Port MASTG v1->v2 MASTG-TEST-0002: Testing Local Storage for Input Validation (android) (by @appknox) by jeel38 · Pull Request #3328 · OWASP/mastg

jeel38 · 2025-06-10T08:06:16Z

This PR ports MASTG-TEST-0002 from version 1 to version 2, creating a new test for detecting use of local storage for input validation in Android applications. The focus shifts from general local storage testing to specifically checking for integrity validation when reading from SharedPreferences.

Deprecates the old MASTG-TEST-0002 and creates MASTG-TEST-0288 as the new version
Implements static analysis detection for SharedPreferences usage without integrity checks
Provides demonstration code showing both vulnerable and secure patterns using HMAC validation

File	Description
tests/android/MASVS-CODE/MASTG-TEST-0002.md	Marks the original test as deprecated with reference to new version
tests-beta/android/MASVS-CODE/MASTG-TEST-0288.md	New test specification for detecting `SharedPreferences` without integrity validation
rules/mastg-android-local-storage-input-validation.yml	Semgrep rule to detect insecure `SharedPreferences` usage patterns
demos/android/MASVS-CODE/MASTG-DEMO-0061/	Complete demonstration including vulnerable code, and analysis output

Co-authored-by: pruDhv! <58649792+sk3l10x1ng@users.noreply.github.com>

jeel38 · 2025-06-10T08:26:01Z

@cpholguera, upon adding the depreciation note, getting branch gets a conflict

cpholguera · 2025-06-10T08:30:01Z

Maybe the branch was a bit old. We added "profiles" now for all tests. I fixed the conflict for you

Please add profiles to tests-beta/android/MASVS-CODE/MASTG-TEST-0281.md as well

cpholguera · 2025-06-10T08:31:56Z

The new profiles (previously known as "levels") are defined here: https://docs.google.com/document/d/1paz7dxKXHzAC9MN7Mnln1JiZwBNyg7Gs364AJ6KudEs/edit?usp=sharing

jeel38 · 2025-06-10T08:42:56Z

Maybe the branch was a bit old. We added "profiles" now for all tests. I fixed the conflict for you

Please add profiles to tests-beta/android/MASVS-CODE/MASTG-TEST-0281.md as well

Done

jeel38 · 2025-06-10T08:45:17Z

@cpholguera please review it

cpholguera · 2025-06-10T08:46:00Z

Please fix the issues reported by Copilot in section "Comments suppressed due to low confidence (5)"

Also, I agree with Copilot's comment about:

"The output file shows usages of the input validation using putString and getString in the code."

The phrasing is misleading: this test detects storage/retrieval calls, not input validation.

If you're conducting a pentest, would you report this as an issue? "The app uses putString() and getString()." The same goes for an automated security testing tool, would you like it to report this? Wouldn't that be noisy / lots of false positives?

cpholguera · 2025-06-10T11:51:49Z

There's another problem that will probably be solved when you fix the copilot issues. Are you able to read these logs?

https://github.com/OWASP/owasp-mastg/actions/runs/15554645412/job/43792346017?pr=3328

ERROR - Error reading page 'MASTG/demos/android/MASVS-CODE/MASTG-DEMO-0054/MASTG-DEMO-0054.md': Snippet at path '../../../../rules/mastg-android-local-storage-for-input-validation.yml' could not be found

jeel38 · 2025-08-11T09:50:55Z

@cpholguera please check

Copilot

Pull Request Overview

This PR ports MASTG-TEST-0002 from version 1 to version 2, creating a new test for detecting use of local storage for input validation in Android applications. The focus shifts from general local storage testing to specifically checking for integrity validation when reading from SharedPreferences.

