+MASVS-PLATFORM Platform Interaction
---+MASTG-TEST-0250 References to Content Provider Access in WebViews (Android)
---+MASTG-TEST-0251 Runtime Use of Content Provider Access APIs in WebViews (Android)
---+MASTG-TEST-0252 References to Local File Access in WebViews (Android)
---+MASTG-TEST-0253 Runtime Use of Local File Access APIs in WebViews (Android)
---+MASTG-TEST-0258 References to Keyboard Caching Attributes in UI Elements (Android)
---+MASTG-TEST-0276 Use of the iOS General Pasteboard (iOS)
---+MASTG-TEST-0277 Sensitive Data in the iOS General Pasteboard at Runtime (iOS)
---+MASTG-TEST-0278 Pasteboard Contents Not Cleared After Use (iOS)
---+MASTG-TEST-0279 Pasteboard Contents Not Expiring (iOS)
---+MASTG-TEST-0280 Pasteboard Contents Not Restricted to Local Device (iOS)
---+MASTG-TEST-0289 Runtime Verification of Sensitive Content Exposure in Screenshots During App Backgrounding (Android)
---+MASTG-TEST-0290 Runtime Verification of Sensitive Content Exposure in Screenshots During App Backgrounding (iOS)
---+MASTG-TEST-0291 References to Screen Capturing Prevention APIs (Android)
---+MASTG-TEST-0315 Sensitive Data Exposed via Notifications (Android)
---+MASTG-TEST-0316 App Exposing User Authentication Data in Text Input Fields (Android)
---+MASTG-TEST-0320 WebViews Not Cleaning Up Sensitive Data (Android)
---+MASTG-TEST-0332 Attacker-Controlled URI in WebViews (iOS)
---+MASTG-TEST-0333 Overly Broad File Read Access in WebViews (iOS)
---+MASTG-TEST-0334 Native Code Exposed Through WebViews (Android)
---+MASTG-TEST-0335 WebView File Origin Access Relaxed by Configuration (iOS)
---+MASTG-TEST-0336 Runtime Setting of Relaxed WebView File Origin Policies (iOS)
---+MASTG-TEST-0340 References to Overlay Attack Protections (Android)
---+MASTG-TEST-0346 References to APIs Hiding Sensitive Data in Text Input Fields (iOS)
---+MASTG-TEST-0347 Runtime Use of APIs Hiding Sensitive Data in Text Input Fields (iOS)
---+MASTG-TEST-0355 References to Unauthorized Database Access through Content Providers (Android)
---+MASTG-TEST-0356 Runtime Verification of Unauthorized Database Access through Content Providers (Android)
---+MASTG-TEST-0357 References to Oversharing of File-Based Content Providers (Android)
---+MASTG-TEST-0364 Exported And Unprotected Activities That Expose Sensitive Functionality (Android)
---+MASTG-TEST-0365 Exported And Unprotected Services That Expose Sensitive Functionality (Android)
---+MASTG-TEST-0366 Exported And Unprotected Broadcast Receivers That Expose Sensitive Functionality (Android)
---+MASTG-TEST-0370 Missing Input Validation in Custom URL Scheme Handlers (iOS)
---+MASTG-TEST-0371 Missing Source Validation in Custom URL Scheme Handlers (iOS)
---+MASTG-TEST-0376 References to Native Bridge APIs in WebViews (iOS)
---+MASTG-TEST-0377 References to `evaluateJavaScript` Used as Bridge Reply in `WKScriptMessageHandler` (iOS)
---+MASTG-TEST-0378 References to Password Fields in WebView-Loaded HTML (iOS)
---+MASTG-TEST-0379 References to `evaluateJavaScript` Without Content World Isolation (iOS)
---+MASTG-TEST-0380 References to `evaluateJavaScript` Writing Sensitive Data into WebView DOM (iOS)
---+MASTG-TEST-0381 References to Insecure PendingIntent Creation (Android)
---+MASTG-TEST-0389 References to the App-Wide Restriction of Custom Keyboards (iOS)
---+MASTG-TEST-0390 Full Access Requested by a Custom Keyboard Extension (iOS)
---+MASTG-TEST-0393 Use of Unverified App Links (Android)
---+MASTG-TEST-0394 Missing Input Validation in Custom URL Scheme Handlers (Android)
---+MASTG-TEST-0395 Missing Input Validation in Universal Link Handlers (iOS)

MASVS-PLATFORM Platform Interaction

Tests for the MASVS group MASVS-PLATFORM.

