/android/MASVS-PLATFORM/MASTG-TEST-XXXC.md

+
+## Evaluation
+
+The test fails if the app relies on custom URL schemes for high-risk operations that should use verified App Links (HTTPS) with Digital Asset Links. Mitigations include migrating to App Links for exclusivity or implementing robust in-app validation and user confirmation.


No mitigations in tests. Add best-practices in the metadata.

demos/android/MASVS-PLATFORM/MASTG-DEMO-XXXA/AndroidManifest_reversed.xml

demos/android/MASVS-PLATFORM/MASTG-DEMO-XXXB/AndroidManifest_reversed.xml

demos/android/MASVS-PLATFORM/MASTG-DEMO-XXXC/AndroidManifest_reversed.xml

cpholguera · 2026-01-27T08:11:20Z

demos/android/MASVS-PLATFORM/MASTG-DEMO-XXXC/MASTG-DEMO-XXXC.md

+status: new
+---
+
+### Overview


Demos don't have an Overview section

cpholguera · 2026-01-27T08:11:52Z

demos/android/MASVS-PLATFORM/MASTG-DEMO-XXXC/MASTG-DEMO-XXXC.md

+
+This demo references a manifest that declares a custom scheme:
+
+{{ AndroidManifest_reversed.xml }}


Original manifest missing

cpholguera · 2026-01-27T08:25:38Z

@ScreaMy7 please take a look. There are review comments from December and today.

ScreaMy7 · 2026-02-09T10:27:09Z

@cpholguera I have added the changes. Please review.

Copilot

Pull request overview

Copilot reviewed 28 out of 28 changed files in this pull request and generated 32 comments.

tools/android/MASTG-TOOL-014X.md

Copilot · 2026-02-10T06:01:31Z

tests-beta/android/MASVS-PLATFORM/MASTG-TEST-XXXA.md

+type: [static]
+weakness: MASWE-0071
+profiles: [L1, L2]
+knowledge: [MASTG-KNOW-0019]


knowledge: [MASTG-KNOW-0019] references a knowledge page that doesn't exist anywhere under knowledge/ in this repo. Either reference an existing MASTG-KNOW-#### entry or add the missing knowledge page and use its actual ID.

Suggested change

knowledge: [MASTG-KNOW-0019]

Copilot · 2026-02-10T06:01:32Z

tests-beta/android/MASVS-PLATFORM/MASTG-TEST-XXXC.md

+
+## Evaluation
+
+The test fails if the app relies on custom URL schemes for high-risk operations that should use verified App Links (HTTPS) with Digital Asset Links.


Evaluation should start with "The test case fails if ..." to match the standard test template used in tests-beta (for example tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0316.md).

Suggested change

The test fails if the app relies on custom URL schemes for high-risk operations that should use verified App Links (HTTPS) with Digital Asset Links.

The test case fails if the app relies on custom URL schemes for high-risk operations that should use verified App Links (HTTPS) with Digital Asset Links.

Copilot · 2026-02-10T06:01:32Z

demos/android/MASVS-PLATFORM/MASTG-DEMO-XXXB/AndroidManifest_reversed.xml

+                    android:scheme="vulnerable-app"
+                    android:host="deeplink"/>


This demo is intended to illustrate missing App Links verification (android:autoVerify), but the intent-filter shown uses a custom scheme (android:scheme="vulnerable-app"). App Links are HTTPS URLs; android:autoVerify is not applicable to custom schemes. Update the sample to use an https scheme + host (and keep android:autoVerify absent) so the demo and rule match the real failure mode.

Suggested change

android:scheme="vulnerable-app"

android:host="deeplink"/>

android:scheme="https"

android:host="vulnerable-app.example"/>

demos/android/MASVS-PLATFORM/MASTG-DEMO-XXXC/MASTG-DEMO-XXXC.md

Copilot · 2026-02-10T06:01:37Z

rules/mastg-android-autoverify-missing.yml

+rules:
+- id: android-autoverify-missing
+  severity: WARNING


Rule IDs in this repo typically use the mastg-android-... prefix (matching the filename), but this new rule uses android-autoverify-missing. Consider renaming the rule id to follow the established prefixing so references and output are consistent.

Copilot · 2026-02-10T06:01:37Z

rules/mastg-android-custom-deeplink-scheme.yml

+rules:
+- id: android-custom-deeplink-intent-filter
+  severity: WARNING


Rule IDs in this repo typically use the mastg-android-... prefix (matching the filename), but this new rule uses android-custom-deeplink-intent-filter. Consider renaming the rule id to follow the established prefixing for consistency with other rules.

