Skip to content

Commit 4185728

Browse files
hashicorp-vault-sonar-prod[bot]petertrr
hashicorp-vault-sonar-prod[bot]
and
petertrr
authored
Update rule metadata (#712)
Co-authored-by: petertrr <petertrr@users.noreply.github.com>
1 parent f1d541b commit 4185728

File tree

15 files changed

+285
-286
lines changed

15 files changed

+285
-286
lines changed

‎sonar-kotlin-plugin/sonarpedia.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"languages": [
44
"KOTLIN"
55
],
6-
"latest-update": "2026-04-10T12:56:34.437431195Z",
6+
"latest-update": "2026-04-17T11:19:29.957200855Z",
77
"options": {
88
"no-language-in-filenames": true,
99
"preserve-filenames": true

‎sonar-kotlin-plugin/src/main/resources/org/sonar/l10n/kotlin/rules/kotlin/S5320.html‎

Lines changed: 35 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,22 @@
1-
<p>In Android applications, broadcasting intents is security-sensitive. For example, it has led in the past to the following vulnerability:</p>
2-
<ul>
3-
<li><a href="https://www.cve.org/CVERecord?id=CVE-2018-9489">CVE-2018-9489</a></li>
4-
</ul>
5-
<p>By default, broadcasted intents are visible to every application, exposing all sensitive information they contain.</p>
6-
<p>This rule raises an issue when an intent is broadcasted without specifying any "receiver permission".</p>
7-
<h2>Ask Yourself Whether</h2>
8-
<ul>
9-
<li>The intent contains sensitive information.</li>
10-
<li>Intent reception is not restricted.</li>
11-
</ul>
12-
<p>There is a risk if you answered yes to any of those questions.</p>
13-
<h2>Recommended Secure Coding Practices</h2>
14-
<p>Restrict the access to broadcasted intents. See <a
15-
href="https://developer.android.com/guide/components/broadcasts.html#restricting_broadcasts_with_permissions">Android documentation</a> for more
16-
information.</p>
17-
<h2>Sensitive Code Example</h2>
18-
<pre>
1+
<p>Broadcasted intents in Android are visible to every application by default, which can expose sensitive information.</p>
2+
<h2>Why is this an issue?</h2>
3+
<p>By default, broadcasted intents are visible to every application on the device, exposing all sensitive information that intents contain. This rule
4+
raises an issue when an intent is broadcasted without specifying a receiver permission.</p>
5+
<p>Methods like <code>sendBroadcast</code>, <code>sendBroadcastAsUser</code>, <code>sendOrderedBroadcast</code>, and
6+
<code>sendOrderedBroadcastAsUser</code> that are called without a receiver permission parameter or with <code>null</code> for the permission allow any
7+
application to receive the broadcast.</p>
8+
<h3>What is the potential impact?</h3>
9+
<h4>Information disclosure</h4>
10+
<p>If an intent contains sensitive data such as user credentials, personal information, or internal application state, any malicious application
11+
installed on the same device can intercept and read this data.</p>
12+
<h4>Privilege escalation</h4>
13+
<p>A malicious application could listen for broadcasted intents to trigger unauthorized actions or manipulate application behavior, potentially
14+
gaining access to functionality that should be restricted.</p>
15+
<h2>How to fix it</h2>
16+
<h3>Code examples</h3>
17+
<p>The following code broadcasts an intent without specifying a receiver permission, making it accessible to all applications on the device.</p>
18+
<h4>Noncompliant code example</h4>
19+
<pre data-diff-id="1" data-diff-type="noncompliant">
1920
import android.content.BroadcastReceiver
2021
import android.content.Context
2122
import android.content.Intent
@@ -33,20 +34,20 @@ <h2>Sensitive Code Example</h2>
3334
initialData: String,
3435
initialExtras: Bundle,
3536
broadcastPermission: String) {
36-
context.sendBroadcast(intent) // Sensitive
37-
context.sendBroadcastAsUser(intent, user) // Sensitive
37+
context.sendBroadcast(intent) // Noncompliant
38+
context.sendBroadcastAsUser(intent, user) // Noncompliant
3839

