Java: Add query for Sensitive Keyboard Cache by joefarebrother · Pull Request #10684 · github/codeql

joefarebrother · 2022-10-04T16:37:53Z

Query that detects instances of sensitive information that could be saved into the keyboard cache.

Considers cases in which an input field declared is declared via XML with a name that indicates it may contain sensitive information, but its input type, as declared either in XML or in code, indicates that it is saved to the keyboard cache.

github-actions · 2022-10-04T16:38:54Z

QHelp previews:

java/ql/src/Security/CWE/CWE-524/SensitiveKeyboardCache.qhelp

errors/warnings:

./java/ql/src/Security/CWE/CWE-524/SensitiveKeyboardCache.qhelp:1:1: Content is not allowed in prolog.
A fatal error occurred: 1 qhelp files could not be processed.

github-actions · 2022-10-06T09:32:17Z

QHelp previews:

java/ql/src/Security/CWE/CWE-524/SensitiveKeyboardCache.qhelp

errors/warnings:

./java/ql/src/Security/CWE/CWE-524/SensitiveKeyboardCache.qhelp:32:127: element "code" not allowed here; expected the element end-tag or text
./java/ql/src/Security/CWE/CWE-524/SensitiveKeyboardCache.qhelp:33:5: element "li" not allowed here; expected the element end-tag, text or element "a", "b", "blockquote", "code", "em", "i", "img", "ol", "p", "pre", "sample", "strong", "sub", "sup", "table", "tt", "ul" or "warning"
./java/ql/src/Security/CWE/CWE-524/SensitiveKeyboardCache.qhelp:35:3: The element type "li" must be terminated by the matching end-tag "</li>".
A fatal error occurred: 1 qhelp files could not be processed.

github-actions · 2022-10-06T10:27:57Z

QHelp previews:

java/ql/src/Security/CWE/CWE-524/SensitiveKeyboardCache.qhelp

errors/warnings:

./java/ql/src/Security/CWE/CWE-524/SensitiveKeyboardCache.qhelp:32:127: element "code" not allowed here; expected the element end-tag or text
./java/ql/src/Security/CWE/CWE-524/SensitiveKeyboardCache.qhelp:33:5: element "li" not allowed here; expected the element end-tag, text or element "a", "b", "blockquote", "code", "em", "i", "img", "ol", "p", "pre", "sample", "strong", "sub", "sup", "table", "tt", "ul" or "warning"
./java/ql/src/Security/CWE/CWE-524/SensitiveKeyboardCache.qhelp:35:3: The element type "li" must be terminated by the matching end-tag "</li>".
A fatal error occurred: 1 qhelp files could not be processed.

github-actions · 2022-10-07T13:33:49Z

QHelp previews:

java/ql/src/Security/CWE/CWE-524/SensitiveKeyboardCache.qhelp

Android sensitive keyboard cache

When a user enters information in a text input field on an Android application, their input is saved to a keyboard cache which provides autocomplete suggestions and predictions. There is a risk that sensitive user data, such as passwords or banking information, may be leaked to other applications via the keyboard cache.

Recommendation

For input fields expected to accept sensitive information, use input types such as "textNoSuggestions" (or "textPassword" for a password) to ensure the input does not get stored in the keyboard cache.

Optionally, instead of declaring an input type through XML, you can set the input type in your code using TextView.setInputType().

Example

In the following example, the field labeled BAD allows the password to be saved to the keyboard cache, whereas the field labeled GOOD uses the "textPassword" input type to ensure the password is not cached.

<?xml version="1.0" encoding="utf-8"?>
<LinearLayout
    xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:app="http://schemas.android.com/apk/res-auto">

    <!-- BAD: This password field uses the `text` input type, which allows the input to be saved to the keyboard cache. -->
    <EditText
        android:id="@+id/password_bad"
        android:inputType="text"/> 

    <!-- GOOD: This password field uses the `textPassword` input type, which ensures that the input is not saved to the keyboard cache. -->
    <EditText
        android:id="@+id/password_good"
        android:inputType="textPassword"/>  
</LinearLayout>

References

OWASP Mobile Application Security Testing Guide: Determining Whether the Keyboard Cache Is Disabled for Text Input Fields.
Android Developers: android:inputType attribute documentation.
Common Weakness Enumeration: CWE-524.

atorralba

This mostly looks good, I added some minor comments.

Other than that, have you considered that the input type could be added programmatically via setInputType? I'm curious about how many alerts raised by this query could be discarded because of this. If there are enough, it could might sense to handle it as well.

