diff --git a/docs/checks/DefaultCleartextTraffic.md.html b/docs/checks/DefaultCleartextTraffic.md.html
index d3dcb28f..353b225c 100644
--- a/docs/checks/DefaultCleartextTraffic.md.html
+++ b/docs/checks/DefaultCleartextTraffic.md.html
@@ -32,7 +32,7 @@
Editing
: This check runs on the fly in the IDE editor
See
-: http://goo.gle/DefaultCleartextTraffic
+: https://goo.gle/DefaultCleartextTraffic
Implementation
: [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/MissingNetworkSecurityConfigDetector.kt)
Tests
@@ -85,17 +85,17 @@
```
// build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
// build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
// build.gradle.kts with version catalogs:
lintChecks(libs.com.android.security.lint.lint)
# libs.versions.toml
[versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
[libraries]
# For clarity and text wrapping purposes the following declaration is
# shown split up across lines, but in TOML it needs to be on a single
@@ -107,7 +107,7 @@
}
```
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
there may be newer versions available.
[Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).
diff --git a/docs/checks/DefaultTrustedUserCerts.md.html b/docs/checks/DefaultTrustedUserCerts.md.html
index c27cb60b..4ea67880 100644
--- a/docs/checks/DefaultTrustedUserCerts.md.html
+++ b/docs/checks/DefaultTrustedUserCerts.md.html
@@ -32,7 +32,7 @@
Editing
: This check runs on the fly in the IDE editor
See
-: http://goo.gle/DefaultTrustedUserCerts
+: https://goo.gle/DefaultTrustedUserCerts
Implementation
: [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/MissingNetworkSecurityConfigDetector.kt)
Tests
@@ -87,17 +87,17 @@
```
// build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
// build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
// build.gradle.kts with version catalogs:
lintChecks(libs.com.android.security.lint.lint)
# libs.versions.toml
[versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
[libraries]
# For clarity and text wrapping purposes the following declaration is
# shown split up across lines, but in TOML it needs to be on a single
@@ -109,7 +109,7 @@
}
```
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
there may be newer versions available.
[Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).
diff --git a/docs/checks/DisabledAllSafeBrowsing.md.html b/docs/checks/DisabledAllSafeBrowsing.md.html
index 2c31bfa7..1689d579 100644
--- a/docs/checks/DisabledAllSafeBrowsing.md.html
+++ b/docs/checks/DisabledAllSafeBrowsing.md.html
@@ -32,7 +32,7 @@
Editing
: This check runs on the fly in the IDE editor
See
-: http://goo.gle/DisabledAllSafeBrowsing
+: https://goo.gle/DisabledAllSafeBrowsing
Implementation
: [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/SafeBrowsingDetector.kt)
Tests
@@ -89,17 +89,17 @@
```
// build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
// build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
// build.gradle.kts with version catalogs:
lintChecks(libs.com.android.security.lint.lint)
# libs.versions.toml
[versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
[libraries]
# For clarity and text wrapping purposes the following declaration is
# shown split up across lines, but in TOML it needs to be on a single
@@ -111,7 +111,7 @@
}
```
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
there may be newer versions available.
[Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).
diff --git a/docs/checks/ExposedRootPath.md.html b/docs/checks/ExposedRootPath.md.html
index 48ea9491..7b458f41 100644
--- a/docs/checks/ExposedRootPath.md.html
+++ b/docs/checks/ExposedRootPath.md.html
@@ -32,7 +32,7 @@
Editing
: This check runs on the fly in the IDE editor
See
-: http://goo.gle/ExposedRootPath
+: https://goo.gle/ExposedRootPath
Implementation
: [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/MisconfiguredFileProviderDetector.kt)
Tests
@@ -87,17 +87,17 @@
```
// build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
// build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
// build.gradle.kts with version catalogs:
lintChecks(libs.com.android.security.lint.lint)
# libs.versions.toml
[versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
[libraries]
# For clarity and text wrapping purposes the following declaration is
# shown split up across lines, but in TOML it needs to be on a single
@@ -109,7 +109,7 @@
}
```
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
there may be newer versions available.
[Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).
diff --git a/docs/checks/InsecureDnsSdkLevel.md.html b/docs/checks/InsecureDnsSdkLevel.md.html
index e447f4f4..5c96ac50 100644
--- a/docs/checks/InsecureDnsSdkLevel.md.html
+++ b/docs/checks/InsecureDnsSdkLevel.md.html
@@ -32,7 +32,7 @@
Editing
: This check runs on the fly in the IDE editor
See
-: http://goo.gle/InsecureDnsSdkLevel
+: https://goo.gle/InsecureDnsSdkLevel
Implementation
: [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/DnsConfigDetector.kt)
Tests
@@ -87,17 +87,17 @@
```
// build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
// build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
// build.gradle.kts with version catalogs:
lintChecks(libs.com.android.security.lint.lint)
# libs.versions.toml
[versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
[libraries]
# For clarity and text wrapping purposes the following declaration is
# shown split up across lines, but in TOML it needs to be on a single
@@ -109,7 +109,7 @@
}
```
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
there may be newer versions available.
[Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).
diff --git a/docs/checks/InsecurePermissionProtectionLevel.md.html b/docs/checks/InsecurePermissionProtectionLevel.md.html
index dc1ece4e..61ad2704 100644
--- a/docs/checks/InsecurePermissionProtectionLevel.md.html
+++ b/docs/checks/InsecurePermissionProtectionLevel.md.html
@@ -32,7 +32,7 @@
Editing
: This check runs on the fly in the IDE editor
See
-: http://goo.gle/InsecurePermissionProtectionLevel
+: https://goo.gle/InsecurePermissionProtectionLevel
Implementation
: [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/PermissionDetector.kt)
Tests
@@ -90,17 +90,17 @@
```
// build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
// build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
// build.gradle.kts with version catalogs:
lintChecks(libs.com.android.security.lint.lint)
# libs.versions.toml
[versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
[libraries]
# For clarity and text wrapping purposes the following declaration is
# shown split up across lines, but in TOML it needs to be on a single
@@ -112,7 +112,7 @@
}
```
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
there may be newer versions available.
[Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).
diff --git a/docs/checks/InsecureStickyBroadcastsMethod.md.html b/docs/checks/InsecureStickyBroadcastsMethod.md.html
new file mode 100644
index 00000000..f55512a4
--- /dev/null
+++ b/docs/checks/InsecureStickyBroadcastsMethod.md.html
@@ -0,0 +1,188 @@
+
+(#) Usage of insecure sticky broadcasts
+
+!!! WARNING: Usage of insecure sticky broadcasts
+ This is a warning.
