rspec/rules/S6358/xml/rule.adoc
Egon Okerman d1417e82f8
Modify CWE and OWASP Top 10 links to follow standard link format (APPSEC-1134) (#3529)
* Fix all CWE references

* Fix all OWASP references

* Fix missing CWE prefixes
2024-01-15 17:15:56 +01:00

94 lines
3.8 KiB
Plaintext

Android has a built-in backup mechanism that can save and restore application
data. When application backup is enabled, local data from your application can
be exported to Google Cloud or to an external device via ``++adb backup++``.
Enabling Android backup exposes your application to disclosure of sensitive
data. It can also lead to corruption of local data when restoration is performed
from an untrusted source.
By default application backup is enabled and it includes:
* Shared preferences files
* Files saved in one of the paths returned by
** https://developer.android.com/reference/android/content/Context#getDatabasePath(java.lang.String)[getDatabasePath(String)]
** https://developer.android.com/reference/android/content/Context#getFilesDir()[getFilesDir()]
** https://developer.android.com/reference/android/content/Context#getDir(java.lang.String,%20int)[getDir(String, int)]
** https://developer.android.com/reference/android/content/Context#getExternalFilesDir(java.lang.String)[getExternalFilesDir(String)]
== Ask Yourself Whether
* Application backup is enabled and sensitive data is stored in local files, local databases, or shared preferences.
* Your application never validates data from files that are included in backups.
There is a risk if you answered yes to any of those questions.
== Recommended Secure Coding Practices
* Disable application backup unless it is required for your application to work properly.
* Narrow the scope of backed-up files by using either
** backup rules (see ``++android:fullBackupContent++`` attribute).
** a custom ``++BackupAgent++``.
** the dedicated `no_backup` folder (see ``++android.content.Context#getNoBackupFilesDir()++``).
* Do not back up local data containing sensitive information unless they are properly encrypted.
* Make sure that the keys used to encrypt backup data are not included in the backup.
* Validate data from backed-up files. They should be considered untrusted as they could have been restored from an untrusted source.
== Sensitive Code Example
[source,xml]
----
<application
android:allowBackup="true"> <!-- Sensitive -->
</application>
----
== Compliant Solution
Disable application backup.
[source,xml]
----
<application
android:allowBackup="false">
</application>
----
If targeting Android 6.0 or above (API level 23), define files to include/exclude from the application backup.
[source,xml]
----
<application
android:allowBackup="true"
android:fullBackupContent="@xml/backup.xml">
</application>
----
== See
* OWASP - https://owasp.org/Top10/A01_2021-Broken_Access_Control/[Top 10 2021 Category A1 - Broken Access Control]
* https://developer.android.com/guide/topics/data/autobackup[Back up user data with Auto Backup]
* OWASP - https://mobile-security.gitbook.io/masvs/security-requirements/0x07-v2-data_storage_and_privacy_requirements[Mobile AppSec Verification Standard - Data Storage and Privacy Requirements]
* OWASP - https://owasp.org/www-project-mobile-top-10/2016-risks/m1-improper-platform-usage[Mobile Top 10 2016 Category M1 - Improper platform usage]
* OWASP - https://owasp.org/www-project-mobile-top-10/2016-risks/m2-insecure-data-storage[Mobile Top 10 2016 Category M2 - Insecure Data Storage]
* OWASP - https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[Top 10 2017 Category A3 - Sensitive Data Exposure]
* OWASP - https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration[Top 10 2017 Category A6 - Security Misconfiguration]
* CWE - https://cwe.mitre.org/data/definitions/312[CWE-922 - Insecure Storage of Sensitive Information]
ifdef::env-github,rspecator-view[]
== Implementation Specification
(visible only on this page)
=== Message
Make sure backup of application data is safe here.
=== Highlighting
The opening <application> tag
endif::env-github,rspecator-view[]