Skip to content

MASWE-0050: Unsafe Handling of Untrusted Data

MAS Requirement

The app securely handles untrusted data.

Mappings

MASVS V1: MSTG-PLATFORM-2

MASVS V2: MASVS-CODE-4

CWE: CWE-20: Improper Input Validation, CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-73: External Control of File Name or Path, CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE-116: Improper Encoding or Escaping of Output, CWE-345: Insufficient Verification of Data Authenticity, CWE-348: Use of Less Trusted Source, CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data, CWE-502: Deserialization of Untrusted Data, CWE-611: Improper Restriction of XML External Entity Reference, CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Android Risks: path-traversal, zip-path-traversal, sql-injection, unsafe-deserialization, xml-external-entities-injection, untrustworthy-contentprovider-provided-filename, use-of-native-code

Overview

This weakness occurs when data originating outside the app's trust boundary reaches a sensitive sink without being validated, sanitized, or safely parsed.

Untrusted data is any data the app did not create itself, regardless of how it arrives: network responses (even over TLS), data restored from backups, external interfaces such as Bluetooth, NFC, and USB, local files (including document pickers and archives), user interface input (text fields, QR codes, URLs, the clipboard), and the platform's IPC (e.g., for Android, received intents, broadcasts, content URIs, or deep links).

When the untrusted data reaches a dangerous sink that has not been validated or sanitized, it cause unintended behavior of the application by exploiting vulnerabilities like SQL injection, path traversal (including variants like ZIP path traversal), XML external entity (XXE) injection, insecure object deserialization, output-encoding flaws, or memory corruption in native parsers, or misleading presentation of security-relevant information.

Modes of Introduction

  • Missing Validation at Trust Boundaries: Consuming untrusted data from the network, backups, external interfaces, files, UI, or platform IPC without validating type, length, format, and range before use.
  • Untrusted Data in Queries: Concatenating untrusted input into queries like SQL queries instead of using parameterized APIs.
  • Untrusted Paths and Archives: Using externally supplied file names or paths (e.g. from ZIP entries) without canonicalization and containment checks.
  • Insecure Parsing: Parsing untrusted XML with external entities enabled, or emitting untrusted data without proper output encoding.
  • Insecure Deserialization: Deserializing untrusted data into rich object types (e.g. Serializable, Parcelable, NSCoding, XML/JSON object mappers) without restricting the allowed types.
  • Weakly Validated URI Handling: Relying on URI parsing classes that apply little to no validation of untrusted input when making security decisions.
  • Unsafe Presentation of Untrusted Data: Displaying untrusted data in notifications, warnings, confirmation dialogs, or other security-sensitive interfaces without constraining its length or formatting.

Impact

  • Compromise of Sensitive Data: Attackers can extract or overwrite private files and database contents through path traversal, SQL injection, or XXE, resulting in unauthorized disclosure or modification of user and app data.
  • Execution of Unauthorized Code: Attackers can exploit insecure deserialization or memory corruption in parsers, resulting in attacker-controlled code running in the app's context.
  • Authentication or Authorization Bypass: Attackers can manipulate queries or logic through injected input, resulting in access to data or functionality beyond what the caller is authorized for.
  • Compromise of Content or UI Integrity: Attackers can obscure, alter, or impersonate trusted application content in interfaces or notifications, resulting in users approving unintended actions or ignoring legitimate security alerts.
  • Application Content Spoofing: Attackers can obscure, alter, or impersonate trusted application content in interfaces or notifications, resulting in users approving unintended actions or ignoring legitimate security alerts.

Mitigations

  • Validate at Every Trust Boundary: Treat all externally originated data as untrusted and validate it against strict expectations before use.
  • Use Parameterized Queries: Access databases exclusively through parameterized or prepared statements. Do not build queries by concatenating untrusted input.
  • Canonicalize and Contain Paths: Canonicalize externally supplied file names and paths and verify they resolve inside the intended directory before any file operation.
  • Harden Parsers: Disable external entity resolution for XML, apply correct output encoding for the destination context, and prefer hardened platform parsers.
  • Deserialize Safely: Avoid deserializing untrusted data into rich object graphs; prefer simple data formats and safe APIs with explicit type allow-lists.
  • Distinguish Untrusted Data From Application-Generated Content: Distinguish externally-provided values from trusted application content, especially in notifications and security-sensitive interfaces. Apply context-appropriate length, line, and formatting restrictions so untrusted data cannot obscure or alter the apparent meaning of the information presented.

Knowledge

MASTG-KNOW-0075: Object Serialization MASTG-KNOW-0025: Explicit vs Implicit Intents MASTG-KNOW-0138: URI Schemes in Android Intent Results MASTG-KNOW-0021: Object Serialization MASTG-KNOW-0117: Android ContentProvider

Tests

MASTG-TEST-0386: References to Object Deserialization of Untrusted Data MASTG-TEST-0375: Missing Validation of Data Returned from Implicit Intents MASTG-TEST-0337: References to Object Deserialization of Untrusted Data MASTG-TEST-0339: SQL Injection in Content Providers

Best Practices

MASTG-BEST-0064: Use Safe APIs for Object Deserialization MASTG-BEST-0057: Sanitize Data Coming from External Components MASTG-BEST-0039: Prevent SQL Injection in ContentProviders