Skip to content

MASTG-DEMO-0033: Dangerous Permissions in the AndroidManifest with semgrep

Download MASTG-DEMO-0033 APK Open MASTG-DEMO-0033 Folder Build MASTG-DEMO-0033 APK

Sample

The following is a sample AndroidManifest file that declares 4 dangerous permissions.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:tools="http://schemas.android.com/tools">

    <uses-permission android:name="android.permission.INTERNET" />
    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
    <uses-permission android:name="android.permission.READ_CONTACTS" />
    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" />
    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />

    <application
        android:allowBackup="true"
        android:dataExtractionRules="@xml/data_extraction_rules"
        android:fullBackupContent="@xml/backup_rules"
        android:icon="@mipmap/ic_launcher"
        android:label="@string/app_name"
        android:roundIcon="@mipmap/ic_launcher_round"
        android:supportsRtl="true"
        android:theme="@style/Theme.MASTestApp"
        tools:targetApi="31">
        <activity
            android:name=".MainActivity"
            android:exported="true"
            android:theme="@style/Theme.MASTestApp">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />

                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>
    </application>

</manifest>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
<?xml version="1.0" encoding="utf-8" standalone="no"?><manifest xmlns:android="http://schemas.android.com/apk/res/android" android:compileSdkVersion="34" android:compileSdkVersionCodename="14" package="org.owasp.mastestapp" platformBuildVersionCode="34" platformBuildVersionName="14">
    <uses-permission android:name="android.permission.INTERNET"/>
    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
    <uses-permission android:name="android.permission.READ_CONTACTS"/>
    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE"/>
    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/>
    <permission android:name="org.owasp.mastestapp.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION" android:protectionLevel="signature"/>
    <uses-permission android:name="org.owasp.mastestapp.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION"/>
    <application android:allowBackup="true" android:appComponentFactory="androidx.core.app.CoreComponentFactory" android:dataExtractionRules="@xml/data_extraction_rules" android:debuggable="true" android:extractNativeLibs="false" android:fullBackupContent="@xml/backup_rules" android:icon="@mipmap/ic_launcher" android:label="@string/app_name" android:roundIcon="@mipmap/ic_launcher_round" android:supportsRtl="true" android:theme="@style/Theme.MASTestApp">
        <activity android:exported="true" android:name="org.owasp.mastestapp.MainActivity" android:theme="@style/Theme.MASTestApp">
            <intent-filter>
                <action android:name="android.intent.action.MAIN"/>
                <category android:name="android.intent.category.LAUNCHER"/>
            </intent-filter>
        </activity>
        <activity android:exported="true" android:name="androidx.compose.ui.tooling.PreviewActivity"/>
        <activity android:exported="true" android:name="androidx.activity.ComponentActivity"/>
        <provider android:authorities="org.owasp.mastestapp.androidx-startup" android:exported="false" android:name="androidx.startup.InitializationProvider">
            <meta-data android:name="androidx.emoji2.text.EmojiCompatInitializer" android:value="androidx.startup"/>
            <meta-data android:name="androidx.lifecycle.ProcessLifecycleInitializer" android:value="androidx.startup"/>
            <meta-data android:name="androidx.profileinstaller.ProfileInstallerInitializer" android:value="androidx.startup"/>
        </provider>
        <receiver android:directBootAware="false" android:enabled="true" android:exported="true" android:name="androidx.profileinstaller.ProfileInstallReceiver" android:permission="android.permission.DUMP">
            <intent-filter>
                <action android:name="androidx.profileinstaller.action.INSTALL_PROFILE"/>
            </intent-filter>
            <intent-filter>
                <action android:name="androidx.profileinstaller.action.SKIP_FILE"/>
            </intent-filter>
            <intent-filter>
                <action android:name="androidx.profileinstaller.action.SAVE_PROFILE"/>
            </intent-filter>
            <intent-filter>
                <action android:name="androidx.profileinstaller.action.BENCHMARK_OPERATION"/>
            </intent-filter>
        </receiver>
    </application>
</manifest>

Steps

Let's run our semgrep rule against the sample manifest file.

