rspec/rules/S4507/xml/rule.adoc

Development tools and frameworks usually have options to make debugging easier for developers. Although these features are useful during development, they should never be enabled for applications deployed in production.

In the application manifest element of an android application, setting ``https://developer.android.com/guide/topics/manifest/application-element#debug[android:debuggable]`` property to ``++"true"++`` makes the application debuggable.


This introduces a security risk as it makes it easy for an attacker to reverse engineer the application and eventually steal the user's secrets.

== Ask Yourself Whether

* The development of the app is completed and the ``++debuggable++`` property is set to _true_
* The app is distributed to end users with the ``++debuggable++`` property set to _true_

There is a risk if you answered yes to any of those questions.

== Recommended Secure Coding Practices

It is not recommended to release debuggable application. Avoid hardcoding the debug mode in the manifest because the build tool will add the property automatically and assign the correct value depending on the build type.

== Sensitive Code Example

In ``++AndroidManifest.xml++`` the android debuggable property is set to ``++true++``:

[source,xml]
----
<application
  android:icon="@mipmap/ic_launcher"
  android:label="@string/app_name"
  android:roundIcon="@mipmap/ic_launcher_round"
  android:supportsRtl="true"
  android:debuggable="true"
  android:theme="@style/AppTheme">
</application>  <!-- Sensitive --> 
----

== Compliant Solution

In ``++AndroidManifest.xml++`` the android debuggable property is set to ``++false++``:

[source,xml]
----
<application
  android:icon="@mipmap/ic_launcher"
  android:label="@string/app_name"
  android:roundIcon="@mipmap/ic_launcher_round"
  android:supportsRtl="true"
  android:debuggable="false"
  android:theme="@style/AppTheme">
</application> <!-- Compliant --> 
----

== See

* https://owasp.org/Top10/A05_2021-Security_Misconfiguration/[OWASP Top 10 2021 Category A5] - Security Misconfiguration
* https://mobile-security.gitbook.io/masvs/security-requirements/0x12-v7-code_quality_and_build_setting_requirements[Mobile AppSec Verification Standard] - Code Quality and Build Setting Requirements
* https://owasp.org/www-project-mobile-top-10/2016-risks/m10-extraneous-functionality[OWASP Mobile Top 10 2016 Category M10] - Extraneous Functionality
* https://cwe.mitre.org/data/definitions/215[MITRE, CWE-215] - Information Exposure Through Debug Information
* https://developer.android.com/studio/publish/preparing[developer.android.com] - Prepare for release

ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

include::../message.adoc[]

'''
== Comments And Links
(visible only on this page)

include::../comments-and-links.adoc[]
endif::env-github,rspecator-view[]