-
Notifications
You must be signed in to change notification settings - Fork 114
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
14 changed files
with
251 additions
and
29 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| ## XSLT scripting should be disabled if possible | ||
|
|
||
| ### Summary | ||
| XSLT scripting contains significant security risks if used on untrustworthy data. | ||
|
|
||
| ### Details | ||
| TO DO - put more details of problem and solution here | ||
|
|
||
| ### References | ||
|
|
||
| *[https://learn.microsoft.com/en-us/previous-versions/windows/desktop/ms763800(v=vs.85)](https://learn.microsoft.com/en-us/previous-versions/windows/desktop/ms763800(v=vs.85)) | ||
| * [https://learn.microsoft.com/en-us/dotnet/api/system.xml.xsl.xsltsettings.enablescript?view=net-8.0](https://learn.microsoft.com/en-us/dotnet/api/system.xml.xsl.xsltsettings.enablescript?view=net-8.0) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| ## Hard-coded Cryptography | ||
|
|
||
| ### Summary | ||
|
|
||
| Usage of hard-coded cryptography reduces the crypto agility of an application, which can hinder attempts to move away from vulnerable cryptography. | ||
|
|
||
| ### Details | ||
|
|
||
| Crypto agility is the ability of an application to migrate from one cryptographic algorithm to another. This ability is valuable both in situations where new, stronger cryptographic algorithms become available, and new attacks against existing cryptographic algorithms become known, making those algorithms no longer safe to use. | ||
|
|
||
| Crypto agility includes being able to switch parameters of an existing algorithm, such as switching between AES-128 and AES-256. | ||
|
|
||
| In order to facilitate this ability, hard-coding crypto algorithms and parameters is not recommended. | ||
|
|
||
| ### References | ||
|
|
||
| * [https://learn.microsoft.com/en-us/archive/msdn-magazine/2009/brownfield/cryptographic-agility](https://learn.microsoft.com/en-us/archive/msdn-magazine/2009/brownfield/cryptographic-agility) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,136 @@ | ||
| [ | ||
| { | ||
| "name": "Android debug is enabled.", | ||
| "id": "DS180000", | ||
| "description": "The android:debuggable element is set to true, which should be disabled for release builds.", | ||
| "recommendation": "Set android:debuggable to false for release builds.", | ||
| "applies_to_file_regex": [ | ||
| "AndroidManifest.xml" | ||
| ], | ||
| "tags": [ | ||
| "Framework.Android" | ||
| ], | ||
| "severity": "ManualReview", | ||
| "rule_info": "DS180000.md", | ||
| "patterns": [ | ||
| { | ||
| "xpaths": ["//default:application/@android:debuggable"], | ||
| "xpathnamespaces": { | ||
| "default": "http://maven.apache.org/POM/4.0.0", | ||
| "android": "http://schemas.android.com/apk/res/android" | ||
| } | ||
| "pattern": "true", | ||
| "type": "regex", | ||
| "scopes": [ | ||
| "code" | ||
| ], | ||
| "modifiers" : ["i"] | ||
| } | ||
| ], | ||
| "fix_its": [ | ||
| { | ||
| "name": "Change to false", | ||
| "type": "RegexReplace", | ||
| "replacement": "false", | ||
| "pattern": { | ||
| "pattern": "true", | ||
| "type": "regex", | ||
| "scopes": [ | ||
| "code" | ||
| ], | ||
| "_comment": "" | ||
| } | ||
| } | ||
| ], | ||
| "must-match": [ | ||
| "<?xml version=\"1.0\" encoding=\"utf-8\"?><manifest xmlns=\"http://maven.apache.org/POM/4.0.0\" xmlns:android=\"http://schemas.android.com/apk/res/android\"><application android:debuggable='true' /></manifest>" | ||
| ], | ||
| "must-not-match": [ | ||
| "<?xml version=\"1.0\" encoding=\"utf-8\"?><manifest xmlns=\"http://maven.apache.org/POM/4.0.0\" xmlns:android=\"http://schemas.android.com/apk/res/android\"><application android:debuggable='false' /></manifest>" | ||
| ] | ||
| }, | ||
| { | ||
| "name": "Android debug is enabled.", | ||
| "id": "DS180001", | ||
| "description": "The setWebContentsDebuggingEnabled element is set to true, which should be disabled for release builds.", | ||
| "recommendation": "Set setWebContentsDebuggingEnabled to false for release builds.", | ||
| "applies_to": [ | ||
| "java" | ||
| ], | ||
| "tags": [ | ||
| "Framework.Android" | ||
| ], | ||
| "severity": "ManualReview", | ||
| "rule_info": "DS180000.md", | ||
| "patterns": [ | ||
| { | ||
| "pattern": "setWebContentsDebuggingEnabled\\(true\\)", | ||
| "type": "regex", | ||
| "scopes": [ | ||
| "code" | ||
| ], | ||
| "modifiers" : ["i"] | ||
| } | ||
| ], | ||
| "fix_its": [ | ||
| { | ||
| "name": "Change to false", | ||
| "type": "RegexReplace", | ||
| "replacement": "false", | ||
| "pattern": { | ||
| "pattern": "true", | ||
| "type": "regex", | ||
| "scopes": [ | ||
| "code" | ||
| ], | ||
| "_comment": "" | ||
| } | ||
| } | ||
| ], | ||
| "must-match": [ | ||
| "setWebContentsDebuggingEnabled(true)" | ||
| ], | ||
| "must-not-match": [ | ||
| "setWebContentsDebuggingEnabled(false)" | ||
| ] | ||
| }, | ||
| { | ||
| "name": "Android StrictMode is enabled.", | ||
| "id": "DS180002", | ||
| "description": "StrictMode is detected, which is useful for developers but should be disabled for release builds.", | ||
| "recommendation": "Disable StrictMode for release builds.", | ||
| "applies_to": [ | ||
| "java" | ||
| ], | ||
| "tags": [ | ||
| "Framework.Android" | ||
| ], | ||
| "severity": "ManualReview", | ||
| "rule_info": "DS180001.md", | ||
| "patterns": [ | ||
| { | ||
| "pattern": "StrictMode.setThreadPolicy(", | ||
| "type": "substring", | ||
| "scopes": [ | ||
| "code" | ||
| ], | ||
| "modifiers" : ["i"] | ||
| }, | ||
| { | ||
| "pattern": "StrictMode.setVmPolicy(", | ||
| "type": "substring", | ||
| "scopes": [ | ||
| "code" | ||
| ], | ||
| "modifiers" : ["i"] | ||
| } | ||
| ], | ||
| "must-match": [ | ||
| "StrictMode.setThreadPolicy(new StrictMode.ThreadPolicy.Builder()", | ||
| "StrictMode.setVmPolicy(new StrictMode.VmPolicy.Builder()" | ||
| ], | ||
| "must-not-match": [ | ||
| "application(StrictMode)" | ||
| ] | ||
| } | ||
| ] |
Oops, something went wrong.