安全分析报告： Photo Lab v3.12.85

安全分数


安全分数 46/100

风险评级


等级

  1. A
  2. B
  3. C
  4. F

严重性分布 (%)


隐私风险

14

用户/设备跟踪器


调研结果

高危 6
中危 40
信息 3
安全 2
关注 1

高危 域配置不安全地配置为允许明文流量到达范围内的这些域。 

Scope:
pho.to
photolab.me
photo-cdn.net
127.0.0.1
34.231.225.61

高危 如果一个应用程序使用WebView.loadDataWithBaseURL方法来加载一个网页到WebView，那么这个应用程序可能会遭受跨站脚本攻击 

如果一个应用程序使用WebView.loadDataWithBaseURL方法来加载一个网页到WebView，那么这个应用程序可能会遭受跨站脚本攻击
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#static-analysis-7

Files:
com/applovin/impl/adview/b.java, line(s) 519,13
com/applovin/impl/sdk/e/t.java, line(s) 107,4
com/vicman/photolab/domain/model/web/WebPageData.java, line(s) 47,3

高危 应用程序使用带PKCS5/PKCS7填充的加密模式CBC。此配置容易受到填充oracle攻击。 

应用程序使用带PKCS5/PKCS7填充的加密模式CBC。此配置容易受到填充oracle攻击。
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
com/vicman/photolab/inapp/LazyAESObfuscator.java, line(s) 30,34

高危 该文件是World Writable。任何应用程序都可以写入文件 

该文件是World Writable。任何应用程序都可以写入文件
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#testing-local-storage-for-sensitive-data-mstg-storage-1-and-mstg-storage-2

Files:
com/vicman/camera/CameraFragment.java, line(s) 398
com/vicman/photolab/models/config/Settings.java, line(s) 2229

高危 已启用远程WebView调试 

已启用远程WebView调试
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04c-Tampering-and-Reverse-Engineering.md#debugging-and-tracing

Files:
com/applovin/impl/adview/d.java, line(s) 131,10

高危 应用程序包含隐私跟踪程序 

此应用程序有多个14隐私跟踪程序。跟踪器可以跟踪设备或用户，是终端用户的隐私问题。

中危 应用程序已启用明文网络流量 

[android:usesCleartextTraffic=true]
应用程序打算使用明文网络流量，例如明文HTTP，FTP协议，DownloadManager和MediaPlayer。针对API级别27或更低的应用程序，默认值为“true”。针对API级别28或更高的应用程序，默认值为“false”。避免使用明文流量的主要原因是缺乏机密性，真实性和防篡改保护；网络攻击者可以窃听传输的数据，并且可以在不被检测到的情况下修改它。

中危 应用程序数据可以被备份 

[android:allowBackup=true]
这个标志允许任何人通过adb备份你的应用程序数据。它允许已经启用了USB调试的用户从设备上复制应用程序数据。

中危 Content Provider (com.vicman.photolab.wastickers.provider.WAWhatsAppStickerContentProvider) 未被保护。 

[android:exported=true]
发现 Content Provider与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

中危 Broadcast Receiver (com.appsflyer.MultipleInstallBroadcastReceiver) 未被保护。 

[android:exported=true]
发现 Broadcast Receiver与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

中危 Activity设置了TaskAffinity属性 

(com.vicman.photolab.activities.deeplink.DeepLinksActivity)
如果设置了 taskAffinity，其他应用程序可能会读取发送到属于另一个任务的 Activity 的 Intent。为了防止其他应用程序读取发送或接收的 Intent 中的敏感信息，请始终使用默认设置，将 affinity 保持为包名

中危 Activity (com.vicman.photolab.activities.deeplink.DeepLinksActivity) 未被保护。 

[android:exported=true]
发现 Activity与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

中危 Activity-Alias (com.vicman.photolab.activities.DeepLinksCustomSchemeAlias) 未被保护。 

[android:exported=true]
发现 Activity-Alias与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

中危 Activity-Alias (com.vicman.photolab.activities.DeepLinksHttpsAlias) 未被保护。 

[android:exported=true]
发现 Activity-Alias与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

