+MASTG-BEST-0071 Validate Input Parameters in Deep Link and Custom URL Scheme Handlers (Android)

MASTG-BEST-0071 Validate Input Parameters in Deep Link and Custom URL Scheme Handlers (Android)

Validate and sanitize every value read from an incoming deep link before using it. Any app on the device can send an Intent that targets your handler, and Android provides no reliable way to identify the caller, so treat all parameters obtained from Intent.getData(), Uri.getQueryParameter(), Uri.getPathSegments(), or Uri.getLastPathSegment() as untrusted input (see MASTG-KNOW-0019).

Convert to Expected Types

When a parameter represents a numeric value, convert it explicitly with toLongOrNull() or toIntOrNull() and handle the failure case. Never use the raw string returned by getQueryParameter() directly in an operation that expects a specific type.

val amount = uri.getQueryParameter("amount")?.toLongOrNull()
    ?: return  // reject missing or non-numeric values

Check Bounds and Ranges

After type conversion, verify that the value falls within acceptable limits before acting on it. For financial or resource-sensitive operations, enforce both a minimum and a maximum.

if (amount <= 0 || amount > 10_000) return

Sanitize String Parameters

Without sanitization, a crafted URI can target different parts of the app:

  • Path traversal: a value like path=../../databases/secrets.db can escape an intended directory if used in file operations. Resolve and verify the canonical path stays within the expected base directory.
  • Script injection: a value like q=<script>alert(1)</script> can execute JavaScript if rendered in a WebView. See MASTG-TEST-0031.
  • Query or command injection: values interpolated into SQL queries or shell commands can alter their logic. Use parameterized queries and avoid string concatenation.

Prefer allowlists for parameters that select a resource or an action when the set of valid inputs is known. Reject any value that does not match rather than attempting to strip individual characters.

Restrict the Handler Surface

If a deep link handler does not need to be reachable by other apps, set android:exported="false" on its activity. For links that trigger sensitive actions, prefer verified App Links (see MASTG-BEST-0070) over custom URL schemes.

1. Prezentare generală

1.1 Referințe

1.2 Cerințe identificate

1.3 Reglementări asociate

2. Cerințe identificate

Cerințe

3. Reglementări asociate

Reglementări

Tichete legate

Legături
is related to MASTG-TEST-0394 Missing Input Validation in Custom URL Scheme Handlers (Android)
  • OWASP -

    EN: Publications of the OWASP Foundation, https://owasp.org/. OWASP® is a registered trademark of the OWASP Foundation, Inc.; GRCA is not affiliated with, nor endorsed by, the OWASP Foundation. Only the versions published by OWASP are authoritative.

    DE: Veröffentlichungen der OWASP Foundation, https://owasp.org/. OWASP® ist eine eingetragene Marke der OWASP Foundation, Inc.; GRCA steht in keiner Verbindung zur OWASP Foundation und wird von ihr nicht unterstützt. Maßgeblich sind allein die von OWASP veröffentlichten Fassungen.