Port MASTG-TEST-0036: Testing Enforced Updating (android) (by @appknox) #3462

sk3l10x1ng · 2025-09-18T12:14:23Z

This PR closes #2994

This reverts commit d11e628.

sk3l10x1ng · 2025-09-19T07:27:07Z

@cpholguera The build works fine on my device, the application utilizes the dependency implementation("com.google.android.play:app-update-ktx:2.1.0") to check for enforced updates. This could be the reason the build fails.

cpholguera · 2025-09-19T07:34:02Z

Thanks for letting me know. I think we'll need to add support for demos to "add dependencies" when needed. That'd solve the issue.

Diolor

Thanks a lot for the migration and for putting this together! I’ve added some comments that might help bring it closer to the guidelines.

One thing I noticed is that the original test (0036) might have been interpreted a bit differently — the current content + Demo don’t quite reflect the real production issue. It could help to re-read the original description for the nuance. I also tried to rephrase the issue here for clarity: https://github.com/OWASP/mastg/pull/3462/files#r2367330215

And just a small tip: if you’re using co-pilot (like in 0290.md), it often works best to first describe the issue in your own words, and then let the LLM refine it. That way the text stays closer to the intent.

Overall though, really nice progress — it’s clear you put effort into this!

tests/android/MASVS-CODE/MASTG-TEST-0036.md

tests-beta/android/MASVS-CODE/MASTG-TEST-0290.md

demos/android/MASVS-CODE/MASTG-DEMO-0x36/output.txt

demos/android/MASVS-CODE/MASTG-DEMO-0x36/MASTG-DEMO-0x36.md

demos/android/MASVS-CODE/MASTG-DEMO-0062/MASTG-DEMO-0062.md

demos/android/MASVS-CODE/MASTG-DEMO-0x36/MASTG-DEMO-0x36.md

cpholguera · 2025-09-23T06:55:33Z

@cpholguera The build works fine on my device, the application utilizes the dependency implementation("com.google.android.play:app-update-ktx:2.1.0") to check for enforced updates. This could be the reason the build fails.

@sk3l10x1ng you can now add this dependency like this:

https://github.com/OWASP/mastg/pull/3410/files#diff-d43bc4152a13d082c2a8c2d4b1d2416a0a9a5290a669827f6aaff626f96430f2

Simply add a /MASTG-DEMO-xxxx/build.gradle.kts.libs

tests-beta/android/MASVS-CODE/MASTG-TEST-0x36.md

demos/android/MASVS-CODE/MASTG-DEMO-0x36/MastgTest.kt

demos/android/MASVS-CODE/MASTG-DEMO-0x36/MainActivity.kt

tests-beta/android/MASVS-CODE/MASTG-TEST-0x36.md

demos/android/MASVS-CODE/MASTG-DEMO-0x36/MastgTest.kt

sk3l10x1ng · 2025-10-10T10:34:39Z

@cpholguera updated the changes, please check

Copilot

Pull Request Overview

This PR ports the Android enforced updating test (MASTG-TEST-0036) to the new MASTG V2 format, deprecating the original test in favor of MASTG-TEST-0x36. The update includes a new test methodology focusing on detecting Google Play Core's immediate in-app update enforcement using static analysis.

Key Changes:

Deprecated the original MASTG-TEST-0036 and created a new V2 version (MASTG-TEST-0x36)
Added a Semgrep rule to detect usage of startUpdateFlowForResult with immediate update configuration
Included comprehensive demo code showing both Kotlin source and reversed Java implementation

Reviewed Changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 6 comments.

File	Description
tests/android/MASVS-CODE/MASTG-TEST-0036.md	Marked original test as deprecated with reference to new version
tests-beta/android/MASVS-CODE/MASTG-TEST-0x36.md	New V2 test definition focusing on Play Core API detection
rules/mastg-android-enforced-updating.yml	Semgrep rule for detecting immediate update enforcement
demos/android/MASVS-CODE/MASTG-DEMO-0x36/*	Demo implementation with Kotlin source, reversed Java, and expected output

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

demos/android/MASVS-CODE/MASTG-DEMO-0x36/MASTG-DEMO-0x36.md

Copilot · 2025-10-27T12:32:24Z

demos/android/MASVS-CODE/MASTG-DEMO-0x36/MainActivity.kt

+        super.onCreate(savedInstanceState)
+        enableEdgeToEdge()
+
+        // mastgTest = MastgTest(applicationContext)


Remove commented-out code. The initialization is already handled by the lazy delegate on line 26.

Suggested change

// mastgTest = MastgTest(applicationContext)

Copilot · 2025-10-27T12:32:24Z

demos/android/MASVS-CODE/MASTG-DEMO-0x36/MainActivity.kt

+                // The unused 'this' parameter is now removed.
+                mastgTest.checkForUpdate(appUpdateResultLauncher)


Remove obsolete comment referring to a removed parameter. The comment no longer provides relevant context.