中危 Activity设置了TaskAffinity属性 

(com.vicman.photolab.activities.ExternalAppEntryPointActivity)
如果设置了 taskAffinity，其他应用程序可能会读取发送到属于另一个任务的 Activity 的 Intent。为了防止其他应用程序读取发送或接收的 Intent 中的敏感信息，请始终使用默认设置，将 affinity 保持为包名

中危 Activity (com.vicman.photolab.activities.ExternalAppEntryPointActivity) 未被保护。 

[android:exported=true]
发现 Activity与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

中危 Service (com.vicman.photolab.services.OnTerminateAppService) 未被保护。 

[android:exported=true]
发现 Service与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

中危 Service (com.vicman.photolab.services.SendAnalyticsEventsService) 未被保护。 

[android:exported=true]
发现 Service与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

中危 Activity (com.vicman.photolab.activities.ShortcutActivity) 未被保护。 

[android:exported=true]
发现 Activity与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

中危 Broadcast Receiver (com.google.android.gms.analytics.CampaignTrackingReceiver) 受权限保护, 但是应该检查权限的保护级别。 

Permission: android.permission.INSTALL_PACKAGES [android:exported=true]
发现一个 Broadcast Receiver被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

中危 Content Provider (com.facebook.FacebookContentProvider) 未被保护。 

[android:exported=true]
发现 Content Provider与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

中危 Service (com.vicman.photolab.services.MyFcmListenerService) 未被保护。 

[android:exported=true]
发现 Service与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

中危 Activity设置了TaskAffinity属性 

(com.vicman.sdkeyboard.activities.SdKeyboardActivity)
如果设置了 taskAffinity，其他应用程序可能会读取发送到属于另一个任务的 Activity 的 Intent。为了防止其他应用程序读取发送或接收的 Intent 中的敏感信息，请始终使用默认设置，将 affinity 保持为包名

中危 Activity设置了TaskAffinity属性 

(com.vicman.sdkeyboard.activities.SdKeyboardPhotoChooserActivity)
如果设置了 taskAffinity，其他应用程序可能会读取发送到属于另一个任务的 Activity 的 Intent。为了防止其他应用程序读取发送或接收的 Intent 中的敏感信息，请始终使用默认设置，将 affinity 保持为包名

中危 Activity设置了TaskAffinity属性 

(com.vicman.sdkeyboard.activities.SdKeyboardBannerActivity)
如果设置了 taskAffinity，其他应用程序可能会读取发送到属于另一个任务的 Activity 的 Intent。为了防止其他应用程序读取发送或接收的 Intent 中的敏感信息，请始终使用默认设置，将 affinity 保持为包名

中危 Activity设置了TaskAffinity属性 

(com.vicman.photolab.sdkeyboard.activities.KbdSettingsHelpActivity)
如果设置了 taskAffinity，其他应用程序可能会读取发送到属于另一个任务的 Activity 的 Intent。为了防止其他应用程序读取发送或接收的 Intent 中的敏感信息，请始终使用默认设置，将 affinity 保持为包名

中危 Activity设置了TaskAffinity属性 

(com.vicman.photolab.sdkeyboard.activities.SdKbdMessengerHowToUseActivity)
如果设置了 taskAffinity，其他应用程序可能会读取发送到属于另一个任务的 Activity 的 Intent。为了防止其他应用程序读取发送或接收的 Intent 中的敏感信息，请始终使用默认设置，将 affinity 保持为包名

中危 Activity设置了TaskAffinity属性 

(com.vicman.photolab.sdkeyboard.activities.tutorial.SdKbdTutorialActivity)
如果设置了 taskAffinity，其他应用程序可能会读取发送到属于另一个任务的 Activity 的 Intent。为了防止其他应用程序读取发送或接收的 Intent 中的敏感信息，请始终使用默认设置，将 affinity 保持为包名

中危 Service (com.vicman.photolab.sdkeyboard.SdKbdIme) 受权限保护, 但是应该检查权限的保护级别。 

Permission: android.permission.BIND_INPUT_METHOD [android:exported=true]
发现一个 Service被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

