Port MASTG v1->v2 MASTG-TEST-0002: Testing Local Storage for Input Validation (android) (by @appknox) #3328

jeel38 · 2025-06-10T08:06:16Z

This PR ports MASTG-TEST-0002 from version 1 to version 2, creating a new test for detecting use of local storage for input validation in Android applications. The focus shifts from general local storage testing to specifically checking for integrity validation when reading from SharedPreferences.

Deprecates the old MASTG-TEST-0002 and creates MASTG-TEST-0288 as the new version
Implements static analysis detection for SharedPreferences usage without integrity checks
Provides demonstration code showing both vulnerable and secure patterns using HMAC validation

File	Description
tests/android/MASVS-CODE/MASTG-TEST-0002.md	Marks the original test as deprecated with reference to new version
tests-beta/android/MASVS-CODE/MASTG-TEST-0288.md	New test specification for detecting `SharedPreferences` without integrity validation
rules/mastg-android-local-storage-input-validation.yml	Semgrep rule to detect insecure `SharedPreferences` usage patterns
demos/android/MASVS-CODE/MASTG-DEMO-0061/	Complete demonstration including vulnerable code, and analysis output

Co-authored-by: pruDhv! <[email protected]>

jeel38 · 2025-06-10T08:26:01Z

@cpholguera, upon adding the depreciation note, getting branch gets a conflict

cpholguera · 2025-06-10T08:30:01Z

Maybe the branch was a bit old. We added "profiles" now for all tests. I fixed the conflict for you

Please add profiles to tests-beta/android/MASVS-CODE/MASTG-TEST-0281.md as well

cpholguera · 2025-06-10T08:31:56Z

The new profiles (previously known as "levels") are defined here: https://docs.google.com/document/d/1paz7dxKXHzAC9MN7Mnln1JiZwBNyg7Gs364AJ6KudEs/edit?usp=sharing

jeel38 · 2025-06-10T08:42:56Z

Maybe the branch was a bit old. We added "profiles" now for all tests. I fixed the conflict for you

Please add profiles to tests-beta/android/MASVS-CODE/MASTG-TEST-0281.md as well

Done

jeel38 · 2025-06-10T08:45:17Z

@cpholguera please review it

cpholguera · 2025-06-10T08:46:00Z

Please fix the issues reported by Copilot in section "Comments suppressed due to low confidence (5)"

Also, I agree with Copilot's comment about:

"The output file shows usages of the input validation using putString and getString in the code."

The phrasing is misleading: this test detects storage/retrieval calls, not input validation.

If you're conducting a pentest, would you report this as an issue? "The app uses putString() and getString()." The same goes for an automated security testing tool, would you like it to report this? Wouldn't that be noisy / lots of false positives?

cpholguera · 2025-06-10T11:51:49Z

There's another problem that will probably be solved when you fix the copilot issues. Are you able to read these logs?

https://github.com/OWASP/owasp-mastg/actions/runs/15554645412/job/43792346017?pr=3328

ERROR - Error reading page 'MASTG/demos/android/MASVS-CODE/MASTG-DEMO-0054/MASTG-DEMO-0054.md': Snippet at path '../../../../rules/mastg-android-local-storage-for-input-validation.yml' could not be found

jeel38 · 2025-08-11T09:50:55Z

@cpholguera please check

Copilot

Pull Request Overview

This PR ports MASTG-TEST-0002 from version 1 to version 2, creating a new test for detecting use of local storage for input validation in Android applications. The focus shifts from general local storage testing to specifically checking for integrity validation when reading from SharedPreferences.

Deprecates the old MASTG-TEST-0002 and creates MASTG-TEST-0288 as the new version
Implements static analysis detection for SharedPreferences usage without integrity checks
Provides demonstration code showing both vulnerable and secure patterns using HMAC validation

Reviewed Changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

File	Description
tests/android/MASVS-CODE/MASTG-TEST-0002.md	Marks the original test as deprecated with reference to new version
tests-beta/android/MASVS-CODE/MASTG-TEST-0288.md	New test specification for detecting SharedPreferences without integrity validation
rules/mastg-android-local-storage-input-validation.yml	Semgrep rule to detect insecure SharedPreferences usage patterns
demos/android/MASVS-CODE/MASTG-DEMO-0061/	Complete demonstration including vulnerable Java code, secure Kotlin implementation, and analysis output

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-08-31T18:30:21Z

tests/android/MASVS-CODE/MASTG-TEST-0002.md

 - L2
 profiles: [L1, L2]
+status: deprecated
+covered_by: [MASTG-TEST-0281]


The deprecation references MASTG-TEST-0281, but the actual replacement test created in this PR is MASTG-TEST-0288. This should be corrected to reference the correct test ID.

