Determining Whether the Keyboard Cache Is Disabled for Text Input Fields
Overview¶
Static Analysis¶
In the layout definition of an activity, you can define TextViews that have XML attributes. If the XML attribute android:inputType is given the value textNoSuggestions, the keyboard cache will not be shown when the input field is selected. The user will have to type everything manually.
<EditText
android:id="@+id/KeyBoardCache"
android:inputType="textNoSuggestions" />
The code for all input fields that take sensitive information should include this XML attribute to disable the keyboard suggestions.
Alternatively, the developer can use the following constants:
XML android:inputType |
Code InputType |
API level |
|---|---|---|
textPassword |
TYPE_TEXT_VARIATION_PASSWORD |
3 |
textVisiblePassword |
TYPE_TEXT_VARIATION_VISIBLE_PASSWORD |
3 |
numberPassword |
TYPE_NUMBER_VARIATION_PASSWORD |
11 |
textWebPassword |
TYPE_TEXT_VARIATION_WEB_PASSWORD |
11 |
Check the application code to verify that none of the input types are being overwritten. For example, by doing findViewById(R.id.KeyBoardCache).setInputType(InputType.TYPE_CLASS_TEXT) the input type of the input field KeyBoardCache is set to text reenabling the keyboard cache.
Finally, check the minimum required SDK version in the Android Manifest (android:minSdkVersion) since it must support the used constants (for example, Android SDK version 11 is required for textWebPassword). Otherwise, the compiled app would not honor the used input type constants allowing keyboard caching.
Dynamic Analysis¶
Start the app and click in the input fields that take sensitive data. If strings are suggested, the keyboard cache has not been disabled for these fields.