中危 Service (androidx.work.impl.background.systemjob.SystemJobService) 受权限保护, 但是应该检查权限的保护级别。 

Permission: android.permission.BIND_JOB_SERVICE [android:exported=true]
发现一个 Service被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

中危 Broadcast Receiver (androidx.work.impl.diagnostics.DiagnosticsReceiver) 受权限保护, 但是应该检查权限的保护级别。 

Permission: android.permission.DUMP [android:exported=true]
发现一个 Broadcast Receiver被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

中危 Broadcast Receiver (com.google.firebase.iid.FirebaseInstanceIdReceiver) 受权限保护, 但是应该检查权限的保护级别。 

Permission: com.google.android.c2dm.permission.SEND [android:exported=true]
发现一个 Broadcast Receiver被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

中危 Activity (com.facebook.CustomTabActivity) 未被保护。 

[android:exported=true]
发现 Activity与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

中危 Service (com.google.android.gms.auth.api.signin.RevocationBoundService) 受权限保护, 但是应该检查权限的保护级别。 

Permission: com.google.android.gms.auth.api.signin.permission.REVOCATION_NOTIFICATION [android:exported=true]
发现一个 Service被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

中危 Service (com.google.android.play.core.assetpacks.AssetPackExtractionService) 未被保护。 

[android:exported=true]
发现 Service与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

中危 Broadcast Receiver (androidx.profileinstaller.ProfileInstallReceiver) 受权限保护, 但是应该检查权限的保护级别。 

Permission: android.permission.DUMP [android:exported=true]
发现一个 Broadcast Receiver被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

中危 应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据 

应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#external-storage

Files:
com/apm/insight/entity/d.java, line(s) 20
com/apm/insight/l/w.java, line(s) 53,64,95
com/apm/insight/nativecrash/c.java, line(s) 448
com/pgl/ssdk/ces/d.java, line(s) 359
com/vicman/photolab/sdkeyboard/activities/selfies/SelfiesChooser$photoChooseLauncher$2$1$localUri$1.java, line(s) 59
com/vicman/stickers/utils/UriHelper.java, line(s) 29
com/vicman/stickers/utils/UtilsCommon.java, line(s) 165
com/vungle/warren/persistence/CacheManager.java, line(s) 133,135
com/vungle/warren/persistence/Repository.java, line(s) 92,93
com/vungle/warren/utility/platform/AndroidPlatform.java, line(s) 213

中危 SHA-1是已知存在哈希冲突的弱哈希 

SHA-1是已知存在哈希冲突的弱哈希
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
com/applovin/impl/sdk/utils/StringUtils.java, line(s) 36
com/applovin/impl/sdk/utils/r.java, line(s) 368
com/pgl/ssdk/ces/d.java, line(s) 207
com/vicman/photo/opeapi/OpeApi.java, line(s) 132
com/vicman/photolab/inapp/Security.java, line(s) 25

中危 应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库 

应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04h-Testing-Code-Quality.md#injection-flaws-mstg-arch-2-and-mstg-platform-2

Files:
b/a/a/a/a/a/b/c/m/d.java, line(s) 4,5,14,20,21,23,25
b/b/a/a/i/a/j/g/d.java, line(s) 5,6,22
com/apm/insight/e/b/a.java, line(s) 4,39
com/apm/insight/e/b/b.java, line(s) 4,44,45,38
com/bykv/vk/openvk/preload/geckox/a/b.java, line(s) 6,7,59
com/danikula/videocache/sourcestorage/DatabaseSourceInfoStorage.java, line(s) 6,7,71
com/vicman/photolab/db/DbHelper.java, line(s) 6,7,373,391,530,593
com/vicman/photolab/db/DbImpl.java, line(s) 6,7,258,259,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,387,388,396,398,399,401,402,404,406,408,410,413,416,417,419,420,421,422,423,425,428,440,441,444,445,446,447,448,449,450,451,452,453
com/vicman/photolab/fragments/FxSearchFragment$search$1.java, line(s) 5,207,250
com/vicman/photolab/livedata/RecentLiveData.java, line(s) 6,65
com/vicman/photolab/loaders/RecentSummaryLoader.java, line(s) 4,47
com/vicman/stickers/data/AbsDbImpl.java, line(s) 4,5,44
com/vicman/stickers/data/DbStickers.java, line(s) 4,15,16,17,37,38
com/vicman/stickers/data/StickerCollectionSource.java, line(s) 5,72
com/vungle/warren/persistence/DatabaseHelper.java, line(s) 9,10,98
com/vungle/warren/persistence/Repository.java, line(s) 8,113,114,115,116,117,118,119,120,121,125,126,127,128,129,130,131,132,133