Suggested change

covered_by: [MASTG-TEST-0281]

covered_by: [MASTG-TEST-0288]

rules/mastg-android-local-storage-input-validation.yml

cpholguera · 2025-06-10T08:35:52Z

tests-beta/android/MASVS-CODE/MASTG-TEST-0281.md

+
+## Steps
+
+1. Run a static analysis tool such as @MASTG-TOOL-0110 on the code and look for uses of the `putString` and `getString`.


https://mas.owasp.org/MASTG/techniques/android/MASTG-TECH-0014/

This is an old file

rules/mastg-android-local-storage-input-validation.yml

cpholguera · 2025-09-06T08:00:08Z

demos/android/MASVS-CODE/MASTG-DEMO-0061/MASTG-DEMO-0061.md

+
+### Evaluation
+
+The test fails as the code does not use an `HMAC` integrity check together with `SharedPreferences` data.


Please describe how, because of this, an attacker can exploit the app. Use references to techniques when possible.

jeel38 · 2025-09-17T12:09:09Z

@cpholguera requested changes be made. Could you please check

jeel38 · 2025-10-07T15:37:03Z

@cpholguera can you please review

jeel38 · 2025-10-27T04:42:55Z

@cpholguera can you please review it

Copilot

Pull Request Overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

demos/android/MASVS-CODE/MASTG-DEMO-0061/MastgTest.kt

Diolor

Thank you @jeel38 ! Really nice pen-test example ^^ Left some suggestions to improve this test. Feel free to reach out if something is unclear

Diolor · 2025-10-28T14:54:29Z

demos/android/MASVS-CODE/MASTG-DEMO-0061/MASTG-DEMO-0061.md

+---
+platform: android
+title: Local Storage for Input Validation with semgrep
+id: MASTG-DEMO-0061


you might need a new id just before merge (demo 61 exists)

Diolor · 2025-10-28T14:54:47Z

tests-beta/android/MASVS-CODE/MASTG-TEST-0288.md

+---
+title: Use of Local Storage for Input Validation
+platform: android
+id: MASTG-TEST-0288


you might need a new id just before merge (test 288 already exists)

Diolor · 2025-10-28T17:01:55Z

tests-beta/android/MASVS-CODE/MASTG-TEST-0288.md

+
+## Overview
+
+Data stored in Android's `SharedPreference`s can be tampered with on a rooted device. If an application reads this data without verifying its integrity (e.g., with an HMAC signature), it can lead to security vulnerabilities. This test checks if the application properly validates data read from local storage.


This is already really well-written @jeel38! How about we generalise it a bit and add a note, comment, or intro that this test is not only about SharedPrefs, but also any other local storage, like the v1 test mentions?

Additionally, we should add the requirement for data authenticity (HMAC is about both integrity and authenticity after all):

Suggested change

Data stored in Android's `SharedPreference`s can be tampered with on a rooted device. If an application reads this data without verifying its integrity (e.g., with an HMAC signature), it can lead to security vulnerabilities. This test checks if the application properly validates data read from local storage.

Data stored in Android's `SharedPreference`s can be tampered with on a rooted device. If an application reads this data without verifying its integrity and authenticity (e.g., with an HMAC signature), it can lead to security vulnerabilities. This test checks if the application properly validates data read from local storage.

What we could highlight here to help the reader is that SHA (integrity check without authenticity check) might not be optimal unless the SHA hashes are stored in a backend server. Therefore, by using HMAC, we only need to store the key safely and the data + HMAC hash in the local storage.

Diolor · 2025-10-28T17:04:44Z

tests-beta/android/MASVS-CODE/MASTG-TEST-0288.md

+
+## Evaluation
+
+The test fails as the application does not verify the integrity of data loaded from `SharedPreferences`. Without an integrity check like `HMAC`, an attacker with root access can directly edit the SharedPreferences XML file, modifying values to grant themselves higher privileges. The app then reads and acts on this tampered data, leading to a critical security failure, like privilege escalation.


Suggested change

The test fails as the application does not verify the integrity of data loaded from `SharedPreferences`. Without an integrity check like `HMAC`, an attacker with root access can directly edit the SharedPreferences XML file, modifying values to grant themselves higher privileges. The app then reads and acts on this tampered data, leading to a critical security failure, like privilege escalation.