3940
// Broadcasting intent with "null" for receiverPermission
40-
context.sendBroadcast(intent, null) // Sensitive
41-
context.sendBroadcastAsUser(intent, user, null) // Sensitive
42-
context.sendOrderedBroadcast(intent, null) // Sensitive
41+
context.sendBroadcast(intent, null) // Noncompliant
42+
context.sendBroadcastAsUser(intent, user, null) // Noncompliant
43+
context.sendOrderedBroadcast(intent, null) // Noncompliant
4344
context.sendOrderedBroadcastAsUser(intent, user, null, resultReceiver,
44-
scheduler, initialCode, initialData, initialExtras) // Sensitive
45+
scheduler, initialCode, initialData, initialExtras) // Noncompliant
4546
}
4647
}
4748
</pre>
48-
<h2>Compliant Solution</h2>
49-
<pre>
49+
<h4>Compliant solution</h4>
50+
<pre data-diff-id="1" data-diff-type="compliant">
5051
import android.content.BroadcastReceiver
5152
import android.content.Context
5253
import android.content.Intent
@@ -68,12 +69,18 @@ <h2>Compliant Solution</h2>
6869
context.sendBroadcast(intent, broadcastPermission)
6970
context.sendBroadcastAsUser(intent, user, broadcastPermission)
7071
context.sendOrderedBroadcast(intent, broadcastPermission)
71-
context.sendOrderedBroadcastAsUser(intent, user,broadcastPermission, resultReceiver,
72+
context.sendOrderedBroadcastAsUser(intent, user, broadcastPermission, resultReceiver,
7273
scheduler, initialCode, initialData, initialExtras)
7374
}
7475
}
7576
</pre>
76-
<h2>See</h2>
77+
<h2>Resources</h2>
78+
<h3>Documentation</h3>
79+
<ul>
80+
<li><a href="https://developer.android.com/guide/components/broadcasts.html#restricting_broadcasts_with_permissions">Android documentation</a> -
81+
Broadcast Overview - Security considerations and best practices</li>
82+
</ul>
83+
<h3>Standards</h3>
7784
<ul>
7885
<li>OWASP - <a href="https://owasp.org/Top10/A04_2021-Insecure_Design/">Top 10 2021 Category A4 - Insecure Design</a></li>
7986
<li>OWASP - <a href="https://mas.owasp.org/checklists/MASVS-PLATFORM/">Mobile AppSec Verification Standard - Platform Interaction
@@ -85,7 +92,5 @@ <h2>See</h2>
8592
<li>OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m8-security-misconfiguration">Mobile Top 10 2024 Category M8 - Security
8693
Misconfiguration</a></li>
8794
<li>CWE - <a href="https://cwe.mitre.org/data/definitions/927">CWE-927 - Use of Implicit Intent for Sensitive Communication</a></li>
88-
<li><a href="https://developer.android.com/guide/components/broadcasts.html#restricting_broadcasts_with_permissions">Android documentation</a> -
89-
Broadcast Overview - Security considerations and best practices</li>
9095
</ul>
9196

‎sonar-kotlin-plugin/src/main/resources/org/sonar/l10n/kotlin/rules/kotlin/S5320.json‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,23 @@
11
{
2-
"title": "Broadcasting intents is security-sensitive",
3-
"type": "SECURITY_HOTSPOT",
2+
"title": "Intents should not be broadcast without receiver permissions",
3+
"type": "VULNERABILITY",
44
"code": {
55
"impacts": {
6-
"SECURITY": "HIGH"
6+
"SECURITY": "MEDIUM"
77
},
88
"attribute": "COMPLETE"
99
},
1010
"status": "ready",
11+
"remediation": {
12+
"func": "Constant\/Issue",
13+
"constantCost": "10min"
14+
},
1115
"tags": [
1216
"cwe",
13-
"android"
17+
"android",
18+
"former-hotspot"
1419
],
15-
"defaultSeverity": "Critical",
20+
"defaultSeverity": "Major",
1621
"ruleSpecification": "RSPEC-5320",
1722
"sqKey": "S5320",
1823
"scope": "Main",

‎sonar-kotlin-plugin/src/main/resources/org/sonar/l10n/kotlin/rules/kotlin/S5322.html‎