中危 可能存在跨域漏洞。在 WebView 中启用从 URL 访问文件可能会泄漏文件系统中的敏感信息 

可能存在跨域漏洞。在 WebView 中启用从 URL 访问文件可能会泄漏文件系统中的敏感信息
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#static-analysis-6

Files:
com/steelkiwi/instagramhelper/InstagramLoginActivity.java, line(s) 322,321
com/vicman/photolab/utils/Utils.java, line(s) 338,339
com/vungle/warren/ui/view/WebSettingsUtils.java, line(s) 16,12

中危 文件可能包含硬编码的敏感信息，如用户名、密码、密钥等 

文件可能包含硬编码的敏感信息，如用户名、密码、密钥等
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#checking-memory-for-sensitive-data-mstg-storage-10

Files:
b/a/a/a/a/a/b/c/i.java, line(s) 33
com/applovin/impl/mediation/b/a/a.java, line(s) 38
com/applovin/impl/sdk/o.java, line(s) 1098
com/applovin/mediation/AppLovinUtils.java, line(s) 23
com/applovin/mediation/ads/MaxAdView.java, line(s) 131,121
com/applovin/mediation/ads/MaxAppOpenAd.java, line(s) 62,52
com/applovin/mediation/ads/MaxInterstitialAd.java, line(s) 72,62
com/applovin/mediation/ads/MaxRewardedAd.java, line(s) 90,80
com/applovin/mediation/ads/MaxRewardedInterstitialAd.java, line(s) 67,57
com/applovin/mediation/nativeAds/MaxNativeAdLoader.java, line(s) 73,68
com/applovin/sdk/AppLovinSdk.java, line(s) 185
com/applovin/sdk/AppLovinSdkSettings.java, line(s) 153
com/applovin/sdk/AppLovinWebViewActivity.java, line(s) 25
com/vicman/photolab/client/UserToken.java, line(s) 14

中危 应用程序使用不安全的随机数生成器 

应用程序使用不安全的随机数生成器
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-random-number-generators

Files:
com/apm/insight/i.java, line(s) 10
com/applovin/exoplayer2/h/z.java, line(s) 4
com/applovin/impl/c/m.java, line(s) 17
com/vicman/photolab/db/DbHelper.java, line(s) 39
com/vicman/photolab/draw/TransitionGenerator.java, line(s) 18
com/vicman/photolab/fragments/EasterEggDialogFragment.java, line(s) 65
com/vicman/photolab/fragments/WebTabFragment.java, line(s) 121
com/vicman/photolab/models/config/Feeds.java, line(s) 26
com/vicman/photolab/models/config/Settings.java, line(s) 66
com/vicman/photolab/models/config/WebCombo.java, line(s) 15
com/vicman/photolab/services/RemoteRecentCheckerService.java, line(s) 26
com/vicman/photolab/utils/glide/GlideUtils.java, line(s) 42

中危 IP地址泄露 

IP地址泄露


Files:
com/applovin/mediation/BuildConfig.java, line(s) 4
com/applovin/mediation/adapters/NimbusMediationAdapter.java, line(s) 31
com/danikula/videocache/HttpProxyCacheServer.java, line(s) 141,233
com/danikula/videocache/IgnoreHostProxySelector.java, line(s) 20
com/danikula/videocache/Pinger.java, line(s) 19