The test fails if the application does not verify the integrity and authenticity of data loaded from local storage such as `SharedPreferences`.

I would consolidate the other sentences as part of the overview to explain the risk etc...

Please Refer to this comment: #3328 (comment)

To my understanding, @cpholguera pointed out that suggestion for the DEMO, this is the TEST file.
Reading this TEST's Overview and Evaluation sections seems to be some repetition.

Diolor · 2025-10-28T17:07:38Z

tests-beta/android/MASVS-CODE/MASTG-TEST-0288.md

@@ -0,0 +1,24 @@
+---
+title: Use of Local Storage for Input Validation


How about the following? Input validation to me sounds validating input rather than checking the integrity/authenticity of data.

Suggested change

title: Use of Local Storage for Input Validation

title: Validation of Local Storage Data

or

Suggested change

title: Use of Local Storage for Input Validation

title: Integrity and Authenticity Validation of Local Storage Data

Diolor · 2025-10-28T17:09:00Z

demos/android/MASVS-CODE/MASTG-DEMO-0061/run.sh

@@ -0,0 +1 @@
+NO_COLOR=true semgrep -c ../../../../rules/mastg-android-local-storage-input-validation.yml ./MastgTest_reversed.java --text -o output.txt


Suggested change

NO_COLOR=true semgrep -c ../../../../rules/mastg-android-local-storage-input-validation.yml ./MastgTest_reversed.java --text -o output.txt

NO_COLOR=true semgrep -c ../../../../rules/mastg-android-local-storage-input-validation.yml ./MastgTest_reversed.java > output.txt

to align with rest of project

Diolor · 2025-10-28T17:31:46Z

demos/android/MASVS-CODE/MASTG-DEMO-0061/MastgTest_reversed.java

+            SecureSharedPreferences insecurePrefs = new SecureSharedPreferences(this.context, false);
+            insecurePrefs.saveData("user_role_insecure", "user");
+            SecureSharedPreferences securePrefs = new SecureSharedPreferences(this.context, true);
+            securePrefs.saveData("user_role_secure", "user");


Extracting this file gives quite a different result. Most importantly, the following. Therefore, Semgrep finds no results for me.

Suggested change

SecureSharedPreferences insecurePrefs = new SecureSharedPreferences(this.context, false);

insecurePrefs.saveData("user_role_insecure", "user");

SecureSharedPreferences securePrefs = new SecureSharedPreferences(this.context, true);

securePrefs.saveData("user_role_secure", "user");

saveData("user_role_insecure", "user", false);

saveData("user_role_secure", "user", true);

Diolor · 2025-10-28T17:37:45Z

demos/android/MASVS-CODE/MASTG-DEMO-0061/MastgTest.kt

+            return "INITIAL SETUP COMPLETE.\n\n" +
+                    "The role for both secure and insecure tests has been set to 'user'.\n\n" +
+                    "ACTION REQUIRED:\n" +
+                    "1. Use a file explorer or ADB shell on a rooted device.\n" +
+                    "2. Go to: /data/data/org.owasp.mastestapp/shared_prefs/\n" +
+                    "3. Open the file: app_settings.xml\n" +
+                    "4. Change BOTH <string>user</string> values to <string>admin</string>.\n" +
+                    "5. Save the file and run this test again to see the results."


Well done on he pen-testing example! 👏 I followed the steps but sadly could not "tamper" it.

<?xml version='1.0' encoding='utf-8' standalone='yes' ?> <map> <string name="user_role_secure_hmac">690d026aeeba673e7225ee95a3460a0054752777afec8e4fb7ec8294934011ed</string> <boolean name="setup_complete" value="true" /> <string name="user_role_insecure">admin</string> <string name="user_role_secure">admin</string> </map>

is the file state between the 2 steps

Diolor · 2025-10-28T17:40:31Z

demos/android/MASVS-CODE/MASTG-DEMO-0061/MastgTest.kt

+                results.append(">> OUTCOME: NOT TAMPERED. The role is still '$secureRole', and its HMAC signature is valid.\n")
+            }
+
+            results.append("\n\nTest complete. To run the setup again, please clear the application's data in Android Settings and restart the test.")


fyi restarting the application (thus test) would rewrite the xml. No need for clearing app data

jeel38 and others added 9 commits June 3, 2025 18:18

demo added draft

86aa179

fix grammar

69ebf81

mastgTest file update

8c4060b

updated test file

96a766f

Update tests-beta/android/MASVS-CODE/MASTG-TEST-0281.md

3e1c45a

Co-authored-by: pruDhv! <[email protected]>

updated changes

2a90252

updated changes

d31713c

updated changes done

970f558

updated changes test file

a323683

Merge branch 'master' into MASTG-TEST-0002_draft

16acaa0

added profiles

e1a0099

cpholguera requested a review from Copilot June 10, 2025 08:36

This comment was marked as outdated.