+
+Id
+: `InsecureStickyBroadcastsMethod`
+Summary
+: Usage of insecure sticky broadcasts
+Severity
+: Warning
+Category
+: Security
+Platform
+: Any
+Vendor
+: Google - Android 3P Vulnerability Research
+Contact
+: https://github.com/google/android-security-lints
+Feedback
+: https://github.com/google/android-security-lints/issues
+Min
+: Lint 4.1
+Compiled
+: Lint 8.0 and 8.1
+Artifact
+: [com.android.security.lint:lint](com_android_security_lint_lint.md.html)
+
+Affects
+: Kotlin and Java files
+Editing
+: This check runs on the fly in the IDE editor
+See
+: https://goo.gle/InsecureStickyBroadcastsMethod
+Implementation
+: [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/StickyBroadcastsDetector.kt)
+Tests
+: [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/test/java/com/example/lint/checks/StickyBroadcastsDetectorTest.kt)
+Copyright Year
+: 2024
+
+Sticky broadcasts can be accessed, sent, or modified by anyone,
+resulting in potential security issues. For this reason, it was
+deprecated in API level 21 and other mechanisms such as databases or
+non-sticky broadcasts should be used instead.
+
+(##) Example
+
+Here is an example of lint warnings produced by this check:
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~text
+src/fake/pkg/MainActivity.java:12:Warning: Sticky broadcasts can be
+accessed, sent or modified by anyone. Use non-sticky broadcasts instead.
+[InsecureStickyBroadcastsMethod]
+ sendStickyOrderedBroadcast();
+ ----------------------------
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Here is the source file referenced above:
+
+`src/fake/pkg/MainActivity.java`:
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~java linenumbers
+package fake.pkg;
+
+import android.app.Activity;
+import android.os.Bundle;
+
+@Suppress("DEPRECATION")
+public class MainActivity extends Activity {
+
+ @Override
+ protected void onCreate(Bundle savedInstanceState) {
+ super.onCreate(savedInstanceState);
+ sendStickyOrderedBroadcast();
+ }
+}
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+You can also visit the
+[source code](https://github.com/google/android-security-lints/tree/main/checks/src/test/java/com/example/lint/checks/StickyBroadcastsDetectorTest.kt)
+for the unit tests for this check to see additional scenarios.
+
+The above example was automatically extracted from the first unit test
+found for this lint check, `StickyBroadcastsDetector.stickyBroadcastMethodCall_showsWarning`.
+To report a problem with this extracted sample, visit
+https://github.com/google/android-security-lints/issues.
+
+(##) Including
+
+!!!
+ This is not a built-in check. To include it, add the below dependency
+ to your project. This lint check is included in the lint documentation,
+ but the Android team may or may not agree with its recommendations.
+
+```
+// build.gradle.kts
+lintChecks("com.android.security.lint:lint:1.0.2")
+
+// build.gradle
+lintChecks 'com.android.security.lint:lint:1.0.2'
+
+// build.gradle.kts with version catalogs:
+lintChecks(libs.com.android.security.lint.lint)
+
+# libs.versions.toml
+[versions]
+com-android-security-lint-lint = "1.0.2"
+[libraries]
+# For clarity and text wrapping purposes the following declaration is
+# shown split up across lines, but in TOML it needs to be on a single
+# line (see https://github.com/toml-lang/toml/issues/516) so adjust
+# when pasting into libs.versions.toml:
+com-android-security-lint-lint = {
+ module = "com.android.security.lint:lint",
+ version.ref = "com-android-security-lint-lint"
+}
+```
+
+1.0.2 is the version this documentation was generated from;
+there may be newer versions available.
+
+[Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).
+(##) Suppressing
+
+You can suppress false positives using one of the following mechanisms:
+
+* Using a suppression annotation like this on the enclosing
+ element:
+
+ ```kt
+ // Kotlin
+ @Suppress("InsecureStickyBroadcastsMethod")
+ fun method() {
+ sendStickyOrderedBroadcast(...)
+ }
+ ```
+
+ or
+
+ ```java
+ // Java
+ @SuppressWarnings("InsecureStickyBroadcastsMethod")
+ void method() {
+ sendStickyOrderedBroadcast(...);
+ }
+ ```
+
+* Using a suppression comment like this on the line above:
+
+ ```kt
+ //noinspection InsecureStickyBroadcastsMethod
+ problematicStatement()
+ ```
+
+* Using a special `lint.xml` file in the source tree which turns off
+ the check in that folder and any sub folder. A simple file might look
+ like this:
+ ```xml
+ <?xml version="1.0" encoding="UTF-8"?>
+ <lint>
+ <issue id="InsecureStickyBroadcastsMethod" severity="ignore" />
+ </lint>
+ ```
+ Instead of `ignore` you can also change the severity here, for
+ example from `error` to `warning`. You can find additional
+ documentation on how to filter issues by path, regular expression and
+ so on
+ [here](https://googlesamples.github.io/android-custom-lint-rules/usage/lintxml.md.html).
+
+* In Gradle projects, using the DSL syntax to configure lint. For
+ example, you can use something like
+ ```gradle
+ lintOptions {
+ disable 'InsecureStickyBroadcastsMethod'
+ }
+ ```
+ In Android projects this should be nested inside an `android { }`
+ block.
+
+* For manual invocations of `lint`, using the `--ignore` flag:
+ ```
+ $ lint --ignore InsecureStickyBroadcastsMethod ...`
+ ```
+
+* Last, but not least, using baselines, as discussed
+ [here](https://googlesamples.github.io/android-custom-lint-rules/usage/baselines.md.html).
+
+
\ No newline at end of file
diff --git a/docs/checks/InsecureStickyBroadcastsPermission.md.html b/docs/checks/InsecureStickyBroadcastsPermission.md.html
new file mode 100644
index 00000000..b69736bc
--- /dev/null
+++ b/docs/checks/InsecureStickyBroadcastsPermission.md.html
@@ -0,0 +1,168 @@
+
+(#) Usage of insecure sticky broadcasts
+
+!!! WARNING: Usage of insecure sticky broadcasts
+ This is a warning.
+
+Id
+: `InsecureStickyBroadcastsPermission`
+Summary
+: Usage of insecure sticky broadcasts
+Severity
+: Warning
+Category
+: Security
+Platform
+: Android
+Vendor
+: Google - Android 3P Vulnerability Research
+Contact
+: https://github.com/google/android-security-lints
+Feedback
+: https://github.com/google/android-security-lints/issues
+Min
+: Lint 4.1
+Compiled
+: Lint 8.0 and 8.1
+Artifact
+: [com.android.security.lint:lint](com_android_security_lint_lint.md.html)
+
+Affects
+: Manifest files
+Editing
+: This check runs on the fly in the IDE editor
+See
+: https://goo.gle/InsecureStickyBroadcastsPermission
+Implementation
+: [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/StickyBroadcastsDetector.kt)
+Tests
+: [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/test/java/com/example/lint/checks/StickyBroadcastsDetectorTest.kt)
+Copyright Year
+: 2024
+
+Sticky broadcasts can be accessed, sent, or modified by anyone,
+resulting in potential security issues. For this reason, it was
+deprecated in API level 21 and other mechanisms such as databases or
+non-sticky broadcasts should be used instead.
+
+(##) Example
+
+Here is an example of lint warnings produced by this check:
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~text
+AndroidManifest.xml:2:Warning: Sticky broadcasts can be accessed, sent
+or modified by anyone. Use non-sticky broadcasts instead.
