Android Security Lints

This repository contains custom lint checks for Android development. These lint checks are by nature more security-focused and experimental than the built-in lint checks within Android Studio, and are intended for more security-conscious developers.

These lint checks are based on guidance from the Android Application Security Knowledge Base that the Android Vulnerability Research team has developed, and common recurring vulnerabilities that the team spots in the wild.

Visit the official Android Lint Github Repo for guidance on writing your own custom lint checks.

This library uses the Apache license, as is Google’s default.

How to use this library

  1. Clone it from GitHub.
  2. Add the checks module to your app’s build.gradle file:

dependencies {
  lintChecks project(':checks')
}

Lint checks included in this library

MASVS-STORAGE

Lint Issue ID Detector Risk
ExposedRootPath MisconfiguredFileProviderDetector Allowing the root directory of the device in the configuration provides arbitrary access to files and folders for attackers
SensitiveExternalPath MisconfiguredFileProviderDetector Sensitive info like PII should not be stored outside of the application container or system credential storage facilities

MASVS-CRYPTO

Lint Issue ID Detector Risk
VulnerableCryptoAlgorithm BadCryptographyUsageDetector Using weak or broken cryptographic hash functions may allow an attacker to reasonably determine the original input
UnsafeCryptoAlgorithmUsage BadCryptographyUsageDetector Using insecure modes and paddings with cryptographic algorithms is unsafe and vulnerable to attacks
WeakPrng WeakPrngDetector Using non-cryptographically secure PRNGs in security contexts like authentication allows attackers to guess the randomly-generated numbers

MASVS-NETWORK

Lint Issue ID Detector Risk
DefaultCleartextTraffic MissingNetworkSecurityConfigDetector On API level 27 and below, the default network security config trusts cleartext traffic and needs to be explicitly opted out by the application to only use secure connections
DefaultTrustedUserCerts MissingNetworkSecurityConfigDetector On API level 23 and below, the default network security config trusts user-added CA certificates. In practice, it is better to limit the set of trusted CAs so only trusted CAs are used for an app’s secure connections

MASVS-PLATFORM

Lint Issue ID Detector Risk
TapjackingVulnerable TapjackingDetector Views without the filterTouchesWhenObscured attribute are susceptible to tapjacking attacks by other apps obscuring the UI to trick the user into performing certain actions
StrandhoggVulnerable StrandhoggDetector Android previously had a bug in task reparenting in earlier versions, allowing malicious applications to hijack legitimate user actions and trick users into providing credentials to malicious apps

MASVS-CODE

Lint Issue ID Detector Risk
UnintendedExposedUrl UnintendedExposedUrlDetector URLs that look intended for debugging and development purposes only are exposed in the application, allowing attackers to gain access to parts of the application and server that should be kept secure
UnintendedPrivateIpAddress UnintendedExposedUrlDetector Private IP addresses are referenced that may have been intended only for debugging and development, and should not be exposed publicly

Contact

For questions, comments or feature requests, please file an issue or start a discussion on Github. We would love to hear from you.

GitHub

View Github