Overview

Apps register custom URL schemes by declaring an <intent-filter> in the AndroidManifest.xml with an <action android:name="android.intent.action.VIEW">, the android.intent.category.BROWSABLE category, and a <data> element whose android:scheme is a custom (non-http/https) value. The handling activity then reads the incoming URI — typically via getIntent() and Intent.getData() (or onNewIntent()) — and extracts parameters with methods such as Uri.getQueryParameter(), Uri.getPathSegments(), or Uri.getLastPathSegment().

Apps must validate and sanitize these URL parameters before using them in security-sensitive operations (see MASTG-KNOW-0019). Since any app on the device can send an Intent targeting a custom URL scheme, an attacker can supply arbitrary parameter values, bypassing the expected business logic constraints. For example:

Unlike iOS, Android provides no mechanism to identify which app sent the Intent. There is no equivalent to iOS's sourceApplication property, so the handler cannot verify the caller's identity, and every custom URL scheme handler is effectively reachable by any app on the device.

This test checks whether the app's custom URL scheme handler validates URL parameters before acting on them.

Steps

  1. Use MASTG-TECH-0013 to reverse engineer the app.
  2. Use MASTG-TECH-0014 to look for the relevant APIs.

Observation

The output should contain the custom URL scheme declarations in the manifest and the handler code locations where the incoming URI is read and its parameters are extracted.

Evaluation

The test case fails if a custom URL scheme handler uses URL parameter values without performing adequate validation before acting on them.

To complement this static analysis, you can use MASTG-TECH-0173 to observe at runtime which handler method receives the deep link and which parameters it reads.

Further Validation Required:

Inspect each reported handler using MASTG-TECH-0023, looking for cases such as:

Note

If the app intentionally accepts arbitrary parameter values (for example, a search scheme that passes user-typed text to a search UI), input validation may not be required and this test may not apply.

Lingitud teemad

Lingid
is related to MASTG-BEST-0071 Validate Input Parameters in Deep Link and Custom URL Scheme Handlers (Android)