1. Panoramica

Titolo Standard

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti
Fonte Requisito

3. Regolamentazioni correlate

Regolamentazioni
Fonte Regolamentazione

Ticket collegati

Collegamenti
Tipo di collegamento Ticket
includes MASTG-TEST-0250 References to Content Provider Access in WebViews (Android)
includes MASTG-TEST-0251 Runtime Use of Content Provider Access APIs in WebViews (Android)
includes MASTG-TEST-0252 References to Local File Access in WebViews (Android)
includes MASTG-TEST-0253 Runtime Use of Local File Access APIs in WebViews (Android)
includes MASTG-TEST-0258 References to Keyboard Caching Attributes in UI Elements (Android)
includes MASTG-TEST-0276 Use of the iOS General Pasteboard (iOS)
includes MASTG-TEST-0277 Sensitive Data in the iOS General Pasteboard at Runtime (iOS)
includes MASTG-TEST-0278 Pasteboard Contents Not Cleared After Use (iOS)
includes MASTG-TEST-0279 Pasteboard Contents Not Expiring (iOS)
includes MASTG-TEST-0280 Pasteboard Contents Not Restricted to Local Device (iOS)
includes MASTG-TEST-0289 Runtime Verification of Sensitive Content Exposure in Screenshots During App Backgrounding (Android)
includes MASTG-TEST-0290 Runtime Verification of Sensitive Content Exposure in Screenshots During App Backgrounding (iOS)
includes MASTG-TEST-0291 References to Screen Capturing Prevention APIs (Android)
includes MASTG-TEST-0315 Sensitive Data Exposed via Notifications (Android)
includes MASTG-TEST-0316 App Exposing User Authentication Data in Text Input Fields (Android)
includes MASTG-TEST-0320 WebViews Not Cleaning Up Sensitive Data (Android)
includes MASTG-TEST-0332 Attacker-Controlled URI in WebViews (iOS)
includes MASTG-TEST-0333 Overly Broad File Read Access in WebViews (iOS)
includes MASTG-TEST-0334 Native Code Exposed Through WebViews (Android)
includes MASTG-TEST-0335 WebView File Origin Access Relaxed by Configuration (iOS)
includes MASTG-TEST-0336 Runtime Setting of Relaxed WebView File Origin Policies (iOS)
includes MASTG-TEST-0340 References to Overlay Attack Protections (Android)
includes MASTG-TEST-0346 References to APIs Hiding Sensitive Data in Text Input Fields (iOS)
includes MASTG-TEST-0347 Runtime Use of APIs Hiding Sensitive Data in Text Input Fields (iOS)
includes MASTG-TEST-0355 References to Unauthorized Database Access through Content Providers (Android)
includes MASTG-TEST-0356 Runtime Verification of Unauthorized Database Access through Content Providers (Android)
includes MASTG-TEST-0357 References to Oversharing of File-Based Content Providers (Android)
includes MASTG-TEST-0364 Exported And Unprotected Activities That Expose Sensitive Functionality (Android)
includes MASTG-TEST-0365 Exported And Unprotected Services That Expose Sensitive Functionality (Android)
includes MASTG-TEST-0366 Exported And Unprotected Broadcast Receivers That Expose Sensitive Functionality (Android)
includes MASTG-TEST-0370 Missing Input Validation in Custom URL Scheme Handlers (iOS)
includes MASTG-TEST-0371 Missing Source Validation in Custom URL Scheme Handlers (iOS)
includes MASTG-TEST-0376 References to Native Bridge APIs in WebViews (iOS)
includes MASTG-TEST-0377 References to `evaluateJavaScript` Used as Bridge Reply in `WKScriptMessageHandler` (iOS)
includes MASTG-TEST-0378 References to Password Fields in WebView-Loaded HTML (iOS)
includes MASTG-TEST-0379 References to `evaluateJavaScript` Without Content World Isolation (iOS)
includes MASTG-TEST-0380 References to `evaluateJavaScript` Writing Sensitive Data into WebView DOM (iOS)
includes MASTG-TEST-0381 References to Insecure PendingIntent Creation (Android)
includes MASTG-TEST-0389 References to the App-Wide Restriction of Custom Keyboards (iOS)
includes MASTG-TEST-0390 Full Access Requested by a Custom Keyboard Extension (iOS)
includes MASTG-TEST-0393 Use of Unverified App Links (Android)
includes MASTG-TEST-0394 Missing Input Validation in Custom URL Scheme Handlers (Android)
includes MASTG-TEST-0395 Missing Input Validation in Universal Link Handlers (iOS)
  • OWASP -

    EN: Publications of the OWASP Foundation, https://owasp.org/. OWASP® is a registered trademark of the OWASP Foundation, Inc.; GRCA is not affiliated with, nor endorsed by, the OWASP Foundation. Only the versions published by OWASP are authoritative.

    DE: Veröffentlichungen der OWASP Foundation, https://owasp.org/. OWASP® ist eine eingetragene Marke der OWASP Foundation, Inc.; GRCA steht in keiner Verbindung zur OWASP Foundation und wird von ihr nicht unterstützt. Maßgeblich sind allein die von OWASP veröffentlichten Fassungen.