应用安全检测报告

[android:usesCleartextTraffic=true]
应用允许明文网络流量（如 HTTP、FTP 协议、DownloadManager、MediaPlayer 等）。API 级别 27 及以下默认启用，28 及以上默认禁用。明文流量缺乏机密性、完整性和真实性保护，攻击者可窃听或篡改传输数据。建议关闭明文流量，仅使用加密协议。

未设置[android:allowBackup]标志
建议将 [android:allowBackup] 显式设置为 false。默认值为 true，允许通过 adb 工具备份应用数据，存在数据泄露风险。

[android:exported=true]
检测到  Broadcast Receiver 已导出，未受任何权限保护，任意应用均可访问。

[android:exported=true]
检测到  Content Provider 已导出，未受任何权限保护，任意应用均可访问。

[android:exported=true]
检测到  Activity 已导出，未受任何权限保护，任意应用均可访问。

Permission: com.google.android.c2dm.permission.SEND [android:exported=true]
检测到  Broadcast Receiver 已导出并受未在本应用定义的权限保护。请在权限定义处核查其保护级别。若为 normal 或 dangerous，恶意应用可申请并与组件交互；若为 signature，仅同证书签名应用可访问。

Permission: android.permission.INSTALL_PACKAGES [android:exported=true]
检测到  Broadcast Receiver 已导出并受未在本应用定义的权限保护。请在权限定义处核查其保护级别。若为 normal 或 dangerous，恶意应用可申请并与组件交互；若为 signature，仅同证书签名应用可访问。

Permission: android.permission.INSTALL_PACKAGES [android:exported=true]
检测到  Broadcast Receiver 已导出并受未在本应用定义的权限保护。请在权限定义处核查其保护级别。若为 normal 或 dangerous，恶意应用可申请并与组件交互；若为 signature，仅同证书签名应用可访问。

[android:exported=true]
检测到  Service 已导出，未受任何权限保护，任意应用均可访问。

Permission: com.google.android.gms.auth.api.signin.permission.REVOCATION_NOTIFICATION [android:exported=true]
检测到  Service 已导出并受未在本应用定义的权限保护。请在权限定义处核查其保护级别。若为 normal 或 dangerous，恶意应用可申请并与组件交互；若为 signature，仅同证书签名应用可访问。

Permission: android.permission.DUMP [android:exported=true]
检测到  Broadcast Receiver 已导出并受未在本应用定义的权限保护。请在权限定义处核查其保护级别。若为 normal 或 dangerous，恶意应用可申请并与组件交互；若为 signature，仅同证书签名应用可访问。

应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#external-storage

Files:
com/xyd/platform/android/autoupdate/AutoUpdater.java, line(s) 94
com/xyd/platform/android/chat/ChatWebView.java, line(s) 58,61,376,58,375
com/xyd/platform/android/config/XinydAttributeLanguage.java, line(s) 29
com/xyd/platform/android/config/XinydConfig.java, line(s) 418
com/xyd/platform/android/config/XinydDeviceID.java, line(s) 138
com/xyd/platform/android/headicon/CirclePhotoClipWindow.java, line(s) 96
com/xyd/platform/android/headicon/LocalPictureHelper.java, line(s) 108,176,238,244,344,465,175,439,464
com/xyd/platform/android/headicon/PhotoClipWindow.java, line(s) 76
com/xyd/platform/android/headicon/PhotoClipWindowNew.java, line(s) 363
com/xyd/platform/android/log/SDKLog.java, line(s) 118
com/xyd/platform/android/pay/horizontal/widget/HorizontalCombinedCreditCardView.java, line(s) 234
com/xyd/platform/android/pay/utils/PayUtils.java, line(s) 30,101,105,100
com/xyd/platform/android/ping/PingUtils.java, line(s) 157
com/xyd/platform/android/uploadImgToGM/GameChatImageWindow.java, line(s) 223
com/xyd/platform/android/utils/ImageCompressorUtils.java, line(s) 240
com/xyd/platform/android/utils/SystemInfoUtils.java, line(s) 26,118
com/xyd/platform/android/utils/XinydFileUtils.java, line(s) 93,124,103,103
z0/C1889X.java, line(s) 1047,1053,1226