Lines changed: 34 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,22 @@
1-
<p>Android applications can receive broadcasts from the system or other applications. Receiving intents is security-sensitive. For example, it has led
2-
in the past to the following vulnerabilities:</p>
3-
<ul>
4-
<li><a href="https://www.cve.org/CVERecord?id=CVE-2019-1677">CVE-2019-1677</a></li>
5-
<li><a href="https://www.cve.org/CVERecord?id=CVE-2015-1275">CVE-2015-1275</a></li>
6-
</ul>
7-
<p>Receivers can be declared in the manifest or in the code to make them context-specific. If the receiver is declared in the manifest Android will
8-
start the application if it is not already running once a matching broadcast is received. The receiver is an entry point into the application.</p>
9-
<p>Other applications can send potentially malicious broadcasts, so it is important to consider broadcasts as untrusted and to limit the applications
10-
that can send broadcasts to the receiver.</p>
11-
<p>Permissions can be specified to restrict broadcasts to authorized applications. Restrictions can be enforced by both the sender and receiver of a
12-
broadcast. If permissions are specified when registering a broadcast receiver, then only broadcasters who were granted this permission can send a
13-
message to the receiver.</p>
14-
<p>This rule raises an issue when a receiver is registered without specifying any broadcast permission.</p>
15-
<h2>Ask Yourself Whether</h2>
16-
<ul>
17-
<li>The data extracted from intents is not sanitized.</li>
18-
<li>Intents broadcast is not restricted.</li>
19-
</ul>
20-
<p>There is a risk if you answered yes to any of those questions.</p>
21-
<h2>Recommended Secure Coding Practices</h2>
22-
<p>Restrict the access to broadcasted intents. See the <a
23-
href="https://developer.android.com/guide/components/broadcasts.html#restricting_broadcasts_with_permissions">Android documentation</a> for more
24-
information.</p>
25-
<h2>Sensitive Code Example</h2>
26-
<pre>
1+
<p>Android applications can receive broadcasts from the system or other applications through registered broadcast receivers.</p>
2+
<h2>Why is this an issue?</h2>
3+
<p>A broadcast receiver registered or declared without a broadcast permission can receive intents from any application on the device, making it an
4+
unrestricted entry point into the application. Malicious or compromised applications can send crafted broadcasts that trigger unintended behavior,
5+
bypass access controls, or feed untrusted data into the application’s processing logic. This rule raises an issue when a receiver is registered in
6+
code without a <code>broadcastPermission</code> argument, or when a receiver is declared in the manifest as exported without an
7+
<code>android:permission</code> attribute.</p>
8+
<h3>What is the potential impact?</h3>
9+
<h4>Unauthorized access</h4>
10+
<p>An attacker controlling a malicious application can send arbitrary broadcasts to the unprotected receiver, potentially triggering sensitive
11+
operations such as changing application state or invoking privileged functionality without the user’s knowledge.</p>
12+
<h4>Data injection</h4>
13+
<p>Without restriction, any application can supply arbitrary intent data to the receiver. If that data is processed without validation, it can lead to
14+
logic errors or further exploitation within the application.</p>
15+
<h2>How to fix it</h2>
16+
<h3>Code examples</h3>
17+
<p>The following code registers a broadcast receiver without specifying a broadcast permission, allowing any application to send intents to it.</p>
18+
<h4>Noncompliant code example</h4>
19+
<pre data-diff-id="1" data-diff-type="noncompliant">
2720
import android.content.BroadcastReceiver
2821
import android.content.Context
2922
import android.content.IntentFilter
@@ -39,17 +32,17 @@ <h2>Sensitive Code Example</h2>
3932
scheduler: Handler?,
4033
flags: Int
4134
) {
42-
context.registerReceiver(receiver, filter) // Sensitive
43-
context.registerReceiver(receiver, filter, flags) // Sensitive
35+
context.registerReceiver(receiver, filter) // Noncompliant
36+
context.registerReceiver(receiver, filter, flags) // Noncompliant
4437