WDYT?

atorralba

Hey @joefarebrother thanks for working on this, I think it'll be a valuable addition. I added some more minor comments and a conceptual question, but otherwise this LGTM. If DCA and MRVA look good, we should ask for a docs review.

sabrowning1

👋🏼 @joefarebrother, thanks for your work on this! I've suggested a few small changes to the .qhelp file to align with our style guide. Let me know if you have any questions!

Co-authored-by: Sam Browning <106113886+sabrowning1@users.noreply.github.com>

sabrowning1

Looks good for Docs, thanks @joefarebrother! 👍🏼

atorralba

🎉

github-actions Bot added documentation Java labels Oct 4, 2022

github-advanced-security AI found potential problems Oct 4, 2022

View reviewed changes

Comment thread java/ql/src/Security/CWE/CWE-524/SensitiveKeyboardCache.ql Fixed

Comment thread java/ql/lib/semmle/code/java/security/SensitiveKeyboardCacheQuery.qll Fixed

intrigus-lgtm reviewed Oct 5, 2022

View reviewed changes

Comment thread java/ql/lib/semmle/code/java/security/SensitiveKeyboardCacheQuery.qll Outdated

Marcono1234 reviewed Oct 5, 2022

View reviewed changes

github-advanced-security AI found potential problems Oct 6, 2022

View reviewed changes

Comment thread java/ql/src/Security/CWE/CWE-524/SensitiveKeyboardCache.ql Fixed

joefarebrother marked this pull request as ready for review October 7, 2022 13:33

joefarebrother requested a review from a team as a code owner October 7, 2022 13:33

atorralba reviewed Oct 11, 2022

View reviewed changes

joefarebrother force-pushed the android-keyboard-cache branch from 027a93b to 63bdd32 Compare October 13, 2022 13:04

github-advanced-security AI found potential problems Oct 31, 2022

View reviewed changes

Comment thread java/ql/lib/semmle/code/java/security/SensitiveKeyboardCacheQuery.qll Fixed

joefarebrother requested a review from atorralba November 7, 2022 17:19

atorralba reviewed Nov 8, 2022

View reviewed changes

joefarebrother force-pushed the android-keyboard-cache branch 3 times, most recently from b8e0779 to 3242bbb Compare November 8, 2022 15:07

joefarebrother added the ready-for-doc-review This PR requires and is ready for review from the GitHub docs team. label Nov 9, 2022

sabrowning1 reviewed Nov 15, 2022

View reviewed changes

Comment thread java/ql/src/Security/CWE/CWE-524/SensitiveKeyboardCache.ql Outdated

joefarebrother added 7 commits November 16, 2022 10:54

Add sensitive keyboard cache query

85fe226

Add test cases; fix the regex used

706858e

Add docs

92190e5

Remove redundant import

0bce189

Fix typos

c085c1f

Add security severity

775a550

Add change note

b421676

joefarebrother and others added 10 commits November 16, 2022 10:54

Fix qldoc

e6dd367

Apply review suggestions

f48b57c

More precise layout xml handling

359d703

Cover cases in which input type is set via code

10a3b3b

Add tests and fix issues

dd4e1d0

fix implicit this

63f715e

Apply code review suggestions

6d465aa

Invert the xml logic to be consistent with the dataflow logic

7ae41ff

Apply suggestions from docs review

255123c

Co-authored-by: Sam Browning <106113886+sabrowning1@users.noreply.github.com>

Apply suggestion from docs review

cc96037

Co-authored-by: Sam Browning <106113886+sabrowning1@users.noreply.github.com>

joefarebrother force-pushed the android-keyboard-cache branch from eae981f to cc96037 Compare November 16, 2022 10:54

sabrowning1 approved these changes Nov 16, 2022

View reviewed changes

atorralba approved these changes Nov 16, 2022

View reviewed changes

joefarebrother merged commit d6c5132 into github:main Nov 16, 2022

Conversation

joefarebrother commented Oct 4, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 4, 2022

errors/warnings:

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Oct 6, 2022

errors/warnings:

Uh oh!

Uh oh!

github-actions Bot commented Oct 6, 2022

errors/warnings:

Uh oh!

github-actions Bot commented Oct 7, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Android sensitive keyboard cache

Recommendation

Example

References

Uh oh!

atorralba left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

atorralba left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sabrowning1 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sabrowning1 left a comment

Choose a reason for hiding this comment

Uh oh!

atorralba left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

joefarebrother commented Oct 4, 2022 •

edited

Loading

github-actions Bot commented Oct 7, 2022 •

edited

Loading