+MASVS-PLATFORM Platform Interaction
---+MASTG-TEST-0250 References to Content Provider Access in WebViews (Android)
---+MASTG-TEST-0251 Runtime Use of Content Provider Access APIs in WebViews (Android)
---+MASTG-TEST-0252 References to Local File Access in WebViews (Android)
---+MASTG-TEST-0253 Runtime Use of Local File Access APIs in WebViews (Android)
---+MASTG-TEST-0258 References to Keyboard Caching Attributes in UI Elements (Android)
---+MASTG-TEST-0276 Use of the iOS General Pasteboard (iOS)
---+MASTG-TEST-0277 Sensitive Data in the iOS General Pasteboard at Runtime (iOS)
---+MASTG-TEST-0278 Pasteboard Contents Not Cleared After Use (iOS)
---+MASTG-TEST-0279 Pasteboard Contents Not Expiring (iOS)
---+MASTG-TEST-0280 Pasteboard Contents Not Restricted to Local Device (iOS)
---+MASTG-TEST-0289 Runtime Verification of Sensitive Content Exposure in Screenshots During App Backgrounding (Android)
---+MASTG-TEST-0290 Runtime Verification of Sensitive Content Exposure in Screenshots During App Backgrounding (iOS)
---+MASTG-TEST-0291 References to Screen Capturing Prevention APIs (Android)
---+MASTG-TEST-0315 Sensitive Data Exposed via Notifications (Android)
---+MASTG-TEST-0316 App Exposing User Authentication Data in Text Input Fields (Android)
---+MASTG-TEST-0320 WebViews Not Cleaning Up Sensitive Data (Android)
---+MASTG-TEST-0332 Attacker-Controlled URI in WebViews (iOS)
---+MASTG-TEST-0333 Overly Broad File Read Access in WebViews (iOS)
---+MASTG-TEST-0334 Native Code Exposed Through WebViews (Android)
---+MASTG-TEST-0335 WebView File Origin Access Relaxed by Configuration (iOS)
---+MASTG-TEST-0336 Runtime Setting of Relaxed WebView File Origin Policies (iOS)
---+MASTG-TEST-0340 References to Overlay Attack Protections (Android)
---+MASTG-TEST-0346 References to APIs Hiding Sensitive Data in Text Input Fields (iOS)
---+MASTG-TEST-0347 Runtime Use of APIs Hiding Sensitive Data in Text Input Fields (iOS)
---+MASTG-TEST-0355 References to Unauthorized Database Access through Content Providers (Android)
---+MASTG-TEST-0356 Runtime Verification of Unauthorized Database Access through Content Providers (Android)
---+MASTG-TEST-0357 References to Oversharing of File-Based Content Providers (Android)
---+MASTG-TEST-0364 Exported And Unprotected Activities That Expose Sensitive Functionality (Android)
---+MASTG-TEST-0365 Exported And Unprotected Services That Expose Sensitive Functionality (Android)
---+MASTG-TEST-0366 Exported And Unprotected Broadcast Receivers That Expose Sensitive Functionality (Android)
---+MASTG-TEST-0370 Missing Input Validation in Custom URL Scheme Handlers (iOS)
---+MASTG-TEST-0371 Missing Source Validation in Custom URL Scheme Handlers (iOS)
---+MASTG-TEST-0376 References to Native Bridge APIs in WebViews (iOS)
---+MASTG-TEST-0377 References to `evaluateJavaScript` Used as Bridge Reply in `WKScriptMessageHandler` (iOS)
---+MASTG-TEST-0378 References to Password Fields in WebView-Loaded HTML (iOS)
---+MASTG-TEST-0379 References to `evaluateJavaScript` Without Content World Isolation (iOS)
---+MASTG-TEST-0380 References to `evaluateJavaScript` Writing Sensitive Data into WebView DOM (iOS)
---+MASTG-TEST-0381 References to Insecure PendingIntent Creation (Android)
---+MASTG-TEST-0389 References to the App-Wide Restriction of Custom Keyboards (iOS)
---+MASTG-TEST-0390 Full Access Requested by a Custom Keyboard Extension (iOS)
---+MASTG-TEST-0393 Use of Unverified App Links (Android)
---+MASTG-TEST-0394 Missing Input Validation in Custom URL Scheme Handlers (Android)
---+MASTG-TEST-0395 Missing Input Validation in Universal Link Handlers (iOS)
|
MASVS-PLATFORM Platform Interaction
Tests for the MASVS group MASVS-PLATFORM.
1. Ħarsa ġenerali
1.1 Referenzi
1.2 Rekwiżiti identifikati
1.3 Regolamenti relatati
2. Rekwiżiti identifikati
3. Regolamenti relatati
Regolamenti
| Sors |
Regolamentazzjoni |
Kwistjonijiet marbuta
- OWASP -
EN: Publications of the OWASP Foundation, https://owasp.org/. OWASP® is a registered trademark of the OWASP Foundation, Inc.; GRCA is not affiliated with, nor endorsed by, the OWASP Foundation. Only the versions published by OWASP are authoritative. - OWASP Application Security Verification Standard (ASVS) 5.0.0, May 2025, from OWASP/ASVS: © 2008-2025 The OWASP Foundation, licensed under CC BY-SA 4.0. Changes: divided into sections and converted into the GRCA format, the wording unchanged. These adaptations are shared under CC BY-SA 4.0 as well.