中危 MD5是已知存在哈希冲突的弱哈希 

MD5是已知存在哈希冲突的弱哈希
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
b/a/a/a/a/a/a/i/b.java, line(s) 19
b/b/a/a/h/x/k/c.java, line(s) 13
com/apm/insight/l/v.java, line(s) 141
com/bykv/vk/openvk/preload/geckox/utils/g.java, line(s) 16
com/danikula/videocache/file/Md5FileNameGenerator.java, line(s) 15
com/vicman/photolab/utils/Utils.java, line(s) 971
com/vicman/stickers/utils/ETagHelper.java, line(s) 13

中危 Firebase远程配置已启用 

Firebase远程配置URL （ https://firebaseremoteconfig.googleapis.com/v1/projects/1006591364179/namespaces/firebase:fetch?key=AIzaSyDpKAgDJPTmxqczO1viLq5DuwhREH-RT9o ） 已启用。请确保这些配置不包含敏感信息。响应内容如下所示：

{
    "entries": {
        "allow_skip_auth": "false",
        "auth_enabled": "true",
        "category_banner_position": "3",
        "petrusev_test_param": "{\"key1\": \"valA\", \"key2\": \"valB\"}"
    },
    "state": "UPDATE",
    "templateVersion": "10"
}

中危 此应用可能包含硬编码机密信息 

从应用程序中识别出以下机密确保这些不是机密或私人信息
AdMob广告平台的=> "com.google.android.gms.ads.APPLICATION_ID" : "ca-app-pub-8698123149353813~1861764684"
"com.google.firebase.crashlytics.mapping_file_id" : "f41fc8915eaf4f4db0ea680557ff9e30"
"facebook_app_id" : "202248336556242"
"facebook_client_token" : "4dd35da85e14cf4336286c041ae40b8a"
"firebase_database_url" : "https://admob-app-id-1861764684.firebaseio.com"
"google_api_key" : "AIzaSyDpKAgDJPTmxqczO1viLq5DuwhREH-RT9o"
"google_app_id" : "1:1006591364179:android:36998c9b2e8832e0"
"google_crash_reporting_api_key" : "AIzaSyDpKAgDJPTmxqczO1viLq5DuwhREH-RT9o"
"sd_kbd_keyboard_send" : "Send"
"sd_kbd_keyboard_send" : "Send"
"sd_kbd_keyboard_send" : "Send"
"sd_kbd_keyboard_send" : "Send"
"sd_kbd_keyboard_send" : "Send"
cca47107bfcbdb211d88f3385aeede40
HSrCHRtOan6wp2kwOIGJC1RDtuSrF2mWVbio2aBcMHX9KF3iTJ1lLSzCKP1ZSo5yNolPNw1kCTtWpxELFF4ah1
3BAF59A2E5331C30675FAB35FF5FFF0D116142D3D4664F1C3CB804068B40614F
2764cf67-6ed7-4baf-a034-9a6641710832
28B01C6D1469C83328E22C633D36
df6b721c8b4d3b6eb44c861d4415007e5a35fc95
5e10e69cbfa5dc01ab44405b53776d53
D21AB35BC5BEC7C6BC48797E33E3
FFE391E0EA186D0734ED601E4E70E3224B7309D48E2075BAC46D8C667EAE7212
9b8f518b086098de3d77736f9458a3d2f6f95a37
2438bce1ddb7bd026d5ff89f598b3b5e5bb824b3
856ba0c8ddbf06d305db2f632db73344
0123456789qwertyuiopasdfghjklzxcvbnm
DBD06DA7E94FA483EA50C7163E0C
c56fb7d591ba6704df047fd98f535372fea00211
cc2751449a350f668590264ed76692694a80308a
cf23853c15e37d51b1c7e54644be735d
a4b7452e2ed8f5f191058ca7bbfd26b0d3214bfc
439BFE970F1C105B945400217CC9
8a3c4b262d721acd49a4bf97d5213199c86fa2b9
4A2BE320EC200086EFB2C0C90D40
FBA3AF4E7757D9016E953FB3EE4671CA2BD9AF725F9A53D52ED4A38EAAA08901
E3F9E1E0CF99D0E56A055BA65E241B3399F7CEA524326B0CDD6EC1327ED0FDC1
35F742B780489230278A4E2C27AA