+[InsecureStickyBroadcastsPermission]
+ <uses-permission android:name="android.permission.BROADCAST_STICKY"/>
+ ---------------------------------------------------------------------
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Here is the source file referenced above:
+
+`AndroidManifest.xml`:
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~xml linenumbers
+<manifest xmlns:android='http://schemas.android.com/apk/res/android' package='test.pkg'>
+ <uses-permission android:name="android.permission.BROADCAST_STICKY"/>
+ <application>
+ <activity android:name='com.example.MainActivity'></activity>
+ </application>
+ </manifest>
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+You can also visit the
+[source code](https://github.com/google/android-security-lints/tree/main/checks/src/test/java/com/example/lint/checks/StickyBroadcastsDetectorTest.kt)
+for the unit tests for this check to see additional scenarios.
+
+The above example was automatically extracted from the first unit test
+found for this lint check, `StickyBroadcastsDetector.stickyBroadcastPermissionInManifest_showsWarning`.
+To report a problem with this extracted sample, visit
+https://github.com/google/android-security-lints/issues.
+
+(##) Including
+
+!!!
+ This is not a built-in check. To include it, add the below dependency
+ to your project. This lint check is included in the lint documentation,
+ but the Android team may or may not agree with its recommendations.
+
+```
+// build.gradle.kts
+lintChecks("com.android.security.lint:lint:1.0.2")
+
+// build.gradle
+lintChecks 'com.android.security.lint:lint:1.0.2'
+
+// build.gradle.kts with version catalogs:
+lintChecks(libs.com.android.security.lint.lint)
+
+# libs.versions.toml
+[versions]
+com-android-security-lint-lint = "1.0.2"
+[libraries]
+# For clarity and text wrapping purposes the following declaration is
+# shown split up across lines, but in TOML it needs to be on a single
+# line (see https://github.com/toml-lang/toml/issues/516) so adjust
+# when pasting into libs.versions.toml:
+com-android-security-lint-lint = {
+ module = "com.android.security.lint:lint",
+ version.ref = "com-android-security-lint-lint"
+}
+```
+
+1.0.2 is the version this documentation was generated from;
+there may be newer versions available.
+
+[Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).
+(##) Suppressing
+
+You can suppress false positives using one of the following mechanisms:
+
+* Adding the suppression attribute
+ `tools:ignore="InsecureStickyBroadcastsPermission"` on the
+ problematic XML element (or one of its enclosing elements). You may
+ also need to add the following namespace declaration on the root
+ element in the XML file if it's not already there:
+ `xmlns:tools="http://schemas.android.com/tools"`.
+
+ ```xml
+ <?xml version="1.0" encoding="UTF-8"?>
+ <manifest xmlns:tools="http://schemas.android.com/tools">
+ ...
+ <uses-permission tools:ignore="InsecureStickyBroadcastsPermission" .../>
+ ...
+ </manifest>
+ ```
+
+* Using a special `lint.xml` file in the source tree which turns off
+ the check in that folder and any sub folder. A simple file might look
+ like this:
+ ```xml
+ <?xml version="1.0" encoding="UTF-8"?>
+ <lint>
+ <issue id="InsecureStickyBroadcastsPermission" severity="ignore" />
+ </lint>
+ ```
+ Instead of `ignore` you can also change the severity here, for
+ example from `error` to `warning`. You can find additional
+ documentation on how to filter issues by path, regular expression and
+ so on
+ [here](https://googlesamples.github.io/android-custom-lint-rules/usage/lintxml.md.html).
+
+* In Gradle projects, using the DSL syntax to configure lint. For
+ example, you can use something like
+ ```gradle
+ lintOptions {
+ disable 'InsecureStickyBroadcastsPermission'
+ }
+ ```
+ In Android projects this should be nested inside an `android { }`
+ block.
+
+* For manual invocations of `lint`, using the `--ignore` flag:
+ ```
+ $ lint --ignore InsecureStickyBroadcastsPermission ...`
+ ```
+
+* Last, but not least, using baselines, as discussed
+ [here](https://googlesamples.github.io/android-custom-lint-rules/usage/baselines.md.html).
+
+
\ No newline at end of file
diff --git a/docs/checks/MissingAutoVerifyAttribute.md.html b/docs/checks/MissingAutoVerifyAttribute.md.html
index 803c0453..76c38ddf 100644
--- a/docs/checks/MissingAutoVerifyAttribute.md.html
+++ b/docs/checks/MissingAutoVerifyAttribute.md.html
@@ -32,7 +32,7 @@
Editing
: This check runs on the fly in the IDE editor
See
-: http://goo.gle/MissingAutoVerifyAttribute
+: https://goo.gle/MissingAutoVerifyAttribute
Implementation
: [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/CustomSchemeDetector.kt)
Tests
@@ -93,17 +93,17 @@
```
// build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
// build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
// build.gradle.kts with version catalogs:
lintChecks(libs.com.android.security.lint.lint)
# libs.versions.toml
[versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
[libraries]
# For clarity and text wrapping purposes the following declaration is
# shown split up across lines, but in TOML it needs to be on a single
@@ -115,7 +115,7 @@
}
```
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
there may be newer versions available.
[Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).
diff --git a/docs/checks/SensitiveExternalPath.md.html b/docs/checks/SensitiveExternalPath.md.html
index cb494504..94324566 100644
--- a/docs/checks/SensitiveExternalPath.md.html
+++ b/docs/checks/SensitiveExternalPath.md.html
@@ -32,7 +32,7 @@
Editing
: This check runs on the fly in the IDE editor
See
-: http://goo.gle/SensitiveExternalPath
+: https://goo.gle/SensitiveExternalPath
Implementation
: [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/MisconfiguredFileProviderDetector.kt)
Tests
@@ -86,17 +86,17 @@
```
// build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
// build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
// build.gradle.kts with version catalogs:
lintChecks(libs.com.android.security.lint.lint)
# libs.versions.toml
[versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
[libraries]
# For clarity and text wrapping purposes the following declaration is
# shown split up across lines, but in TOML it needs to be on a single
@@ -108,7 +108,7 @@
}
```
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
there may be newer versions available.
[Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).
diff --git a/docs/checks/StrandhoggVulnerable.md.html b/docs/checks/StrandhoggVulnerable.md.html
index 2774736e..9baf87d1 100644
--- a/docs/checks/StrandhoggVulnerable.md.html
+++ b/docs/checks/StrandhoggVulnerable.md.html
@@ -32,7 +32,7 @@
Editing
: This check runs on the fly in the IDE editor
See
-: http://goo.gle/StrandhoggVulnerable
+: https://goo.gle/StrandhoggVulnerable
Implementation
: [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/StrandhoggDetector.kt)
Tests
@@ -87,17 +87,17 @@
```
// build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
// build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
// build.gradle.kts with version catalogs:
lintChecks(libs.com.android.security.lint.lint)
# libs.versions.toml
[versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
[libraries]
# For clarity and text wrapping purposes the following declaration is
# shown split up across lines, but in TOML it needs to be on a single
@@ -109,7 +109,7 @@
}
```
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
there may be newer versions available.
[Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).
diff --git a/docs/checks/TapjackingVulnerable.md.html b/docs/checks/TapjackingVulnerable.md.html
index d5bca745..ed16faa0 100644
--- a/docs/checks/TapjackingVulnerable.md.html
+++ b/docs/checks/TapjackingVulnerable.md.html
@@ -32,7 +32,7 @@
Editing
: This check runs on the fly in the IDE editor
See
-: http://goo.gle/TapjackingVulnerable
+: https://goo.gle/TapjackingVulnerable
Implementation
: [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/TapjackingDetector.kt)
Tests
@@ -87,17 +87,17 @@
```
// build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
// build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
// build.gradle.kts with version catalogs:
lintChecks(libs.com.android.security.lint.lint)
# libs.versions.toml
[versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
[libraries]
# For clarity and text wrapping purposes the following declaration is
# shown split up across lines, but in TOML it needs to be on a single
@@ -109,7 +109,7 @@
}
```
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
there may be newer versions available.
[Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).
diff --git a/docs/checks/UnintendedExposedUrl.md.html b/docs/checks/UnintendedExposedUrl.md.html
index c5b8361d..1991916c 100644
--- a/docs/checks/UnintendedExposedUrl.md.html
+++ b/docs/checks/UnintendedExposedUrl.md.html
@@ -32,7 +32,7 @@
Editing
: This check runs on the fly in the IDE editor
See
-: http://goo.gle/UnintendedExposedUrl
+: https://goo.gle/UnintendedExposedUrl
Implementation
: [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/UnintendedExposedUrlDetector.kt)
Tests
@@ -102,17 +102,17 @@
```
// build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
// build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
// build.gradle.kts with version catalogs:
lintChecks(libs.com.android.security.lint.lint)
# libs.versions.toml
[versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
[libraries]
# For clarity and text wrapping purposes the following declaration is
# shown split up across lines, but in TOML it needs to be on a single
@@ -124,7 +124,7 @@
}
```
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
there may be newer versions available.
[Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).
diff --git a/docs/checks/UnintendedPrivateIpAddress.md.html b/docs/checks/UnintendedPrivateIpAddress.md.html
index b32bb3b7..b71d5f3e 100644
--- a/docs/checks/UnintendedPrivateIpAddress.md.html
+++ b/docs/checks/UnintendedPrivateIpAddress.md.html
@@ -32,7 +32,7 @@
Editing
: This check runs on the fly in the IDE editor
See
-: http://goo.gle/UnintendedPrivateIpAddress
+: https://goo.gle/UnintendedPrivateIpAddress
Implementation
: [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/UnintendedExposedUrlDetector.kt)
Tests
@@ -103,17 +103,17 @@
```
// build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
// build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
// build.gradle.kts with version catalogs:
lintChecks(libs.com.android.security.lint.lint)
# libs.versions.toml
[versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
[libraries]
# For clarity and text wrapping purposes the following declaration is
# shown split up across lines, but in TOML it needs to be on a single
@@ -125,7 +125,7 @@
}
```
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
there may be newer versions available.
[Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).
diff --git a/docs/checks/UnsafeCryptoAlgorithmUsage.md.html b/docs/checks/UnsafeCryptoAlgorithmUsage.md.html
index 884b3747..fdd6f8d5 100644
--- a/docs/checks/UnsafeCryptoAlgorithmUsage.md.html
+++ b/docs/checks/UnsafeCryptoAlgorithmUsage.md.html
@@ -32,7 +32,7 @@
Editing
: This check runs on the fly in the IDE editor
See
-: http://goo.gle/UnsafeCryptoAlgorithmUsage
+: https://goo.gle/UnsafeCryptoAlgorithmUsage
Implementation
: [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/BadCryptographyUsageDetector.kt)
Tests
@@ -95,17 +95,17 @@
```
// build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
// build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
// build.gradle.kts with version catalogs:
lintChecks(libs.com.android.security.lint.lint)
# libs.versions.toml
[versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
[libraries]
# For clarity and text wrapping purposes the following declaration is
# shown split up across lines, but in TOML it needs to be on a single
@@ -117,7 +117,7 @@
}
```
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
there may be newer versions available.
[Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).
diff --git a/docs/checks/UnsanitizedFilenameFromContentProvider-2.md.html b/docs/checks/UnsanitizedFilenameFromContentProvider-2.md.html
new file mode 100644
index 00000000..06bc3ce1
--- /dev/null
+++ b/docs/checks/UnsanitizedFilenameFromContentProvider-2.md.html
@@ -0,0 +1,204 @@
+
+(#) Trusting ContentProvider filenames without any sanitization
+
+!!! WARNING: Trusting ContentProvider filenames without any sanitization
+ This is a warning.
+
+Id
+: `UnsanitizedFilenameFromContentProvider`
+Summary
+: Trusting ContentProvider filenames without any sanitization
+Severity
+: Warning
+Category
+: Security
+Platform
+: Android
+Vendor
+: Google - Android 3P Vulnerability Research
+Contact
+: https://github.com/google/android-security-lints
+Feedback
+: https://github.com/google/android-security-lints/issues
+Min
+: Lint 4.1
+Compiled
+: Lint 8.0 and 8.1
+Artifact
+: [com.android.security.lint:lint](com_android_security_lint_lint.md.html)
+
+Affects
+: Kotlin and Java files
+Editing
+: This check runs on the fly in the IDE editor
+See
+: https://goo.gle/UnsanitizedFilenameFromContentProvider
+Implementation
+: [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/UnsafeFilenameDetector.kt)
+Tests
+: [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/test/java/com/example/lint/checks/UnsafeFilenameDetectorTest.kt)
+Copyright Year
+: 2024
+
+When communicating between applications with files, the server app can
+provide the client app with a maliciously constructed filename. The
+client app should never trust this filename and should either sanitize
+it or completely discard it.
+
+(##) Example
+
+Here is an example of lint warnings produced by this check:
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~text
+src/TestClass.java:10:Warning: Using fileName is unsafe as it is a
+filename obtained directly from a ContentProvider. You should sanitize
+it before using it for creating a File.
+[UnsanitizedFilenameFromContentProvider]
+ File fileObject = new File("./", fileName);
+ --------
+src/TestClass.kt:10:Warning: Using fileName is unsafe as it is a
+filename obtained directly from a ContentProvider. You should sanitize
+it before using it for creating a File.
+[UnsanitizedFilenameFromContentProvider]
+ val fileObject = File("./", fileName)
+ --------
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Here are the relevant source files:
+
+`src/TestClass.java`:
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~java linenumbers
+import android.database.Cursor;
+import android.provider.OpenableColumns;
+import java.io.File;
+
+class TestClass {
+ private void trustProvidedFilename_shouldWarn(Cursor cursor) {
+ int id = cursor.getColumnIndex(OpenableColumns.DISPLAY_NAME);
+ String fileName = cursor.getString(id);
+
+ File fileObject = new File("./", fileName);
+ }
+}
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+`src/TestClass.kt`:
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~kotlin linenumbers
+import android.database.Cursor
+import android.provider.OpenableColumns
+import java.io.File
+
+class TestClass {
+ private fun trustProvidedFilename_shouldWarn(cursor: Cursor) {
+ val id = cursor.getColumnIndex(OpenableColumns.DISPLAY_NAME)
+ val fileName = cursor.getString(id)
+
+ val fileObject = File("./", fileName)
+ }
+}
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+You can also visit the
+[source code](https://github.com/google/android-security-lints/tree/main/checks/src/test/java/com/example/lint/checks/UnsafeFilenameDetectorTest.kt)
+for the unit tests for this check to see additional scenarios.