Deprecates the old MASTG-TEST-0002 and creates MASTG-TEST-0288 as the new version
Implements static analysis detection for SharedPreferences usage without integrity checks
Provides demonstration code showing both vulnerable and secure patterns using HMAC validation

Reviewed Changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

File	Description
tests/android/MASVS-CODE/MASTG-TEST-0002.md	Marks the original test as deprecated with reference to new version
tests-beta/android/MASVS-CODE/MASTG-TEST-0288.md	New test specification for detecting SharedPreferences without integrity validation
rules/mastg-android-local-storage-input-validation.yml	Semgrep rule to detect insecure SharedPreferences usage patterns
demos/android/MASVS-CODE/MASTG-DEMO-0061/	Complete demonstration including vulnerable Java code, secure Kotlin implementation, and analysis output

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-08-31T18:30:21Z

tests/android/MASVS-CODE/MASTG-TEST-0002.md

 - L2
 profiles: [L1, L2]
+status: deprecated
+covered_by: [MASTG-TEST-0281]


The deprecation references MASTG-TEST-0281, but the actual replacement test created in this PR is MASTG-TEST-0288. This should be corrected to reference the correct test ID.

Suggested change

covered_by: [MASTG-TEST-0281]

covered_by: [MASTG-TEST-0288]

rules/mastg-android-local-storage-input-validation.yml

cpholguera · 2025-06-10T08:35:52Z

tests-beta/android/MASVS-CODE/MASTG-TEST-0281.md

+
+## Steps
+
+1. Run a static analysis tool such as @MASTG-TOOL-0110 on the code and look for uses of the `putString` and `getString`.


https://mas.owasp.org/MASTG/techniques/android/MASTG-TECH-0014/

This is an old file

rules/mastg-android-local-storage-input-validation.yml

demos/android/MASVS-CODE/MASTG-DEMO-XXXX/MASTG-DEMO-XXXX.md

jeel38 · 2025-09-17T12:09:09Z

@cpholguera requested changes be made. Could you please check

jeel38 · 2025-10-07T15:37:03Z

@cpholguera can you please review

jeel38 · 2025-10-27T04:42:55Z

@cpholguera can you please review it

Copilot

Pull Request Overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

demos/android/MASVS-CODE/MASTG-DEMO-XXXX/MastgTest.kt

Diolor

Thank you @jeel38 ! Really nice pen-test example ^^ Left some suggestions to improve this test. Feel free to reach out if something is unclear

demos/android/MASVS-CODE/MASTG-DEMO-0061/MASTG-DEMO-0061.md

Diolor · 2025-10-28T14:54:47Z

tests-beta/android/MASVS-CODE/MASTG-TEST-0288.md

+---
+title: Use of Local Storage for Input Validation
+platform: android
+id: MASTG-TEST-0288


you might need a new id just before merge (test 288 already exists)

tests-beta/android/MASVS-CODE/MASTG-TEST-XXXX.md

tests-beta/android/MASVS-CODE/MASTG-TEST-0288.md

Diolor · 2025-10-28T17:07:38Z

tests-beta/android/MASVS-CODE/MASTG-TEST-0288.md

@@ -0,0 +1,24 @@
+---
+title: Use of Local Storage for Input Validation


How about the following? Input validation to me sounds validating input rather than checking the integrity/authenticity of data.

Suggested change

title: Use of Local Storage for Input Validation

title: Validation of Local Storage Data

or

Suggested change

title: Use of Local Storage for Input Validation

title: Integrity and Authenticity Validation of Local Storage Data

demos/android/MASVS-CODE/MASTG-DEMO-0061/run.sh

Diolor · 2025-10-28T17:31:46Z

demos/android/MASVS-CODE/MASTG-DEMO-XXXX/MastgTest_reversed.java

+            SecureSharedPreferences insecurePrefs = new SecureSharedPreferences(this.context, false);
+            insecurePrefs.saveData("user_role_insecure", "user");
+            SecureSharedPreferences securePrefs = new SecureSharedPreferences(this.context, true);
+            securePrefs.saveData("user_role_secure", "user");


Extracting this file gives quite a different result. Most importantly, the following. Therefore, Semgrep finds no results for me.