信息 应用程序记录日志信息,不得记录敏感信息 

应用程序记录日志信息,不得记录敏感信息
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#logs

Files:
b/a/a/a/a/a/a/i/c.java, line(s) 48,54,66,60
b/a/a/a/a/a/b/c/d.java, line(s) 370,135,154,229,279,296,343,392,109,403,428,434,440
b/a/a/a/a/a/b/c/e.java, line(s) 59,106
b/a/a/a/a/a/b/c/g.java, line(s) 118,124,133,147,152,165,145,178
b/a/a/a/a/a/b/d/a.java, line(s) 238,248,255,261,269,363,370,162,194,227,322,343
b/b/a/a/b.java, line(s) 376,369,383,397
b/b/a/a/d/e/b/a.java, line(s) 99
b/b/a/a/e/a.java, line(s) 96,115,121,122
b/b/a/a/e/g.java, line(s) 118
b/b/a/a/e/i.java, line(s) 18,19,12
b/b/a/a/h/w/a.java, line(s) 63,73,91,102
b/b/a/a/h/x/c.java, line(s) 170
b/b/a/a/h/x/i/d/a.java, line(s) 231
b/b/a/a/h/x/i/d/b.java, line(s) 21,50,55,76,101,135,157,199
b/b/a/a/i/a/l/c.java, line(s) 47,63,79,95,111
b/b/a/a/j/f/b.java, line(s) 42
b/b/a/a/j/f/e.java, line(s) 21
b/b/a/a/k/d.java, line(s) 172,186,189,173
com/apm/insight/b/j.java, line(s) 49
com/apm/insight/h/a.java, line(s) 73
com/apm/insight/k/k.java, line(s) 135
com/apm/insight/l/q.java, line(s) 38,44,50,8,32,20,26
com/apm/insight/runtime/o.java, line(s) 163
com/applovin/exoplayer2/l/q.java, line(s) 31,19,25
com/applovin/impl/sdk/a/f.java, line(s) 81,87,93
com/applovin/impl/sdk/y.java, line(s) 23,80,27,90,31,54
com/appsflyer/AFLogger.java, line(s) 55,70,79,90
com/appsflyer/internal/AFa1cSDK.java, line(s) 571,575,589,614,892,893,911,912
com/appsflyer/internal/AFb1kSDK.java, line(s) 89,94
com/appsflyer/internal/AFc1iSDK.java, line(s) 531
com/appsflyer/internal/AFd1aSDK.java, line(s) 76,84,115,148,150
com/appsflyer/internal/AFd1bSDK.java, line(s) 25
com/appsflyer/internal/AFd1dSDK.java, line(s) 77
com/appsflyer/internal/AFd1fSDK.java, line(s) 97,94,281,93
com/appsflyer/internal/AFd1kSDK.java, line(s) 35
com/appsflyer/internal/AFe1dSDK.java, line(s) 676,678
com/appsflyer/internal/AFe1pSDK.java, line(s) 153
com/appsflyer/internal/AFe1qSDK.java, line(s) 44
com/appsflyer/internal/AFe1rSDK.java, line(s) 44,52
com/appsflyer/internal/AFe1ySDK.java, line(s) 51
com/appsflyer/internal/AFe1zSDK.java, line(s) 39
com/appsflyer/internal/AFf1ySDK.java, line(s) 73,82
com/appsflyer/internal/AFg1jSDK.java, line(s) 48,149,155,171,49,150,158,188,194
com/bykv/vk/openvk/component/video/api/renderview/SSRenderTextureView.java, line(s) 46
com/bykv/vk/openvk/preload/falconx/a/a.java, line(s) 24
com/bykv/vk/openvk/preload/geckox/h/a.java, line(s) 19,24
com/iab/omid/library/applovin/utils/d.java, line(s) 18,11
com/iab/omid/library/bytedance2/utils/d.java, line(s) 18,11
com/iab/omid/library/vungle/b/e.java, line(s) 16
com/iab/omid/library/vungle/d/c.java, line(s) 13
com/vicman/analytics/vmanalytics/AnalyticsLimitPolicy.java, line(s) 22
com/vicman/analytics/vmanalytics/VMAnalyticProvider.java, line(s) 278,358
com/vicman/camera/CameraFragment.java, line(s) 338,478
com/vicman/camera/activities/CameraPhotoChooserActivity.java, line(s) 323,339
com/vicman/photo/opeapi/ImageProcessModel.java, line(s) 73
com/vicman/photolab/PhotoLab.java, line(s) 49,101
com/vicman/photolab/activities/AboutActivity.java, line(s) 76