Copilot · 2026-02-10T06:01:37Z

techniques/android/MASTG-TECH-XXXX.md

+```bash
+$ python3 deeplink_analyser.py -op list-all -apk example.apk
+
+org.owasp.mastestapp.MainActivity
+
+vulnerable-app://deeplink
+```


Shell command examples in fenced blocks should not include a prompt character. Remove the leading $ so the command is directly copy/pasteable.

tests-beta/android/MASVS-PLATFORM/MASTG-TEST-XXXC.md

Copilot · 2026-02-10T06:01:38Z

demos/android/MASVS-PLATFORM/MASTG-DEMO-XXXB/run.sh

@@ -0,0 +1 @@
+NO_COLOR=true semgrep -c ../../../../rules/mastg-android-autoverify-missing.yml ../MASTG-DEMO-0062/AndroidManifest_reversed.xml --text -o output.txt


run.sh references ../MASTG-DEMO-0062/AndroidManifest_reversed.xml instead of the manifest shipped in this demo folder, which makes the demo non-self-contained and couples it to another demo's layout. Point the command at ./AndroidManifest_reversed.xml (or include the needed file locally) so the demo can run independently.

Suggested change

NO_COLOR=true semgrep -c ../../../../rules/mastg-android-autoverify-missing.yml ../MASTG-DEMO-0062/AndroidManifest_reversed.xml --text -o output.txt

NO_COLOR=true semgrep -c ../../../../rules/mastg-android-autoverify-missing.yml ./AndroidManifest_reversed.xml --text -o output.txt

ScreaMy7 and others added 5 commits September 4, 2025 13:30

added testing deeplinks

7b32ee2

after review

516166a

md fix

bdb97d8

moved to platform

afbe8b6

Merge branch 'master' into Testing-deeplink-draft

aa1894b

cpholguera requested changes Sep 21, 2025

View reviewed changes

cpholguera changed the title ~~MASTG v1->v2 MASTG-TEST-0028: Testing for Testing Deep Links (android) (by @appknox)~~ Port MASTG-TEST-0028: Testing for Testing Deep Links (android) (by @appknox) Oct 28, 2025

cpholguera requested a review from serek8 November 7, 2025 11:08

add new tech and demos.

a14745d

cpholguera requested a review from Copilot December 8, 2025 18:16

Copilot started reviewing on behalf of cpholguera December 8, 2025 18:16 View session

Copilot AI reviewed Dec 8, 2025

View reviewed changes

Merge branch 'master' into Testing-deeplink-draft

d95df4f

cpholguera requested changes Jan 27, 2026

View reviewed changes

added fix and original manifest

05ad8a3

ScreaMy7 requested a review from cpholguera February 9, 2026 10:22

Merge branch 'master' into Testing-deeplink-draft

b4efe36

cpholguera requested a review from Copilot February 10, 2026 05:49

Copilot started reviewing on behalf of cpholguera February 10, 2026 05:50 View session

Copilot AI reviewed Feb 10, 2026

View reviewed changes

		@@ -0,0 +1,24 @@
		---
		title: Deep Link Intent Filter Missing android:autoVerify


		## Steps

		1. Run a static analysis tool such as @MASTG-TOOL-0110 on the `AndroidManifest.xml` to list the `VIEW/BROWSABLE` intent-filters declaring non-HTTP(S) schemes.


		## Evaluation

		The test fails if the app relies on custom URL schemes for high-risk operations that should use verified App Links (HTTPS) with Digital Asset Links. Mitigations include migrating to App Links for exclusivity or implementing robust in-app validation and user confirmation.


		This demo references a manifest that declares a custom scheme:

		{{ AndroidManifest_reversed.xml }}

	The test fails if the app relies on custom URL schemes for high-risk operations that should use verified App Links (HTTPS) with Digital Asset Links.
	The test case fails if the app relies on custom URL schemes for high-risk operations that should use verified App Links (HTTPS) with Digital Asset Links.

		@@ -0,0 +1 @@
		NO_COLOR=true semgrep -c ../../../../rules/mastg-android-autoverify-missing.yml ../MASTG-DEMO-0062/AndroidManifest_reversed.xml --text -o output.txt No newline at end of file

Uh oh!

Port MASTG-TEST-0028: Testing for Testing Deep Links (android) (by @appknox) #3463

Are you sure you want to change the base?

Port MASTG-TEST-0028: Testing for Testing Deep Links (android) (by @appknox) #3463

Uh oh!

Conversation

ScreaMy7 commented Sep 18, 2025

Uh oh!

Uh oh!

cpholguera Sep 21, 2025

Choose a reason for hiding this comment

Uh oh!

cpholguera Sep 21, 2025

Choose a reason for hiding this comment

Uh oh!

cpholguera commented Sep 21, 2025

Uh oh!

cpholguera commented Dec 1, 2025

Uh oh!

ScreaMy7 commented Dec 8, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cpholguera Dec 8, 2025

Choose a reason for hiding this comment

Uh oh!

cpholguera Dec 8, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cpholguera Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

cpholguera Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

cpholguera commented Jan 27, 2026

Uh oh!

ScreaMy7 commented Feb 9, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!