Sign in to view

cpholguera added Android MASVS-CODE MASTG Refactor changes-requested labels Jun 10, 2025

jeel38 and others added 5 commits July 31, 2025 17:45

Updated-Demo

3bb04a9

Updated-Demo-fix

bcaec04

internal-comment-completed

2a4b407

Updated Demo

fce6000

deleted old demo

4ba84d9

cpholguera added changes-done and removed changes-requested labels Aug 12, 2025

cpholguera requested a review from Copilot August 31, 2025 18:29

Copilot AI reviewed Aug 31, 2025

View reviewed changes

Merge branch 'master' into MASTG-TEST-0002_draft

c6b5232

cpholguera requested changes Sep 6, 2025

View reviewed changes

jeel38 added 2 commits September 17, 2025 17:33

updated changes

a855378

updated changes in demo file

f8639f8

cpholguera requested review from Diolor and Copilot October 27, 2025 12:00

Copilot AI reviewed Oct 27, 2025

View reviewed changes

demos/android/MASVS-CODE/MASTG-DEMO-0061/MastgTest.kt Show resolved Hide resolved

Diolor suggested changes Oct 28, 2025

View reviewed changes


		## Steps

		1. Run a static analysis tool such as @MASTG-TOOL-0110 on the code and look for uses of the `putString` and `getString`.


		### Evaluation

		The test fails as the code does not use an `HMAC` integrity check together with `SharedPreferences` data.


		## Overview

		Data stored in Android's `SharedPreference`s can be tampered with on a rooted device. If an application reads this data without verifying its integrity (e.g., with an HMAC signature), it can lead to security vulnerabilities. This test checks if the application properly validates data read from local storage.


		## Evaluation

		The test fails as the application does not verify the integrity of data loaded from `SharedPreferences`. Without an integrity check like `HMAC`, an attacker with root access can directly edit the SharedPreferences XML file, modifying values to grant themselves higher privileges. The app then reads and acts on this tampered data, leading to a critical security failure, like privilege escalation.

	The test fails as the application does not verify the integrity of data loaded from `SharedPreferences`. Without an integrity check like `HMAC`, an attacker with root access can directly edit the SharedPreferences XML file, modifying values to grant themselves higher privileges. The app then reads and acts on this tampered data, leading to a critical security failure, like privilege escalation.
	The test fails if the application does not verify the integrity and authenticity of data loaded from local storage such as `SharedPreferences`.

		@@ -0,0 +1,24 @@
		---
		title: Use of Local Storage for Input Validation

	title: Use of Local Storage for Input Validation
	title: Validation of Local Storage Data

	title: Use of Local Storage for Input Validation
	title: Integrity and Authenticity Validation of Local Storage Data

		@@ -0,0 +1 @@
		NO_COLOR=true semgrep -c ../../../../rules/mastg-android-local-storage-input-validation.yml ./MastgTest_reversed.java --text -o output.txt No newline at end of file

Uh oh!

Port MASTG v1->v2 MASTG-TEST-0002: Testing Local Storage for Input Validation (android) (by @appknox) #3328

Are you sure you want to change the base?

Port MASTG v1->v2 MASTG-TEST-0002: Testing Local Storage for Input Validation (android) (by @appknox) #3328

Uh oh!

Conversation

jeel38 commented Jun 10, 2025 • edited by cpholguera Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jeel38 commented Jun 10, 2025

Uh oh!

cpholguera commented Jun 10, 2025

Uh oh!

cpholguera commented Jun 10, 2025

Uh oh!

This comment was marked as outdated.

Uh oh!

jeel38 commented Jun 10, 2025

Uh oh!

jeel38 commented Jun 10, 2025

Uh oh!

cpholguera commented Jun 10, 2025

Uh oh!

cpholguera commented Jun 10, 2025

Uh oh!

jeel38 commented Aug 11, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Aug 31, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jeel38 commented Sep 17, 2025

Uh oh!

jeel38 commented Oct 7, 2025

Uh oh!

jeel38 commented Oct 27, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Diolor left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

jeel38 commented Jun 10, 2025 •

edited by cpholguera

Loading