com/vicman/photolab/activities/BaseActivity.java, line(s) 228
com/vicman/photolab/activities/BlockedVersionActivity.java, line(s) 46
com/vicman/photolab/activities/ConstructorActivity.java, line(s) 877
com/vicman/photolab/activities/EditMaskActivity.java, line(s) 353
com/vicman/photolab/activities/MainActivity.java, line(s) 494,522,530,507
com/vicman/photolab/activities/NewPhotoChooserActivity.java, line(s) 946,1092
com/vicman/photolab/activities/PortraitCameraActivity.java, line(s) 122
com/vicman/photolab/activities/PostprocessingActivity.java, line(s) 784
com/vicman/photolab/activities/ShareActivity.java, line(s) 607
com/vicman/photolab/activities/SimilarResultActivity.java, line(s) 116
com/vicman/photolab/activities/WebPhotoChooserActivity.java, line(s) 173,183,244
com/vicman/photolab/activities/WebShareActivity.java, line(s) 105
com/vicman/photolab/activities/deeplink/DeepLinkProcessor.java, line(s) 126,172,185,187,234
com/vicman/photolab/activities/deeplink/DeepLinksActivity.java, line(s) 174
com/vicman/photolab/activities/web_banner/WebBannerActivity.java, line(s) 182,184,610
com/vicman/photolab/ads/Ad.java, line(s) 171,239
com/vicman/photolab/ads/AdPreloadManager.java, line(s) 200,206,210,226,329,335,494,517,554,570,813,824
com/vicman/photolab/ads/appopen/AppOpenAdPrefetcher.java, line(s) 112,138
com/vicman/photolab/ads/cells/AdMobUtils.java, line(s) 256
com/vicman/photolab/ads/rect/FbNativeRectAd.java, line(s) 97,121,125
com/vicman/photolab/ads/webutils/AdWebViewClient.java, line(s) 49
com/vicman/photolab/client/CompositionAPI.java, line(s) 525,533
com/vicman/photolab/controls/recycler/FixStaggeredGridLayoutManager.java, line(s) 27,22
com/vicman/photolab/controls/recycler/FullSpanGridSpacingItemDecoration.java, line(s) 107,116
com/vicman/photolab/data/local/PlacementLocalLoader.java, line(s) 43
com/vicman/photolab/data/network/PlacementLoader.java, line(s) 136,144,134
com/vicman/photolab/db/ComboStorage.java, line(s) 82
com/vicman/photolab/db/DbHelper.java, line(s) 347
com/vicman/photolab/db/DbImpl.java, line(s) 171,288,125,382
com/vicman/photolab/db/HistorySource$Companion$putAsync$1.java, line(s) 65
com/vicman/photolab/db/RecentImageSource.java, line(s) 110,184
com/vicman/photolab/doll/DollViewModel.java, line(s) 194
com/vicman/photolab/draw/DrawSaveTask.java, line(s) 64
com/vicman/photolab/draw/ResultDrawActivity.java, line(s) 78
com/vicman/photolab/draw/ResultDrawFragment.java, line(s) 503,511
com/vicman/photolab/draw/ShareDrawTransitionActivity.java, line(s) 188,203,250
com/vicman/photolab/draw/ShareDrawTransitionFragment.java, line(s) 305,314
com/vicman/photolab/events/UploaderError.java, line(s) 9
com/vicman/photolab/fragments/AbsContentListFragment.java, line(s) 297,277
com/vicman/photolab/fragments/CompositionLoginFragment.java, line(s) 136,140,149,154,163,205,212,224,248
com/vicman/photolab/fragments/CropNRotateFragment.java, line(s) 158,234,478,348
com/vicman/photolab/fragments/DeleteUserDialogFragment$performDelete$1$onResponse$1.java, line(s) 57,61
