Overview

This test verifies whether the app cleans up sensitive data used by WebViews. Apps can enable several specific storage areas in their WebViews and not clean them up properly, leading to sensitive data being stored on the device longer than necessary. For example:

This test uses dynamic analysis to monitor the relevant API calls and file system operations. Regardless of whether the app uses these APIs directly, WebViews may use them internally when rendering content (e.g., JavaScript code using localStorage). So tracing calls to APIs such as open, openat, opendir, unlinkat, etc., can help identify file operations in the WebView storage directory.

When exercising the app, make sure to keep a list of the sensitive data you expect to be cleaned up, so you can verify whether it is still present in the WebView storage directory after closing the app.

Steps

  1. Use MASTG-TECH-0005 to install the app.
  2. Use MASTG-TECH-0043 to hook the relevant API calls.
  3. Exercise the app extensively to trigger as many flows as possible and enter sensitive data wherever you can.
  4. Close the app.
  5. Use MASTG-TECH-0002 to pull the contents of the /data/data/<app_package>/app_webview/ directory or simply search for the sensitive data used in the WebView within that directory.

Observation

The output should include:

  1. The list of WebView storage enablement APIs used.
  2. The list of WebView storage cleanup APIs used.
  3. The list of sensitive data expected to be cleaned up.
  4. The result of searching the contents of the /data/data/<app_package>/app_webview/ directory for the sensitive data used in the WebView after closing the app.

Evaluation

The test case fails if the app still has sensitive data on the /data/data/<app_package>/app_webview/ directory after the app is closed. This could be due to the app not calling the relevant cleanup APIs after using the WebView.

Note

It can be challenging to determine whether the right cleanup APIs were called for the enabled storage areas. MASTG-KNOW-0018 describes the storage areas used by WebViews and the challenges of evaluating their cleanup.

Additional Guidance:

If you need more introspection during runtime, you can rerun the test with additional tracing of file system operations in the WebView storage directory. See MASTG-TECH-0143.

Ticket collegati

Collegamenti
is related to MASTG-BEST-0028 WebViews Cache Cleanup (Android)