Copilot · 2025-10-27T12:32:25Z

demos/android/MASVS-CODE/MASTG-DEMO-0x36/MainActivity.kt

+                    // The unused 'this' parameter is now removed.
+                    mastgTest.checkForUpdate(appUpdateResultLauncher)


Remove obsolete comment referring to a removed parameter. The comment no longer provides relevant context.

Copilot · 2025-10-27T12:32:25Z

demos/android/MASVS-CODE/MASTG-DEMO-0x36/MainActivity.kt

+        // The unused 'this' parameter is now removed.
+        mastgTest.checkForUpdate(appUpdateResultLauncher)


Remove obsolete comment referring to a removed parameter. The comment no longer provides relevant context.

Copilot · 2025-10-27T12:32:25Z

demos/android/MASVS-CODE/MASTG-DEMO-0x36/MainActivity.kt

+        // if (::mastgTest.isInitialized) {
+            // The unused 'this' parameter is now removed.
+            mastgTest.resumeUpdateIfInProgress(appUpdateResultLauncher)


Remove commented-out initialization check and obsolete parameter comment. Since mastgTest is initialized by lazy delegation, the check is unnecessary.

Diolor · 2025-10-28T11:08:02Z

demos/android/MASVS-CODE/MASTG-DEMO-0x36/run.sh

@@ -0,0 +1 @@
+NO_COLOR=true semgrep -c ../../../../rules/mastg-android-enforced-updating.yml ./MastgTest_reversed.java --text -o output.txt


Suggested change

NO_COLOR=true semgrep -c ../../../../rules/mastg-android-enforced-updating.yml ./MastgTest_reversed.java --text -o output.txt

NO_COLOR=true semgrep -c ../../../../rules/mastg-android-enforced-updating.yml ./MastgTest_reversed.java > output.txt

Diolor · 2025-10-28T11:47:43Z

tests-beta/android/MASVS-CODE/MASTG-TEST-0x36.md

+
+## Overview
+
+The goal of this test is to verify whether the application enforces updates in a way that blocks usage until the latest version is installed. This is typically achieved using the [Google Play Core In-App Update API](https://developer.android.com/guide/playcore/in-app-updates/kotlin-java) by invoking `startUpdateFlowForResult` with an Immediate update type option `AppUpdateType.IMMEDIATE` or value `1`. This configuration initiates a non-cancellable, blocking update flow. The test should involve launching the app when an update is available and verifying that access to the app's functionality remains restricted until the update has been successfully downloaded and installed.


Suggested change

The goal of this test is to verify whether the application enforces updates in a way that blocks usage until the latest version is installed. This is typically achieved using the [Google Play Core In-App Update API](https://developer.android.com/guide/playcore/in-app-updates/kotlin-java) by invoking `startUpdateFlowForResult` with an Immediate update type option `AppUpdateType.IMMEDIATE` or value `1`. This configuration initiates a non-cancellable, blocking update flow. The test should involve launching the app when an update is available and verifying that access to the app's functionality remains restricted until the update has been successfully downloaded and installed.

The goal of this test is to verify whether the application enforces mandatory updates, preventing users from accessing the app until the latest version has been successfully downloaded and installed. A mandatory update can typically be achieved by using the [Google Play Core In-App Update API](https://developer.android.com/guide/playcore/in-app-updates/kotlin-java) and invoking `startUpdateFlowForResult` with an Immediate update type option `AppUpdateType.IMMEDIATE` or value `1`.

I couldn't find anywhere in Android docs that "this configuration initiates a non-cancellable, blocking update flow"

Reading https://developer.android.com/guide/playcore/in-app-updates#immediate I see that there is an X button when an immediate update is available, indicating that the user can refuse an immediate update, meaning that any blocking functionality is to the developer's discretion.

Diolor · 2025-10-28T11:48:47Z

tests-beta/android/MASVS-CODE/MASTG-TEST-0x36.md

+
+## Steps
+
+1. Run a static analysis tool such as @MASTG-TOOL-0110 on codebase for usages of the calls to the Play Core in-app update API, specifically `startUpdateFlowForResult`, that are configured with the integer value `1`.


Suggested change

1. Run a static analysis tool such as @MASTG-TOOL-0110 on codebase for usages of the calls to the Play Core in-app update API, specifically `startUpdateFlowForResult`, that are configured with the integer value `1`.

1. Run a static analysis tool such as @MASTG-TOOL-0110 on codebase for usages of the calls to the Play Core in-app update API, specifically `startUpdateFlowForResult`, that are configured with the integer value `1` (`AppUpdateType.IMMEDIATE`).

tests-beta/android/MASVS-CODE/MASTG-TEST-0290.md

Diolor · 2025-10-28T14:19:34Z

tests-beta/android/MASVS-CODE/MASTG-TEST-0x36.md

+
+## Evaluation
+
+The test fails if the app does not enforce updates and still allows users to skip or ignore them.