+
+(##) Including
+
+!!!
+ This is not a built-in check. To include it, add the below dependency
+ to your project. This lint check is included in the lint documentation,
+ but the Android team may or may not agree with its recommendations.
+
+```
+// build.gradle.kts
+lintChecks("com.android.security.lint:lint:1.0.2")
+
+// build.gradle
+lintChecks 'com.android.security.lint:lint:1.0.2'
+
+// build.gradle.kts with version catalogs:
+lintChecks(libs.com.android.security.lint.lint)
+
+# libs.versions.toml
+[versions]
+com-android-security-lint-lint = "1.0.2"
+[libraries]
+# For clarity and text wrapping purposes the following declaration is
+# shown split up across lines, but in TOML it needs to be on a single
+# line (see https://github.com/toml-lang/toml/issues/516) so adjust
+# when pasting into libs.versions.toml:
+com-android-security-lint-lint = {
+ module = "com.android.security.lint:lint",
+ version.ref = "com-android-security-lint-lint"
+}
+```
+
+1.0.2 is the version this documentation was generated from;
+there may be newer versions available.
+
+[Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).
+(##) Suppressing
+
+You can suppress false positives using one of the following mechanisms:
+
+* Using a suppression annotation like this on the enclosing
+ element:
+
+ ```kt
+ // Kotlin
+ @Suppress("UnsanitizedFilenameFromContentProvider")
+ fun method() {
+ getColumnIndex(...)
+ }
+ ```
+
+ or
+
+ ```java
+ // Java
+ @SuppressWarnings("UnsanitizedFilenameFromContentProvider")
+ void method() {
+ getColumnIndex(...);
+ }
+ ```
+
+* Using a suppression comment like this on the line above:
+
+ ```kt
+ //noinspection UnsanitizedFilenameFromContentProvider
+ problematicStatement()
+ ```
+
+* Using a special `lint.xml` file in the source tree which turns off
+ the check in that folder and any sub folder. A simple file might look
+ like this:
+ ```xml
+ <?xml version="1.0" encoding="UTF-8"?>
+ <lint>
+ <issue id="UnsanitizedFilenameFromContentProvider" severity="ignore" />
+ </lint>
+ ```
+ Instead of `ignore` you can also change the severity here, for
+ example from `error` to `warning`. You can find additional
+ documentation on how to filter issues by path, regular expression and
+ so on
+ [here](https://googlesamples.github.io/android-custom-lint-rules/usage/lintxml.md.html).
+
+* In Gradle projects, using the DSL syntax to configure lint. For
+ example, you can use something like
+ ```gradle
+ lintOptions {
+ disable 'UnsanitizedFilenameFromContentProvider'
+ }
+ ```
+ In Android projects this should be nested inside an `android { }`
+ block.
+
+* For manual invocations of `lint`, using the `--ignore` flag:
+ ```
+ $ lint --ignore UnsanitizedFilenameFromContentProvider ...`
+ ```
+
+* Last, but not least, using baselines, as discussed
+ [here](https://googlesamples.github.io/android-custom-lint-rules/usage/baselines.md.html).
+
+
\ No newline at end of file
diff --git a/docs/checks/UnsanitizedFilenameFromContentProvider.md.html b/docs/checks/UnsanitizedFilenameFromContentProvider.md.html
index 8b8a5aeb..424eafcb 100644
--- a/docs/checks/UnsanitizedFilenameFromContentProvider.md.html
+++ b/docs/checks/UnsanitizedFilenameFromContentProvider.md.html
@@ -25,9 +25,9 @@
See
: https://developer.android.com/privacy-and-security/risks/untrustworthy-contentprovider-provided-filename
Implementation
-: [Source Code](https://cs.android.com/android-studio/platform/tools/base/+/mirror-goog-studio-main:lint/libs/lint-checks/src/main/java/com/android/tools/lint/checks/UnsafeFilenameDetector.kt)
+: [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/UnsafeFilenameDetector.kt)
Tests
-: [Source Code](https://cs.android.com/android-studio/platform/tools/base/+/mirror-goog-studio-main:lint/libs/lint-tests/src/test/java/com/android/tools/lint/checks/UnsafeFilenameDetectorTest.kt)
+: [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/test/java/com/example/lint/checks/UnsafeFilenameDetectorTest.kt)
Copyright Year
: 2024
@@ -89,7 +89,7 @@
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
You can also visit the
-[source code](https://cs.android.com/android-studio/platform/tools/base/+/mirror-goog-studio-main:lint/libs/lint-tests/src/test/java/com/android/tools/lint/checks/UnsafeFilenameDetectorTest.kt)
+[source code](https://github.com/google/android-security-lints/tree/main/checks/src/test/java/com/example/lint/checks/UnsafeFilenameDetectorTest.kt)
for the unit tests for this check to see additional scenarios.
(##) Suppressing
diff --git a/docs/checks/VulnerableCryptoAlgorithm.md.html b/docs/checks/VulnerableCryptoAlgorithm.md.html
index 358ebac4..54c659ec 100644
--- a/docs/checks/VulnerableCryptoAlgorithm.md.html
+++ b/docs/checks/VulnerableCryptoAlgorithm.md.html
@@ -32,7 +32,7 @@
Editing
: This check runs on the fly in the IDE editor
See
-: http://goo.gle/VulnerableCryptoAlgorithm
+: https://goo.gle/VulnerableCryptoAlgorithm
Implementation
: [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/BadCryptographyUsageDetector.kt)
Tests
@@ -92,17 +92,17 @@
```
// build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
// build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
// build.gradle.kts with version catalogs:
lintChecks(libs.com.android.security.lint.lint)
# libs.versions.toml
[versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
[libraries]
# For clarity and text wrapping purposes the following declaration is
# shown split up across lines, but in TOML it needs to be on a single
@@ -114,7 +114,7 @@
}
```
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
there may be newer versions available.
[Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).
diff --git a/docs/checks/WeakPrng.md.html b/docs/checks/WeakPrng.md.html
index 23d8ccf3..58200940 100644
--- a/docs/checks/WeakPrng.md.html
+++ b/docs/checks/WeakPrng.md.html
@@ -32,7 +32,7 @@
Editing
: This check runs on the fly in the IDE editor
See
-: http://goo.gle/WeakPrng
+: https://goo.gle/WeakPrng
Implementation
: [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/WeakPrngDetector.kt)
Tests
@@ -93,17 +93,17 @@
```
// build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
// build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
// build.gradle.kts with version catalogs:
lintChecks(libs.com.android.security.lint.lint)
# libs.versions.toml
[versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
[libraries]
# For clarity and text wrapping purposes the following declaration is
# shown split up across lines, but in TOML it needs to be on a single
@@ -115,7 +115,7 @@
}
```
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
there may be newer versions available.
[Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).
diff --git a/docs/checks/categories.md.html b/docs/checks/categories.md.html
index 84dba151..9ad1028a 100644
--- a/docs/checks/categories.md.html
+++ b/docs/checks/categories.md.html
@@ -562,7 +562,7 @@
- [PermissionImpliesUnsupportedChromeOsHardware: Permission Implies Unsupported Chrome OS Hardware](PermissionImpliesUnsupportedChromeOsHardware.md.html)
- [UnsupportedChromeOsHardware: Unsupported Chrome OS Hardware Feature](UnsupportedChromeOsHardware.md.html)
-* Security (76)
+* Security (79)
- [AcceptsUserCertificates: Allowing User Certificates](AcceptsUserCertificates.md.html)
- [AddJavascriptInterface: `addJavascriptInterface` Called](AddJavascriptInterface.md.html)
@@ -592,6 +592,8 @@
- [InsecureBaseConfiguration: Insecure Base Configuration](InsecureBaseConfiguration.md.html)
- [InsecureDnsSdkLevel: Application vulnerable to DNS spoofing attacks](InsecureDnsSdkLevel.md.html)
- [InsecurePermissionProtectionLevel: Custom permission created with a normal `protectionLevel`](InsecurePermissionProtectionLevel.md.html)
+ - [InsecureStickyBroadcastsMethod: Usage of insecure sticky broadcasts](InsecureStickyBroadcastsMethod.md.html)
+ - [InsecureStickyBroadcastsPermission: Usage of insecure sticky broadcasts](InsecureStickyBroadcastsPermission.md.html)
- [IntentFilterExportedReceiver: Unspecified `android:exported` in manifest](IntentFilterExportedReceiver.md.html)
- [IntentWithNullActionLaunch: Unsafe intent launched with no action set](IntentWithNullActionLaunch.md.html)
- [InvalidPermission: Invalid Permission Attribute](InvalidPermission.md.html)
@@ -630,6 +632,7 @@
- [UnsafeNativeCodeLocation: Native code outside library directory](UnsafeNativeCodeLocation.md.html)
- [UnsafeProtectedBroadcastReceiver: Unsafe Protected `BroadcastReceiver`](UnsafeProtectedBroadcastReceiver.md.html)
- [UnsanitizedFilenameFromContentProvider: Trusting ContentProvider filenames without any sanitization](UnsanitizedFilenameFromContentProvider.md.html)
+ - [UnsanitizedFilenameFromContentProvider: Trusting ContentProvider filenames without any sanitization](UnsanitizedFilenameFromContentProvider.md.html)
- [UnspecifiedImmutableFlag: Missing `PendingIntent` mutability flag](UnspecifiedImmutableFlag.md.html)
- [UseCheckPermission: Using the result of check permission calls](UseCheckPermission.md.html)
- [UsingC2DM: Using C2DM](UsingC2DM.md.html)
diff --git a/docs/checks/com_android_security_lint_lint.md.html b/docs/checks/com_android_security_lint_lint.md.html
index 264ae65a..3356d93a 100644
--- a/docs/checks/com_android_security_lint_lint.md.html
+++ b/docs/checks/com_android_security_lint_lint.md.html
@@ -13,27 +13,30 @@
Compiled
: Lint 8.0 and 8.1
Artifact
-: com.android.security.lint:lint:1.0.1
+: com.android.security.lint:lint:1.0.2
(##) Included Issues
-|Issue Id |Issue Description |
-|------------------------------------------------------------------------------|---------------------------------------------------------------------------------|
-|[VulnerableCryptoAlgorithm](VulnerableCryptoAlgorithm.md.html) |Application uses vulnerable cryptography algorithms |
-|[UnsafeCryptoAlgorithmUsage](UnsafeCryptoAlgorithmUsage.md.html) |Application uses unsafe cipher modes or paddings with cryptographic algorithms |
-|[MissingAutoVerifyAttribute](MissingAutoVerifyAttribute.md.html) |Application has custom scheme intent filters with missing `autoVerify` attributes|
-|[InsecureDnsSdkLevel](InsecureDnsSdkLevel.md.html) |Application vulnerable to DNS spoofing attacks |
-|[StrandhoggVulnerable](StrandhoggVulnerable.md.html) |Application vulnerable to Strandhogg attacks |
-|[TapjackingVulnerable](TapjackingVulnerable.md.html) |Application's UI is vulnerable to tapjacking attacks |
-|[DefaultCleartextTraffic](DefaultCleartextTraffic.md.html) |Application by default permits cleartext traffic |
-|[DefaultTrustedUserCerts](DefaultTrustedUserCerts.md.html) |Application by default trusts user-added CA certificates |
-|[UnintendedExposedUrl](UnintendedExposedUrl.md.html) |Application may have a debugging or development URL publicly exposed |
-|[UnintendedPrivateIpAddress](UnintendedPrivateIpAddress.md.html) |Application may have a private IP address publicly exposed |
-|[ExposedRootPath](ExposedRootPath.md.html) |Application specifies the device root directory |
-|[SensitiveExternalPath](SensitiveExternalPath.md.html) |Application may expose sensitive info like PII by storing it in external storage |
-|[WeakPrng](WeakPrng.md.html) |Application uses non-cryptographically secure pseudorandom number generators |
-|[DisabledAllSafeBrowsing](DisabledAllSafeBrowsing.md.html) |Application has disabled safe browsing for all WebView objects |
-|[InsecurePermissionProtectionLevel](InsecurePermissionProtectionLevel.md.html)|Custom permission created with a normal `protectionLevel` |
+|Issue Id |Issue Description |
+|------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------|
+|[VulnerableCryptoAlgorithm](VulnerableCryptoAlgorithm.md.html) |Application uses vulnerable cryptography algorithms |
+|[UnsafeCryptoAlgorithmUsage](UnsafeCryptoAlgorithmUsage.md.html) |Application uses unsafe cipher modes or paddings with cryptographic algorithms |
+|[MissingAutoVerifyAttribute](MissingAutoVerifyAttribute.md.html) |Application has custom scheme intent filters with missing `autoVerify` attributes|
+|[InsecureDnsSdkLevel](InsecureDnsSdkLevel.md.html) |Application vulnerable to DNS spoofing attacks |
+|[StrandhoggVulnerable](StrandhoggVulnerable.md.html) |Application vulnerable to Strandhogg attacks |
+|[TapjackingVulnerable](TapjackingVulnerable.md.html) |Application's UI is vulnerable to tapjacking attacks |
+|[DefaultCleartextTraffic](DefaultCleartextTraffic.md.html) |Application by default permits cleartext traffic |
+|[DefaultTrustedUserCerts](DefaultTrustedUserCerts.md.html) |Application by default trusts user-added CA certificates |
+|[UnintendedExposedUrl](UnintendedExposedUrl.md.html) |Application may have a debugging or development URL publicly exposed |
+|[UnintendedPrivateIpAddress](UnintendedPrivateIpAddress.md.html) |Application may have a private IP address publicly exposed |
+|[ExposedRootPath](ExposedRootPath.md.html) |Application specifies the device root directory |
+|[SensitiveExternalPath](SensitiveExternalPath.md.html) |Application may expose sensitive info like PII by storing it in external storage |
+|[WeakPrng](WeakPrng.md.html) |Application uses non-cryptographically secure pseudorandom number generators |
+|[DisabledAllSafeBrowsing](DisabledAllSafeBrowsing.md.html) |Application has disabled safe browsing for all WebView objects |
+|[InsecurePermissionProtectionLevel](InsecurePermissionProtectionLevel.md.html) |Custom permission created with a normal `protectionLevel` |
+|[UnsanitizedFilenameFromContentProvider](UnsanitizedFilenameFromContentProvider-2.md.html)|Trusting ContentProvider filenames without any sanitization |
+|[InsecureStickyBroadcastsMethod](InsecureStickyBroadcastsMethod.md.html) |Usage of insecure sticky broadcasts |
+|[InsecureStickyBroadcastsPermission](InsecureStickyBroadcastsPermission.md.html) |Usage of insecure sticky broadcasts |
(##) Including
@@ -44,17 +47,17 @@
```
// build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
// build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
// build.gradle.kts with version catalogs:
lintChecks(libs.com.android.security.lint.lint)
# libs.versions.toml
[versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
[libraries]
# For clarity and text wrapping purposes the following declaration is
# shown split up across lines, but in TOML it needs to be on a single
@@ -66,7 +69,7 @@
}
```
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
there may be newer versions available.
