Overview

This test verifies that the app correctly handles notifications, ensuring that sensitive information, such as personally identifiable information (PII), one-time passwords (OTPs), or other sensitive data, like health or financial details, is not exposed.

On Android 13 and higher, apps targeting API level 33 or above must request the runtime permission POST_NOTIFICATIONS to send notifications. Below API level 33, this permission is not required. For testing purposes, we consider the value of the app's minSdkVersion because it indicates the lowest Android version on which the app can run.

Notifications can be created using the setContentTitle) and setContentText) methods of Notification.Builder or NotificationCompat.Builder.

Notification usage should not expose sensitive information that could be disclosed accidentally, e.g., through shoulder surfing or when sharing the device with another person.

Steps

  1. Use MASTG-TECH-0013 to reverse engineer the app.
  2. Use MASTG-TECH-0014 to look for the relevant APIs.
  3. Use MASTG-TECH-0117 to obtain the AndroidManifest.xml.
  4. Use MASTG-TECH-0150 to obtain the minSdkVersion from the AndroidManifest.xml file.
  5. Use MASTG-TECH-0126 to obtain the relevant permissions.

Observation

The output should contain:

Evaluation

The test case fails if the app exposes any sensitive data in any notifications and either:

Why minSdkVersion and not targetSdkVersion?: Using minSdkVersion ensures the test accounts for the least secure environment in which the app can operate, which is what determines the real exposure risk.

targetSdkVersion only influences how the app behaves on newer Android versions and how the system enforces newer platform restrictions. It does not change the behavior of older Android versions. As a result, an app with a high targetSdkVersion but a low minSdkVersion must still be evaluated against the security guarantees, or lack thereof, of those older versions.