Suggested change

SecureSharedPreferences insecurePrefs = new SecureSharedPreferences(this.context, false);

insecurePrefs.saveData("user_role_insecure", "user");

SecureSharedPreferences securePrefs = new SecureSharedPreferences(this.context, true);

securePrefs.saveData("user_role_secure", "user");

saveData("user_role_insecure", "user", false);

saveData("user_role_secure", "user", true);

Can you share your output.txt as showing the result of finding

Is this file LLM generated or did you actually pull it from the device? Please use the MastgTest.kt as input on the demo app.

The output.txt of the actual MastgTest.kt which is very different than this file is empty.

This is not a LLM Generated, it's a Reversed while MastgTest_reversed.java from MastgTest.kt file

Diolor · 2025-10-28T17:37:45Z

demos/android/MASVS-CODE/MASTG-DEMO-XXXX/MastgTest.kt

+            return "INITIAL SETUP COMPLETE.\n\n" +
+                    "The role for both secure and insecure tests has been set to 'user'.\n\n" +
+                    "ACTION REQUIRED:\n" +
+                    "1. Use a file explorer or ADB shell on a rooted device.\n" +
+                    "2. Go to: /data/data/org.owasp.mastestapp/shared_prefs/\n" +
+                    "3. Open the file: app_settings.xml\n" +
+                    "4. Change BOTH <string>user</string> values to <string>admin</string>.\n" +
+                    "5. Save the file and run this test again to see the results."


Well done on he pen-testing example! 👏 I followed the steps but sadly could not "tamper" it.

<?xml version='1.0' encoding='utf-8' standalone='yes' ?> <map> <string name="user_role_secure_hmac">690d026aeeba673e7225ee95a3460a0054752777afec8e4fb7ec8294934011ed</string> <boolean name="setup_complete" value="true" /> <string name="user_role_insecure">admin</string> <string name="user_role_secure">admin</string> </map>

is the file state between the 2 steps

You have to edit "user_role_insecure" value and restart the application

I did change both values as explained in step 5.
Both scenarios 1 and 2 display NOT EXPLOITED and NOT TAMPERED, respectively.

This is tested on physical rooted Android device. Please refer to the attached POC video

Screen.Recording.2026-01-30.at.12.mp4

Diolor · 2025-10-28T17:40:31Z

demos/android/MASVS-CODE/MASTG-DEMO-XXXX/MastgTest.kt

+                results.append(">> OUTCOME: NOT TAMPERED. The role is still '$secureRole', and its HMAC signature is valid.\n")
+            }
+
+            results.append("\n\nTest complete. To run the setup again, please clear the application's data in Android Settings and restart the test.")


fyi restarting the application (thus test) would rewrite the xml. No need for clearing app data

To get tamper data, you have to restart the application, clearing app data is reset to application default settings.

The message/user direction is wrong.

If I restart the application it will override the shared prefs to default -> "user"

Thus clearing the data is not required.

In combination with the fact that I could not "tamper" the app as explained in the other comment, please carefully re-check the demo and its instructions.

Refer the POC: #3328 (comment)

jeel38 · 2025-12-12T08:30:53Z

@Diolor please review, changes are completed

jeel38 · 2026-01-07T08:04:56Z

@Diolor please review

Diolor

Hi @jeel38, please carefully check the comments.
There are also unaddressed comments from my previous review. Please address those too before requesting a new review.

Diolor · 2026-01-12T12:37:33Z

tests/android/MASVS-CODE/MASTG-TEST-0002.md

 - L2
 profiles: [L1, L2]
+status: deprecated
+covered_by: [MASTG-TEST-0288]


indicating that this might change

This is been addressed

Diolor · 2026-01-12T12:44:10Z

tests/android/MASVS-CODE/MASTG-TEST-0002.md

 For any publicly accessible data storage, any process can override the data. This means that input validation needs to be applied the moment the data is read back again.