不安全的Web视图实现。可能存在WebView任意代码执行漏洞
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#testing-javascript-execution-in-webviews-mstg-platform-5

Files:
com/google/android/recaptcha/internal/zzbh.java, line(s) 35,34
com/xyd/platform/android/chat/ChatWebView.java, line(s) 261,246
com/xyd/platform/android/forum/GameForumActivity.java, line(s) 557,315
com/xyd/platform/android/webPay/WebPayActivity.java, line(s) 313,246

可能存在跨域漏洞。在 WebView 中启用从 URL 访问文件可能会泄漏文件系统中的敏感信息
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#static-analysis-6

Files:
com/xyd/platform/android/chat/ChatWebView.java, line(s) 252,246
com/xyd/platform/android/forum/GameForumActivity.java, line(s) 320,315
com/xyd/platform/android/pay/widget/WebPayView.java, line(s) 139,132
com/xyd/platform/android/webPay/WebPayActivity.java, line(s) 251,246
i3/d.java, line(s) 41,36

应用程序使用不安全的随机数生成器
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-random-number-generators

Files:
F3/AbstractC1359a.java, line(s) 3
F3/C1360b.java, line(s) 4
G3/C1376a.java, line(s) 5
i0/C1430s.java, line(s) 3
z0/C1889X.java, line(s) 59

SHA-1是已知存在哈希冲突的弱哈希
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
S2/C1801b.java, line(s) 56
i0/a.java, line(s) 23
w3/b.java, line(s) 174

应用程序创建临时文件。敏感信息永远不应该被写进临时文件


Files:
S2/C1802c.java, line(s) 84
X/b.java, line(s) 125

应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04h-Testing-Code-Quality.md#injection-flaws-mstg-arch-2-and-mstg-platform-2

Files:
a1/M.java, line(s) 9,10,260,295,312,321,369,478,493,701
a1/U.java, line(s) 5,6,136
com/google/android/recaptcha/internal/zzq.java, line(s) 7,8,38
com/xyd/platform/android/database/XinydSQLOpenHelper.java, line(s) 5,6,25,26,27,28,29,30,31,33,34,35,42,48,54

文件可能包含硬编码的敏感信息，如用户名、密码、密钥等
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#checking-memory-for-sensitive-data-mstg-storage-10

Files:
B1/C0246k.java, line(s) 122
L0/g.java, line(s) 98
com/xyd/platform/android/XinydAFTracking.java, line(s) 11
com/xyd/platform/android/config/XinydEncrypt.java, line(s) 4
com/xyd/platform/android/login/XinydThirdPartyUtils.java, line(s) 536,536
com/xyd/platform/android/provider/SharedPreferencesProvider.java, line(s) 16
com/yottagames/stoneage/MainActivity.java, line(s) 55

MD5是已知存在哈希冲突的弱哈希
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
J0/C1458d.java, line(s) 50
R0/C1774l.java, line(s) 142
com/xyd/platform/android/utils/XinydUtils.java, line(s) 544

Firebase远程配置URL （ https://firebaseremoteconfig.googleapis.com/v1/projects/251912502646/namespaces/firebase:fetch?key=AIzaSyCZ3zhJ4tv_o0sgaEe03NIiS6PFJcR41P0 ） 已启用。请确保这些配置不包含敏感信息。响应内容如下所示：

{
    "entries": {
        "ca_android_will_purchase": "",
        "ca_ios_will_in_app_purchase": ""
    },
    "state": "UPDATE",
    "templateVersion": "12"
}