4538
// Broadcasting intent with "null" for broadcastPermission
46-
context.registerReceiver(receiver, filter, null, scheduler) // Sensitive
47-
context.registerReceiver(receiver, filter, null, scheduler, flags) // Sensitive
39+
context.registerReceiver(receiver, filter, null, scheduler) // Noncompliant
40+
context.registerReceiver(receiver, filter, null, scheduler, flags) // Noncompliant
4841
}
4942
}
5043
</pre>
51-
<h2>Compliant Solution</h2>
52-
<pre>
44+
<h4>Compliant solution</h4>
45+
<pre data-diff-id="1" data-diff-type="compliant">
5346
import android.content.BroadcastReceiver
5447
import android.content.Context
5548
import android.content.IntentFilter
@@ -71,8 +64,16 @@ <h2>Compliant Solution</h2>
7164
}
7265
}
7366
</pre>
74-
<h2>See</h2>
67+
<h2>Resources</h2>
68+
<h3>Documentation</h3>
69+
<ul>
70+
<li><a href="https://developer.android.com/guide/components/broadcasts.html#restricting_broadcasts_with_permissions">Android documentation</a> -
71+
Broadcast Overview - Security considerations and best practices</li>
72+
</ul>
73+
<h3>Standards</h3>
7574
<ul>
75+
<li>CWE - <a href="https://cwe.mitre.org/data/definitions/925">CWE-925 - Improper Verification of Intent by Broadcast Receiver</a></li>
76+
<li>CWE - <a href="https://cwe.mitre.org/data/definitions/926">CWE-926 - Improper Export of Android Application Components</a></li>
7677
<li>OWASP - <a href="https://mas.owasp.org/checklists/MASVS-PLATFORM/">Mobile AppSec Verification Standard - Platform Interaction
7778
Requirements</a></li>
7879
<li>OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m1-improper-platform-usage">Mobile Top 10 2016 Category M1 - Improper
@@ -81,9 +82,5 @@ <h2>See</h2>
8182
- Insecure Authentication/Authorization</a></li>
8283
<li>OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m4-insufficient-input-output-validation">Mobile Top 10 2024 Category M4
8384
- Insufficient Input/Output Validation</a></li>
84-
<li>CWE - <a href="https://cwe.mitre.org/data/definitions/925">CWE-925 - Improper Verification of Intent by Broadcast Receiver</a></li>
85-
<li>CWE - <a href="https://cwe.mitre.org/data/definitions/926">CWE-926 - Improper Export of Android Application Components</a></li>
86-
<li><a href="https://developer.android.com/guide/components/broadcasts.html#restricting_broadcasts_with_permissions">Android documentation</a> -
87-
Broadcast Overview - Security considerations and best practices</li>
8885
</ul>
8986

‎sonar-kotlin-plugin/src/main/resources/org/sonar/l10n/kotlin/rules/kotlin/S5322.json‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
{
2-
"title": "Receiving intents is security-sensitive",
3-
"type": "SECURITY_HOTSPOT",
2+
"title": "Android broadcast receivers should not be registered without a permission",
3+
"type": "VULNERABILITY",
4+
"quickfix": "unknown",
5+
"remediation": {
6+
"func": "Constant\/Issue",
7+
"constantCost": "15min"
8+
},
49
"code": {
510
"impacts": {
611
"SECURITY": "HIGH"
@@ -10,7 +15,8 @@
1015
"status": "ready",
1116
"tags": [
1217
"cwe",
13-
"android"
18+
"android",
19+
"former-hotspot"
1420
],
1521
"defaultSeverity": "Critical",
1622
"ruleSpecification": "RSPEC-5322",
@@ -31,6 +37,5 @@
3137
"MASVS": [
3238
"MSTG-PLATFORM-2"
3339
]
34-
},
35-
"quickfix": "unknown"
40+
}
3641
}

‎sonar-kotlin-plugin/src/main/resources/org/sonar/l10n/kotlin/rules/kotlin/S5324.html‎