(##) Changes
@@ -78,6 +81,9 @@
StrandhoggVulnerable, TapjackingVulnerable, UnintendedExposedUrl,
UnintendedPrivateIpAddress, UnsafeCryptoAlgorithmUsage,
VulnerableCryptoAlgorithm, WeakPrng.
+* 1.0.2: Adds InsecureStickyBroadcastsMethod,
+ InsecureStickyBroadcastsPermission,
+ UnsanitizedFilenameFromContentProvider.
(##) Version Compatibility
@@ -85,6 +91,7 @@
| Version | Date | Issues | Compatible | Compiled | Requires |
|-------------------:|----------|-------:|------------|--------------:|---------:|
+| 1.0.2| | 18| Yes| 8.0 and 8.1|8.0 and 8.1|
| 1.0.1| | 15| Yes| 8.0 and 8.1|8.0 and 8.1|
\ No newline at end of file
diff --git a/docs/checks/index.md.html b/docs/checks/index.md.html
index 023dc8d5..4efdd02a 100644
--- a/docs/checks/index.md.html
+++ b/docs/checks/index.md.html
@@ -268,6 +268,8 @@
- [InsecureBaseConfiguration: Insecure Base Configuration](InsecureBaseConfiguration.md.html)
- [InsecureDnsSdkLevel: Application vulnerable to DNS spoofing attacks](InsecureDnsSdkLevel.md.html)
- [InsecurePermissionProtectionLevel: Custom permission created with a normal `protectionLevel`](InsecurePermissionProtectionLevel.md.html)
+ - [InsecureStickyBroadcastsMethod: Usage of insecure sticky broadcasts](InsecureStickyBroadcastsMethod.md.html)
+ - [InsecureStickyBroadcastsPermission: Usage of insecure sticky broadcasts](InsecureStickyBroadcastsPermission.md.html)
- [InstantApps: Instant App Issues](InstantApps.md.html)
- [Instantiatable: Registered class is not instantiatable](Instantiatable.md.html)
- [IntentFilterExportedReceiver: Unspecified `android:exported` in manifest](IntentFilterExportedReceiver.md.html)
@@ -675,6 +677,7 @@
- [UnsafeProtectedBroadcastReceiver: Unsafe Protected `BroadcastReceiver`](UnsafeProtectedBroadcastReceiver.md.html)
- [UnsafeRepeatOnLifecycleDetector: RepeatOnLifecycle should be used with viewLifecycleOwner in Fragments](UnsafeRepeatOnLifecycleDetector.md.html)
- [UnsanitizedFilenameFromContentProvider: Trusting ContentProvider filenames without any sanitization](UnsanitizedFilenameFromContentProvider.md.html)
+ - [UnsanitizedFilenameFromContentProvider: Trusting ContentProvider filenames without any sanitization](UnsanitizedFilenameFromContentProvider.md.html) (from com.android.security.lint:lint:1.0.2)
- [UnspecifiedImmutableFlag: Missing `PendingIntent` mutability flag](UnspecifiedImmutableFlag.md.html)
- [UnspecifiedRegisterReceiverFlag: Missing `registerReceiver()` exported flag](UnspecifiedRegisterReceiverFlag.md.html)
- [UnsupportedChromeOsCameraSystemFeature: Looking for Rear Camera only feature](UnsupportedChromeOsCameraSystemFeature.md.html)
diff --git a/docs/checks/libraries.md.html b/docs/checks/libraries.md.html
index 9b025faa..124ae266 100644
--- a/docs/checks/libraries.md.html
+++ b/docs/checks/libraries.md.html
@@ -6,7 +6,7 @@
Lint-specific libraries:
* [androidx.lint:lint-gradle](androidx_lint_lint-gradle.md.html) (6 checks)
-* [com.android.security.lint:lint](com_android_security_lint_lint.md.html) (15 checks)
+* [com.android.security.lint:lint](com_android_security_lint_lint.md.html) (18 checks)
* [com.uber.autodispose2:autodispose-lint](com_uber_autodispose2_autodispose-lint.md.html) (1 checks)
* [com.google.dagger:dagger-lint](com_google_dagger_dagger-lint.md.html) (4 checks)
* [com.vanniktech:lint-rules-rxjava2](com_vanniktech_lint-rules-rxjava2.md.html) (7 checks)
diff --git a/docs/checks/severity.md.html b/docs/checks/severity.md.html
index 5c9aaadf..3e8b5d9d 100644
--- a/docs/checks/severity.md.html
+++ b/docs/checks/severity.md.html
@@ -368,7 +368,7 @@
- [WrongViewCast: Mismatched view type](WrongViewCast.md.html)
- [XmlEscapeNeeded: Missing XML Escape](XmlEscapeNeeded.md.html)
-* Warning (419)
+* Warning (422)
- [AcceptsUserCertificates: Allowing User Certificates](AcceptsUserCertificates.md.html)
- [AccessibilityFocus: Forcing accessibility focus](AccessibilityFocus.md.html)
@@ -521,6 +521,8 @@
- [InsecureBaseConfiguration: Insecure Base Configuration](InsecureBaseConfiguration.md.html)
- [InsecureDnsSdkLevel: Application vulnerable to DNS spoofing attacks](InsecureDnsSdkLevel.md.html)
- [InsecurePermissionProtectionLevel: Custom permission created with a normal `protectionLevel`](InsecurePermissionProtectionLevel.md.html)
+ - [InsecureStickyBroadcastsMethod: Usage of insecure sticky broadcasts](InsecureStickyBroadcastsMethod.md.html)
+ - [InsecureStickyBroadcastsPermission: Usage of insecure sticky broadcasts](InsecureStickyBroadcastsPermission.md.html)
- [InstantApps: Instant App Issues](InstantApps.md.html)
- [IntentFilterExportedReceiver: Unspecified `android:exported` in manifest](IntentFilterExportedReceiver.md.html)
- [IntentFilterUniqueDataAttributes: Data tags should only declare unique attributes](IntentFilterUniqueDataAttributes.md.html)
@@ -726,6 +728,7 @@
- [UnsafeOptInUsageWarning: Unsafe opt-in usage intended to be warning-level severity](UnsafeOptInUsageWarning.md.html)
- [UnsafeProtectedBroadcastReceiver: Unsafe Protected `BroadcastReceiver`](UnsafeProtectedBroadcastReceiver.md.html)
- [UnsanitizedFilenameFromContentProvider: Trusting ContentProvider filenames without any sanitization](UnsanitizedFilenameFromContentProvider.md.html)
+ - [UnsanitizedFilenameFromContentProvider: Trusting ContentProvider filenames without any sanitization](UnsanitizedFilenameFromContentProvider.md.html)
