rspec/rules/S6358/description.adoc

12 lines
1023 B
Plaintext

Android has a built-in backup mechanism that can save and restore application data.
When application backup is enabled, local data from your application can be exported to Google Cloud or to an external device via ``++adb backup++``.
Enabling Android backup exposes your application to disclosure of sensitive data. It can also lead to corruption of local data when restore is performed from an untrusted source.
By default application backup is enabled and it includes:
* Shared preferences files
* Files saved in one of the paths returned by
** https://developer.android.com/reference/android/content/Context#getDatabasePath(java.lang.String)[getDatabasePath(String)]
** https://developer.android.com/reference/android/content/Context#getFilesDir()[getFilesDir()]
** https://developer.android.com/reference/android/content/Context#getDir(java.lang.String,%20int)[getDir(String, int)]
** https://developer.android.com/reference/android/content/Context#getExternalFilesDir(java.lang.String)[getExternalFilesDir(String)]