Lines changed: 29 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,38 +1,34 @@
1-
<p>Storing data locally is a common task for mobile applications. Such data includes files among other things. One convenient way to store files is to
2-
use the external file storage which usually offers a larger amount of disc space compared to internal storage.</p>
3-
<p>Files created on the external storage are globally readable and writable. Therefore, a malicious application having the permissions
4-
<code>WRITE_EXTERNAL_STORAGE</code> or <code>READ_EXTERNAL_STORAGE</code> could try to read sensitive information from the files that other
5-
applications have stored on the external storage.</p>
6-
<p>External storage can also be removed by the user (e.g. when based on SD card) making the files unavailable to the application.</p>
7-
<h2>Ask Yourself Whether</h2>
8-
<p>Your application uses external storage to:</p>
9-
<ul>
10-
<li>store files that contain sensitive data.</li>
11-
<li>store files that are not meant to be shared with other application.</li>
12-
<li>store files that are critical for the application to work.</li>
13-
</ul>
14-
<p>There is a risk if you answered yes to any of those questions.</p>
15-
<h2>Recommended Secure Coding Practices</h2>
16-
<ul>
17-
<li>Use internal storage whenever possible as the system prevents other apps from accessing this location.</li>
18-
<li>Only use external storage if you need to share non-sensitive files with other applications.</li>
19-
<li>If your application has to use the external storage to store sensitive data, make sure it encrypts the files using <a
20-
href="https://developer.android.com/reference/androidx/security/crypto/EncryptedFile">EncryptedFile</a>.</li>
21-
<li>Data coming from external storage should always be considered untrusted and should be validated.</li>
22-
<li>As some external storage can be removed, make sure to never store files on it that are critical for the usability of your application.</li>
23-
</ul>
24-
<h2>Sensitive Code Example</h2>
1+
<p>Android applications can store files on external storage (such as an SD card or shared storage), which is globally readable and writable by other
2+
applications.</p>
3+
<h2>Why is this an issue?</h2>
4+
<p>External storage in Android is globally readable and writable by any application that holds the <code>READ_EXTERNAL_STORAGE</code> or
5+
<code>WRITE_EXTERNAL_STORAGE</code> permissions. Files stored there can be read, modified, or deleted by other applications, making external storage
6+
unsuitable for sensitive data. External storage can also be physically removed by the user, causing files to become unavailable at any time. This rule
7+
raises an issue when an application accesses external storage directories via APIs such as <code>getExternalFilesDir</code>,
8+
<code>getExternalStorageDirectory</code>, or equivalent.</p>
9+
<h3>What is the potential impact?</h3>
10+
<h4>Data exposure</h4>
11+
<p>A malicious application with storage permissions can read sensitive files stored in external storage, leading to exposure of user credentials,
12+
personal data, or application secrets.</p>
13+
<h4>Data integrity</h4>
14+
<p>An attacker can modify or delete files in external storage, corrupting application data or injecting malicious content that the application will
15+
later process.</p>
16+
<h2>How to fix it</h2>
17+
<h3>Code examples</h3>
18+
<p>The following code accesses external storage, which is globally readable and writable by other applications and therefore should not be used to
19+
store sensitive data.</p>
20+
<h4>Noncompliant code example</h4>
2521
<pre data-diff-id="1" data-diff-type="noncompliant">
2622
import android.content.Context
2723

2824
class AccessExternalFiles {
2925

3026
fun accessFiles(Context context) {
31-
context.getExternalFilesDir(null) // Sensitive
27+
context.getExternalFilesDir(null) // Noncompliant
3228
}
3329
}
3430
</pre>
35-
<h2>Compliant Solution</h2>
31+
<h4>Compliant solution</h4>
3632
<pre data-diff-id="1" data-diff-type="compliant">
3733
import android.content.Context
3834
import android.os.Environment
@@ -44,11 +40,15 @@ <h2>Compliant Solution</h2>
4440
}
4541
}
4642
</pre>
47-
<h2>See</h2>
43+
<h2>Resources</h2>
44+
<h3>Documentation</h3>
4845
<ul>
49-
<li>OWASP - <a href="https://owasp.org/Top10/A04_2021-Insecure_Design/">Top 10 2021 Category A4 - Insecure Design</a></li>
50-
<li><a href="https://developer.android.com/privacy-and-security/security-tips#ExternalStorage">Android Security tips on external file
46+
<li><a href="https://developer.android.com/privacy-and-security/security-tips#external-storage">Android Security tips on external file
5147
storage</a></li>
48+
</ul>
49+
<h3>Standards</h3>
50+
<ul>
51+
<li>OWASP - <a href="https://owasp.org/Top10/A04_2021-Insecure_Design/">Top 10 2021 Category A4 - Insecure Design</a></li>
5252
<li>OWASP - <a href="https://mas.owasp.org/checklists/MASVS-STORAGE/">Mobile AppSec Verification Standard - Data Storage and Privacy
5353
Requirements</a></li>
5454
<li>OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m2-insecure-data-storage">Mobile Top 10 2016 Category M2 - Insecure Data

‎sonar-kotlin-plugin/src/main/resources/org/sonar/l10n/kotlin/rules/kotlin/S5324.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,21 @@
11
{
2-
"title": "Accessing Android external storage is security-sensitive",
3-
"type": "SECURITY_HOTSPOT",
2+
"title": "Sensitive data should not be stored in Android external storage",
3+
"type": "VULNERABILITY",
44
"code": {
55
"impacts": {
66
"SECURITY": "HIGH"
77
},
88
"attribute": "COMPLETE"
99
},
1010
"status": "ready",
11+
"remediation": {
12+
"func": "Constant\/Issue",
13+
"constantCost": "1h"
14+
},
1115
"tags": [
1216
"cwe",
13-
"android"
17+
"android",
18+
"former-hotspot"
1419
],
1520
"defaultSeverity": "Critical",
1621
"ruleSpecification": "RSPEC-5324",

0 commit comments

Comments
 (0)