- [UnsupportedChromeOsCameraSystemFeature: Looking for Rear Camera only feature](UnsupportedChromeOsCameraSystemFeature.md.html)
- [Untranslatable: Translated Untranslatable](Untranslatable.md.html)
- [UnusedAttribute: Attribute unused on older versions](UnusedAttribute.md.html)
diff --git a/docs/checks/vendors.md.html b/docs/checks/vendors.md.html
index 81729696..c7af9b8a 100644
--- a/docs/checks/vendors.md.html
+++ b/docs/checks/vendors.md.html
@@ -609,7 +609,7 @@
- [ModuleCompanionObjects: Module companion objects should not be annotated with @Module](ModuleCompanionObjects.md.html)
- [ModuleCompanionObjectsNotInModuleParent: Companion objects should not be annotated with @Module](ModuleCompanionObjectsNotInModuleParent.md.html)
-* Google - Android 3P Vulnerability Research (15)
+* Google - Android 3P Vulnerability Research (18)
- [DefaultCleartextTraffic: Application by default permits cleartext traffic](DefaultCleartextTraffic.md.html)
- [DefaultTrustedUserCerts: Application by default trusts user-added CA certificates](DefaultTrustedUserCerts.md.html)
@@ -617,6 +617,8 @@
- [ExposedRootPath: Application specifies the device root directory](ExposedRootPath.md.html)
- [InsecureDnsSdkLevel: Application vulnerable to DNS spoofing attacks](InsecureDnsSdkLevel.md.html)
- [InsecurePermissionProtectionLevel: Custom permission created with a normal `protectionLevel`](InsecurePermissionProtectionLevel.md.html)
+ - [InsecureStickyBroadcastsMethod: Usage of insecure sticky broadcasts](InsecureStickyBroadcastsMethod.md.html)
+ - [InsecureStickyBroadcastsPermission: Usage of insecure sticky broadcasts](InsecureStickyBroadcastsPermission.md.html)
- [MissingAutoVerifyAttribute: Application has custom scheme intent filters with missing `autoVerify` attributes](MissingAutoVerifyAttribute.md.html)
- [SensitiveExternalPath: Application may expose sensitive info like PII by storing it in external storage](SensitiveExternalPath.md.html)
- [StrandhoggVulnerable: Application vulnerable to Strandhogg attacks](StrandhoggVulnerable.md.html)
@@ -624,6 +626,7 @@
- [UnintendedExposedUrl: Application may have a debugging or development URL publicly exposed](UnintendedExposedUrl.md.html)
- [UnintendedPrivateIpAddress: Application may have a private IP address publicly exposed](UnintendedPrivateIpAddress.md.html)
- [UnsafeCryptoAlgorithmUsage: Application uses unsafe cipher modes or paddings with cryptographic algorithms](UnsafeCryptoAlgorithmUsage.md.html)
+ - [UnsanitizedFilenameFromContentProvider: Trusting ContentProvider filenames without any sanitization](UnsanitizedFilenameFromContentProvider.md.html)
- [VulnerableCryptoAlgorithm: Application uses vulnerable cryptography algorithms](VulnerableCryptoAlgorithm.md.html)
- [WeakPrng: Application uses non-cryptographically secure pseudorandom number generators](WeakPrng.md.html)
diff --git a/docs/checks/year.md.html b/docs/checks/year.md.html
index 18b94ad2..fe894a51 100644
--- a/docs/checks/year.md.html
+++ b/docs/checks/year.md.html
@@ -3,7 +3,7 @@
Order: [Alphabetical](index.md.html) | [By category](categories.md.html) | [By vendor](vendors.md.html) | [By severity](severity.md.html) | By year | [Libraries](libraries.md.html)
-* 2024 (37)
+* 2024 (40)
- [AccessibilityFocus: Forcing accessibility focus](AccessibilityFocus.md.html)
- [AccessibilityScrollActions: Incomplete Scroll Action support](AccessibilityScrollActions.md.html)
@@ -19,6 +19,8 @@
- [GradleProjectIsolation: Avoid using APIs that are not project isolation safe](GradleProjectIsolation.md.html)
- [InsecureDnsSdkLevel: Application vulnerable to DNS spoofing attacks](InsecureDnsSdkLevel.md.html)
- [InsecurePermissionProtectionLevel: Custom permission created with a normal `protectionLevel`](InsecurePermissionProtectionLevel.md.html)
+ - [InsecureStickyBroadcastsMethod: Usage of insecure sticky broadcasts](InsecureStickyBroadcastsMethod.md.html)
+ - [InsecureStickyBroadcastsPermission: Usage of insecure sticky broadcasts](InsecureStickyBroadcastsPermission.md.html)
- [InternalAgpApiUsage: Avoid using internal Android Gradle Plugin APIs](InternalAgpApiUsage.md.html)
- [InternalGradleApiUsage: Avoid using internal Gradle APIs](InternalGradleApiUsage.md.html)
- [InvalidLanguageTagDelimiter: Underscore (`_`) is an unsupported delimiter for subtags](InvalidLanguageTagDelimiter.md.html)
@@ -34,6 +36,7 @@
- [UnclosedTrace: Incorrect trace section usage](UnclosedTrace.md.html)
- [UnnecessaryRequiredFeature: Potentially unnecessary required feature](UnnecessaryRequiredFeature.md.html)
- [UnsanitizedFilenameFromContentProvider: Trusting ContentProvider filenames without any sanitization](UnsanitizedFilenameFromContentProvider.md.html)
+ - [UnsanitizedFilenameFromContentProvider: Trusting ContentProvider filenames without any sanitization](UnsanitizedFilenameFromContentProvider.md.html)
- [UnusedSharedTransitionModifierParameter: SharedTransitionScope calls should use the provided Modifier parameter](UnusedSharedTransitionModifierParameter.md.html)
- [ViewModelConstructorInComposable: Constructing a view model in a composable](ViewModelConstructorInComposable.md.html)
- [WithPluginClasspathUsage: Flags usage of GradleRunner#withPluginClasspath](WithPluginClasspathUsage.md.html)