 > Note: The same is true for private accessible data on a rooted device


This v1 test addresses 2 issues:

Publicly accessible data

Private accessible data on a rooted device

As stated in the comment on the Tests' overview, the second case is not addressed on the v2 test.

Here, the demo covers "Private accessible data on a rooted device" as per the static analysis of the previous V1 test. Private test data path: /data/data/org.owasp.mastestapp/shared_prefs

Diolor · 2026-01-12T12:50:14Z

tests-beta/android/MASVS-CODE/MASTG-TEST-XXXX.md

+
+## Evaluation
+
+The test fails if the application does not verify the integrity and authenticity of data loaded from local storage such as `SharedPreferences`.


Does that mean we should verify integrity + authenticity for all data in SharedPrefs? E.g. a true/false boolean if the app should render light or dark them is not important.

Without adding the context of sensitive data or data that could harm the apps, this wording is very generalised.

Diolor · 2026-01-12T12:55:24Z

demos/android/MASVS-CODE/MASTG-DEMO-XXXX/MastgTest.kt

+package org.owasp.mastestapp
+
+import android.content.Context
+import android.content.SharedPreferences


This is been addressed

demos/android/MASVS-CODE/MASTG-DEMO-XXXX/MastgTest.kt

Diolor · 2026-01-12T13:05:54Z

demos/android/MASVS-CODE/MASTG-DEMO-XXXX/MastgTest.kt

+            return "INITIAL SETUP COMPLETE.\n\n" +
+                    "The role for both secure and insecure tests has been set to 'user'.\n\n" +
+                    "ACTION REQUIRED:\n" +
+                    "1. Use a file explorer or ADB shell on a rooted device.\n" +
+                    "2. Go to: /data/data/org.owasp.mastestapp/shared_prefs/\n" +
+                    "3. Open the file: app_settings.xml\n" +
+                    "4. Change BOTH <string>user</string> values to <string>admin</string>.\n" +
+                    "5. Save the file and run this test again to see the results."


I did change both values as explained in step 5.
Both scenarios 1 and 2 display NOT EXPLOITED and NOT TAMPERED, respectively.

Diolor · 2026-01-12T13:15:42Z

demos/android/MASVS-CODE/MASTG-DEMO-XXXX/MastgTest.kt

+                results.append(">> OUTCOME: NOT TAMPERED. The role is still '$secureRole', and its HMAC signature is valid.\n")
+            }
+
+            results.append("\n\nTest complete. To run the setup again, please clear the application's data in Android Settings and restart the test.")


The message/user direction is wrong.

If I restart the application it will override the shared prefs to default -> "user"

Thus clearing the data is not required.

In combination with the fact that I could not "tamper" the app as explained in the other comment, please carefully re-check the demo and its instructions.

Diolor · 2026-01-12T13:21:26Z

demos/android/MASVS-CODE/MASTG-DEMO-XXXX/MastgTest_reversed.java

+            SecureSharedPreferences insecurePrefs = new SecureSharedPreferences(this.context, false);
+            insecurePrefs.saveData("user_role_insecure", "user");
+            SecureSharedPreferences securePrefs = new SecureSharedPreferences(this.context, true);
+            securePrefs.saveData("user_role_secure", "user");


Is this file LLM generated or did you actually pull it from the device? Please use the MastgTest.kt as input on the demo app.

The output.txt of the actual MastgTest.kt which is very different than this file is empty.

Diolor · 2026-01-12T13:22:06Z

demos/android/MASVS-CODE/MASTG-DEMO-XXXX/output.txt

+           23┆ SecureSharedPreferences insecurePrefs = new  
+               SecureSharedPreferences(this.context, false);


Note: You might have hard wrapping in your editor.