- OWASP Mobile Application Security Verification Standard (MASVS) v2.1.0, January 2024, from OWASP/masvs: © The OWASP Foundation, licensed under CC BY-SA 4.0. Changes: converted into the GRCA format, the wording unchanged. These adaptations are shared under CC BY-SA 4.0 as well.
- OWASP Mobile Application Security Weakness Enumeration (MASWE) v1.0.0, August 2026, from OWASP/maswe: © The OWASP Foundation, licensed under CC BY-SA 4.0. Changes: converted into the GRCA format, the wording unchanged, linked to the MASVS controls they map to. These adaptations are shared under CC BY-SA 4.0 as well.
- OWASP Mobile Application Security Testing Guide (MASTG) v2.0.0, June 2026, from OWASP/mastg: © The OWASP Foundation, licensed under CC BY-SA 4.0. The tests and best practices only, without code samples, images, tools or apps. Changes: converted into the GRCA format, the wording unchanged; references to other pages of the MASTG as links to mas.owasp.org; the weakness of each test in the numbering of MASWE v1 and linked to it. These adaptations are shared under CC BY-SA 4.0 as well.
- OWASP Software Assurance Maturity Model (SAMM) v2.2.0, July 2026, from owaspsamm/core: © The OWASP Foundation, licensed under CC BY-SA 4.0. Changes: converted into the GRCA format, the wording unchanged; short codes (G-SM-1-A) built from the model, the assessment questions as assessment procedures of their activities. These adaptations are shared under CC BY-SA 4.0 as well.
- OWASP Top 10:2025, from OWASP/Top10: © 2003-2025 The OWASP® Foundation, Inc., licensed under CC BY-SA 4.0. The ten categories, without the icons. Changes: converted into the GRCA format, the wording unchanged. These adaptations are shared under CC BY-SA 4.0 as well. The names of the mapped CWEs (Common Weakness Enumeration): © 2006–2026 The MITRE Corporation. License: The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. See the CWE Terms of Use. CWE™ is a trademark of The MITRE Corporation.
DE: Veröffentlichungen der OWASP Foundation, https://owasp.org/. OWASP® ist eine eingetragene Marke der OWASP Foundation, Inc.; GRCA steht in keiner Verbindung zur OWASP Foundation und wird von ihr nicht unterstützt. Maßgeblich sind allein die von OWASP veröffentlichten Fassungen. - OWASP Application Security Verification Standard (ASVS) 5.0.0, Mai 2025, aus OWASP/ASVS: © 2008-2025 The OWASP Foundation, lizenziert unter CC BY-SA 4.0. Änderungen: in Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Diese Bearbeitungen stehen ebenfalls unter CC BY-SA 4.0.
- OWASP Mobile Application Security Verification Standard (MASVS) v2.1.0, Januar 2024, aus OWASP/masvs: © The OWASP Foundation, lizenziert unter CC BY-SA 4.0. Änderungen: in das GRCA-Format umgewandelt, der Wortlaut unverändert. Diese Bearbeitungen stehen ebenfalls unter CC BY-SA 4.0.
- OWASP Mobile Application Security Weakness Enumeration (MASWE) v1.0.0, August 2026, aus OWASP/maswe: © The OWASP Foundation, lizenziert unter CC BY-SA 4.0. Änderungen: in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den MASVS-Controls verknüpft, denen sie zugeordnet sind. Diese Bearbeitungen stehen ebenfalls unter CC BY-SA 4.0.
- OWASP Mobile Application Security Testing Guide (MASTG) v2.0.0, Juni 2026, aus OWASP/mastg: © The OWASP Foundation, lizenziert unter CC BY-SA 4.0. Nur die Tests und Best Practices, ohne Codebeispiele, Bilder, Werkzeuge und Apps. Änderungen: in das GRCA-Format umgewandelt, der Wortlaut unverändert; Verweise auf andere Seiten des MASTG als Links zu mas.owasp.org; die Schwachstelle jedes Tests in der Nummerierung der MASWE v1 und mit ihr verknüpft. Diese Bearbeitungen stehen ebenfalls unter CC BY-SA 4.0.
- OWASP Software Assurance Maturity Model (SAMM) v2.2.0, Juli 2026, aus owaspsamm/core: © The OWASP Foundation, lizenziert unter CC BY-SA 4.0. Änderungen: in das GRCA-Format umgewandelt, der Wortlaut unverändert; Kürzel (G-SM-1-A) aus dem Modell gebildet, die Assessment-Fragen als Prüfverfahren ihrer Aktivitäten. Diese Bearbeitungen stehen ebenfalls unter CC BY-SA 4.0.
- OWASP Top 10:2025, aus OWASP/Top10: © 2003-2025 The OWASP® Foundation, Inc., lizenziert unter CC BY-SA 4.0. Die zehn Kategorien, ohne die Symbole. Änderungen: in das GRCA-Format umgewandelt, der Wortlaut unverändert. Diese Bearbeitungen stehen ebenfalls unter CC BY-SA 4.0. Die Namen der zugeordneten CWEs (Common Weakness Enumeration): © 2006–2026 The MITRE Corporation. MITRE erlaubt die Nutzung für Forschung, Entwicklung und kommerzielle Zwecke, wenn jede Kopie den Urheberrechtsvermerk und die Lizenz enthält; maßgeblich ist der englische Wortlaut der Lizenz oben und die CWE Terms of Use. CWE™ ist eine Marke der MITRE Corporation.
|