Could you please indicate what should look for in the code based on the above observation in order to evaluate this?

demos/android/MASVS-CODE/MASTG-DEMO-0x36/MainActivity.kt

sk3l10x1ng added 9 commits August 14, 2025 15:54

deprecated_notes

2bb57d9

added test-beta

07109c2

added Demo

d11e628

updated test-beta

a9708b1

Revert "added Demo"

d79bb96

This reverts commit d11e628.

fix demo files

46700ae

fix test-beta & demo.md

b42de04

fix lint

a9d792a

fix spell & add rule

8e29eb0

sk3l10x1ng changed the title ~~Port MASTG-TEST-0036: MASTG v1->v2 MASTG-TEST-0036: Testing Enforced Updating (android)~~ Port MASTG-TEST-0036: MASTG v1->v2 MASTG-TEST-0036: Testing Enforced Updating (android) (@appknox) Sep 19, 2025

fixe DEMO-0062.md

0673135

sk3l10x1ng closed this Sep 19, 2025

sk3l10x1ng reopened this Sep 19, 2025

sk3l10x1ng changed the title ~~Port MASTG-TEST-0036: MASTG v1->v2 MASTG-TEST-0036: Testing Enforced Updating (android) (@appknox)~~ Port MASTG-TEST-0036: MASTG-TEST-0036: Testing Enforced Updating (android) (@appknox) Sep 19, 2025

sk3l10x1ng changed the title ~~Port MASTG-TEST-0036: MASTG-TEST-0036: Testing Enforced Updating (android) (@appknox)~~ MASTG-TEST-0036: Testing Enforced Updating (android) (@appknox) Sep 19, 2025

sk3l10x1ng changed the title ~~MASTG-TEST-0036: Testing Enforced Updating (android) (@appknox)~~ MASTG-TEST-0036: Testing Enforced Updating (android) (by @appknox) Sep 19, 2025

sk3l10x1ng changed the title ~~MASTG-TEST-0036: Testing Enforced Updating (android) (by @appknox)~~ Port MASTG-TEST-0036: Testing Enforced Updating (android) (by @appknox) Sep 19, 2025

fix MainActivity.kt

486b13d

cpholguera requested a review from Diolor September 22, 2025 08:23

Diolor suggested changes Sep 22, 2025

View reviewed changes

cpholguera and others added 6 commits September 23, 2025 08:55

Merge branch 'master' into port_mastg_test_0036

428c988

MASTG-DEMO-0062.md

ebf4d1c

updated file id's

753f2ef

added build.gradle.kts.libs file

1173e1b

updated MASTG-TEST-0x36

14961c2

updated changes

831a08d

Diolor reviewed Oct 6, 2025

View reviewed changes

sk3l10x1ng and others added 3 commits October 7, 2025 17:40

updated demo files

d42e1d9

markdown_lint fix

fb39bc4

updated MainActivity.kt

29666ed

cpholguera requested review from Diolor and Copilot October 27, 2025 12:01

Copilot AI reviewed Oct 27, 2025

View reviewed changes

Diolor suggested changes Oct 28, 2025

View reviewed changes

		// The unused 'this' parameter is now removed.
		mastgTest.checkForUpdate(appUpdateResultLauncher)

		@@ -0,0 +1 @@
		NO_COLOR=true semgrep -c ../../../../rules/mastg-android-enforced-updating.yml ./MastgTest_reversed.java --text -o output.txt No newline at end of file


		## Overview

		The goal of this test is to verify whether the application enforces updates in a way that blocks usage until the latest version is installed. This is typically achieved using the [Google Play Core In-App Update API](https://developer.android.com/guide/playcore/in-app-updates/kotlin-java) by invoking `startUpdateFlowForResult` with an Immediate update type option `AppUpdateType.IMMEDIATE` or value `1`. This configuration initiates a non-cancellable, blocking update flow. The test should involve launching the app when an update is available and verifying that access to the app's functionality remains restricted until the update has been successfully downloaded and installed.


		## Steps

		1. Run a static analysis tool such as @MASTG-TOOL-0110 on codebase for usages of the calls to the Play Core in-app update API, specifically `startUpdateFlowForResult`, that are configured with the integer value `1`.


		## Evaluation

		The test fails if the app does not enforce updates and still allows users to skip or ignore them.

Uh oh!

Uh oh!

Port MASTG-TEST-0036: Testing Enforced Updating (android) (by @appknox) #3462

Are you sure you want to change the base?

Port MASTG-TEST-0036: Testing Enforced Updating (android) (by @appknox) #3462

Uh oh!

Conversation

sk3l10x1ng commented Sep 18, 2025 • edited by cpholguera Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sk3l10x1ng commented Sep 19, 2025

Uh oh!

cpholguera commented Sep 19, 2025

Uh oh!

Diolor left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cpholguera commented Sep 23, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sk3l10x1ng commented Oct 10, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Copilot AI Oct 27, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 27, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 27, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 27, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 27, 2025

Choose a reason for hiding this comment

Uh oh!

Diolor Oct 28, 2025

Choose a reason for hiding this comment

Uh oh!

Diolor Oct 28, 2025

Choose a reason for hiding this comment

Uh oh!

Diolor Oct 28, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Diolor Oct 28, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

sk3l10x1ng commented Sep 18, 2025 •

edited by cpholguera

Loading

Diolor left a comment •

edited

Loading