../../../../rules/mastg-android-dangerous-app-permissions.yaml
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
rules:
  - id: detect-dangerous-android-permissions
    languages:
      - xml
    message: "Dangerous Android permission found:"
    severity: WARNING
    pattern-either:
      - pattern: <uses-permission android:name="android.permission.READ_CONTACTS"/>
      - pattern: <uses-permission android:name="android.permission.WRITE_CONTACTS"/>
      - pattern: <uses-permission android:name="android.permission.READ_CALENDAR"/>
      - pattern: <uses-permission android:name="android.permission.WRITE_CALENDAR"/>
      - pattern: <uses-permission android:name="android.permission.SEND_SMS"/>
      - pattern: <uses-permission android:name="android.permission.RECEIVE_SMS"/>
      - pattern: <uses-permission android:name="android.permission.READ_SMS"/>
      - pattern: <uses-permission android:name="android.permission.RECEIVE_WAP_PUSH"/>
      - pattern: <uses-permission android:name="android.permission.RECEIVE_MMS"/>
      - pattern: <uses-permission
          android:name="android.permission.READ_CELL_BROADCASTS"/>
      - pattern: <uses-permission
          android:name="android.permission.READ_EXTERNAL_STORAGE"/>
      - pattern: <uses-permission android:name="android.permission.READ_MEDIA_AUDIO"/>
      - pattern: <uses-permission android:name="android.permission.READ_MEDIA_VIDEO"/>
      - pattern: <uses-permission android:name="android.permission.READ_MEDIA_IMAGES"/>
      - pattern: <uses-permission
          android:name="android.permission.READ_MEDIA_VISUAL_USER_SELECTED"/>
      - pattern: <uses-permission
          android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
      - pattern: <uses-permission
          android:name="android.permission.ACCESS_MEDIA_LOCATION"/>
      - pattern: <uses-permission
          android:name="android.permission.ACCESS_FINE_LOCATION"/>
      - pattern: <uses-permission
          android:name="android.permission.ACCESS_COARSE_LOCATION"/>
      - pattern: <uses-permission
          android:name="android.permission.ACCESS_BACKGROUND_LOCATION"/>
      - pattern: <uses-permission android:name="android.permission.READ_CALL_LOG"/>
      - pattern: <uses-permission android:name="android.permission.WRITE_CALL_LOG"/>
      - pattern: <uses-permission
          android:name="android.permission.PROCESS_OUTGOING_CALLS"/>
      - pattern: <uses-permission android:name="android.permission.READ_PHONE_STATE"/>
      - pattern: <uses-permission android:name="android.permission.READ_PHONE_NUMBERS"/>
      - pattern: <uses-permission android:name="android.permission.CALL_PHONE"/>
      - pattern: <uses-permission
          android:name="com.android.voicemail.permission.ADD_VOICEMAIL"/>
      - pattern: <uses-permission android:name="android.permission.USE_SIP"/>
      - pattern: <uses-permission android:name="android.permission.ANSWER_PHONE_CALLS"/>
      - pattern: <uses-permission android:name="android.permission.ACCEPT_HANDOVER"/>
      - pattern: <uses-permission android:name="android.permission.RECORD_AUDIO"/>
      - pattern: <uses-permission
          android:name="android.permission.ACTIVITY_RECOGNITION"/>
      - pattern: <uses-permission android:name="android.permission.CAMERA"/>
      - pattern: <uses-permission android:name="android.permission.BODY_SENSORS"/>
      - pattern: <uses-permission
          android:name="android.permission.BODY_SENSORS_BACKGROUND"/>
      - pattern: <uses-permission android:name="android.permission.POST_NOTIFICATIONS"/>
      - pattern: <uses-permission android:name="android.permission.BLUETOOTH_SCAN"/>
      - pattern: <uses-permission android:name="android.permission.BLUETOOTH_CONNECT"/>
      - pattern: <uses-permission
          android:name="android.permission.BLUETOOTH_ADVERTISE"/>
      - pattern: <uses-permission android:name="android.permission.UWB_RANGING"/>
      - pattern: <uses-permission
          android:name="android.permission.NEARBY_WIFI_DEVICES"/>
      - pattern: <uses-permission android:name="android.permission.RANGING"/>
      - pattern: <uses-permission android:name="android.permission.GET_ACCOUNTS"/>
run.sh
1
NO_COLOR=true semgrep -c ../../../../rules/mastg-android-dangerous-app-permissions.yaml ./AndroidManifest_reversed.xml > output.txt

Observation

The rule has identified four instances in the AndroidManifest file where the app declares dangerous permissions.

output.txt
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
┌─────────────────┐
│ 4 Code Findings │
└─────────────────┘

    AndroidManifest_reversed.xml
    ❯❱ rules.detect-dangerous-android-permissions
          Dangerous Android permission found:

            3┆ <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
            ⋮┆----------------------------------------
            4┆ <uses-permission android:name="android.permission.READ_CONTACTS"/>
            ⋮┆----------------------------------------
            5┆ <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE"/>
            ⋮┆----------------------------------------
            6┆ <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/>

Evaluation

The test fails because the app declares the following dangerous permissions:

  • WRITE_EXTERNAL_STORAGE
  • READ_CONTACTS
  • READ_EXTERNAL_STORAGE
  • ACCESS_FINE_LOCATION