This is been addressed

jeel38 · 2026-01-30T09:53:12Z

@Diolor please review it

jeel38 and others added 9 commits June 3, 2025 18:18

demo added draft

86aa179

fix grammar

69ebf81

mastgTest file update

8c4060b

updated test file

96a766f

Update tests-beta/android/MASVS-CODE/MASTG-TEST-0281.md

3e1c45a

Co-authored-by: pruDhv! <58649792+sk3l10x1ng@users.noreply.github.com>

updated changes

2a90252

updated changes

d31713c

updated changes done

970f558

updated changes test file

a323683

Merge branch 'master' into MASTG-TEST-0002_draft

16acaa0

added profiles

e1a0099

cpholguera requested a review from Copilot June 10, 2025 08:36

This comment was marked as outdated.

Sign in to view

cpholguera added Android MASVS-CODE MASTG Refactor changes-requested labels Jun 10, 2025

jeel38 and others added 5 commits July 31, 2025 17:45

Updated-Demo

3bb04a9

Updated-Demo-fix

bcaec04

internal-comment-completed

2a4b407

Updated Demo

fce6000

deleted old demo

4ba84d9

cpholguera added changes-done and removed changes-requested labels Aug 12, 2025

cpholguera requested a review from Copilot August 31, 2025 18:29

Copilot AI reviewed Aug 31, 2025

View reviewed changes

Merge branch 'master' into MASTG-TEST-0002_draft

c6b5232

cpholguera requested changes Sep 6, 2025

View reviewed changes

jeel38 added 2 commits September 17, 2025 17:33

updated changes

a855378

updated changes in demo file

f8639f8

cpholguera requested review from Diolor and Copilot October 27, 2025 12:00

Copilot AI reviewed Oct 27, 2025

View reviewed changes

demos/android/MASVS-CODE/MASTG-DEMO-XXXX/MastgTest.kt Show resolved Hide resolved

Diolor suggested changes Oct 28, 2025

View reviewed changes

Diolor mentioned this pull request Nov 1, 2025

Add MASTG-DEMO-0060 for securely storing sensitive data using EncryptedSharedPreferences #3410

Merged

updated changes

178bb52

jeel38 requested a review from Diolor December 12, 2025 08:30

Diolor suggested changes Jan 12, 2026

View reviewed changes

Chnages Completed

e01ee84

serek8 self-requested a review January 30, 2026 11:37

jeel38 added 2 commits March 10, 2026 14:32

fix changes

e5fbdea

fix spelling

7bdaaa0


		## Steps

		1. Run a static analysis tool such as @MASTG-TOOL-0110 on the code and look for uses of the `putString` and `getString`.

		@@ -0,0 +1,24 @@
		---
		title: Use of Local Storage for Input Validation

	title: Use of Local Storage for Input Validation
	title: Validation of Local Storage Data

	title: Use of Local Storage for Input Validation
	title: Integrity and Authenticity Validation of Local Storage Data

		For any publicly accessible data storage, any process can override the data. This means that input validation needs to be applied the moment the data is read back again.

		> Note: The same is true for private accessible data on a rooted device


		## Evaluation

		The test fails if the application does not verify the integrity and authenticity of data loaded from local storage such as `SharedPreferences`.

		23┆ SecureSharedPreferences insecurePrefs = new
		SecureSharedPreferences(this.context, false);

Uh oh!

Conversation

jeel38 commented Jun 10, 2025 • edited by cpholguera Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jeel38 commented Jun 10, 2025

Uh oh!

cpholguera commented Jun 10, 2025

Uh oh!

cpholguera commented Jun 10, 2025

Uh oh!

This comment was marked as outdated.

Uh oh!

jeel38 commented Jun 10, 2025

Uh oh!

jeel38 commented Jun 10, 2025

Uh oh!

cpholguera commented Jun 10, 2025

Uh oh!

cpholguera commented Jun 10, 2025

Uh oh!

jeel38 commented Aug 11, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Aug 31, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

jeel38 commented Sep 17, 2025

Uh oh!

jeel38 commented Oct 7, 2025

Uh oh!

jeel38 commented Oct 27, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Diolor left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jeel38 commented Jun 10, 2025 •

edited by cpholguera

Loading