此应用程序有多个4隐私跟踪程序。跟踪器可以跟踪设备或用户，是终端用户的隐私问题。

从应用程序中识别出以下机密确保这些不是机密或私人信息
凭证信息=> "com.google.android.gms.games.APP_ID" : "@7F0E0023"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Password"
"androidx.credentials.TYPE_PUBLIC_KEY_CREDENTIAL" : "Passkey"
"app_id" : "1291203008"
"facebook_app_id" : "493181124384726"
"facebook_client_token" : "4fcbde5a4d0890ccd7bea02afe47fce4"
"firebase_database_url" : "https://stone-age-183806.firebaseio.com"
"google_api_key" : "AIzaSyCZ3zhJ4tv_o0sgaEe03NIiS6PFJcR41P0"
"google_app_id" : "1:251912502646:android:e9aea75168e4454a"
"google_crash_reporting_api_key" : "AIzaSyCZ3zhJ4tv_o0sgaEe03NIiS6PFJcR41P0"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Contrasenya"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Adgangskode"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Passord"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Passwort"
"androidx.credentials.TYPE_PUBLIC_KEY_CREDENTIAL" : "Passkey"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Wagwoord"
"androidx.credentials.TYPE_PUBLIC_KEY_CREDENTIAL" : "Wagwoordsleutel"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Salasana"
"androidx.credentials.TYPE_PUBLIC_KEY_CREDENTIAL" : "Avainkoodi"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Heslo"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Contrasinal"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Wachtwoord"
"androidx.credentials.TYPE_PUBLIC_KEY_CREDENTIAL" : "Toegangssleutel"
"androidx.credentials.TYPE_PUBLIC_KEY_CREDENTIAL" : "Klucz"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Geslo"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Password"
"androidx.credentials.TYPE_PUBLIC_KEY_CREDENTIAL" : "Passkey"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Sandi"
"androidx.credentials.TYPE_PUBLIC_KEY_CREDENTIAL" : "Passkey"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Zaporka"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Lozinka"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Lozinka"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Heslo"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Parool"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Password"
"androidx.credentials.TYPE_PUBLIC_KEY_CREDENTIAL" : "Passkey"
"androidx.credentials.TYPE_PUBLIC_KEY_CREDENTIAL" : "Passkey"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Senha"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Pasahitza"
"androidx.credentials.TYPE_PUBLIC_KEY_CREDENTIAL" : "Sarbide-gakoa"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Iphasiwedi"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Parole"
"androidx.credentials.TYPE_PUBLIC_KEY_CREDENTIAL" : "Nyckel"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Nenosiri"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Parol"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Parol"
"androidx.credentials.TYPE_PUBLIC_KEY_CREDENTIAL" : "Kod"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Password"
"androidx.credentials.TYPE_PUBLIC_KEY_CREDENTIAL" : "Passkey"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Password"
"androidx.credentials.TYPE_PUBLIC_KEY_CREDENTIAL" : "Passkey"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Password"
"androidx.credentials.TYPE_PUBLIC_KEY_CREDENTIAL" : "Passkey"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Senha"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Palavra-passe"
"android.credentials.TYPE_PASSWORD_CREDENTIAL" : "Password"
"androidx.credentials.TYPE_PUBLIC_KEY_CREDENTIAL" : "Passkey"
45c5d3542b2f66025dfb1b016b82cca3
258EAFA5-E914-47DA-95CA-C5AB0DC85B11
9b8f518b086098de3d77736f9458a3d2f6f95a37
cc2751449a350f668590264ed76692694a80308a
df6b721c8b4d3b6eb44c861d4415007e5a35fc95
8a3c4b262d721acd49a4bf97d5213199c86fa2b9
c56fb7d591ba6704df047fd98f535372fea00211
a4b7452e2ed8f5f191058ca7bbfd26b0d3214bfc
2438bce1ddb7bd026d5ff89f598b3b5e5bb824b3
5a34016b251bbdfb2f66582c5c42c0d3