com/vicman/photolab/fragments/EasterEggDialogFragment.java, line(s) 498,500,508,518,526,530,558,561,564,567,570,573,576,579,582,585,588,591,594,597,604,610,614,618,621
com/vicman/photolab/fragments/EditMaskFragment.java, line(s) 416
com/vicman/photolab/fragments/FeedFragment.java, line(s) 1021
com/vicman/photolab/fragments/HighLoadWebBannerFragment.java, line(s) 258
com/vicman/photolab/fragments/MainTabsFragment.java, line(s) 157
com/vicman/photolab/fragments/NeuroPortraitPreviewFragment.java, line(s) 106
com/vicman/photolab/fragments/PhotoChooserImageFragment.java, line(s) 273
com/vicman/photolab/fragments/PhotoChooserPagerFragment.java, line(s) 762,784,817,748
com/vicman/photolab/fragments/PhotoChooserWebFragment.java, line(s) 417,424
com/vicman/photolab/fragments/PhotoChooserWebTutorialDialogFragment.java, line(s) 219
com/vicman/photolab/fragments/PostprocessingProgressFragment.java, line(s) 98
com/vicman/photolab/fragments/ProCompositionWatchVideoDialogFragment.java, line(s) 48
com/vicman/photolab/fragments/PromoFragment.java, line(s) 131
com/vicman/photolab/fragments/RateUsDialogFragment.java, line(s) 66,78
com/vicman/photolab/fragments/ResultWebProcessingFragment.java, line(s) 230,727,817,928
com/vicman/photolab/fragments/ShareFragment.java, line(s) 591
com/vicman/photolab/fragments/SimilarFragment.java, line(s) 81
com/vicman/photolab/fragments/VideoChooserFragment.java, line(s) 261,281,296,201,207,245
com/vicman/photolab/fragments/WaitCacheNUploadDialogFragment.java, line(s) 176
com/vicman/photolab/fragments/WebTabFragment.java, line(s) 373,985,367
com/vicman/photolab/fragments/l.java, line(s) 99,110
com/vicman/photolab/fragments/n.java, line(s) 64
com/vicman/photolab/fragments/o.java, line(s) 254,257
com/vicman/photolab/fragments/result_progress/ResultProgressFragment.java, line(s) 364,493,497,509,743
com/vicman/photolab/inapp/BillingWrapper.java, line(s) 610,676,865,912,924,936,159,379,781,842
com/vicman/photolab/inapp/PreferenceObfuscator.java, line(s) 28
com/vicman/photolab/inapp/Security.java, line(s) 17,31,34,37,40,44,50
com/vicman/photolab/livedata/HistoryLiveData.java, line(s) 85
com/vicman/photolab/livedata/MediaAlbumsLiveData.java, line(s) 142
com/vicman/photolab/livedata/SingleLiveEvent.java, line(s) 24
com/vicman/photolab/loaders/FeedLoader.java, line(s) 219,222,241,246
com/vicman/photolab/models/Banner.java, line(s) 276,288,327
com/vicman/photolab/models/ConstructorModel.java, line(s) 154,148,151
com/vicman/photolab/models/OriginalToResultMatrix.java, line(s) 299,348
com/vicman/photolab/models/Rules.java, line(s) 86
com/vicman/photolab/models/TemplateModel.java, line(s) 265
com/vicman/photolab/models/config/EffectListProps.java, line(s) 42
com/vicman/photolab/models/config/Settings.java, line(s) 333,337,1103,1108
com/vicman/photolab/models/neuroport/NeuroLayoutsViewModel.java, line(s) 175,209
com/vicman/photolab/notifications/LocalNotificationHelper.java, line(s) 210,214,100,114,139,153,182,191,197,241,258,262
com/vicman/photolab/notifications/LocalNotificationPreview.java, line(s) 93
com/vicman/photolab/sdkeyboard/fragments/KbdPhotoDescriptorsFragment.java, line(s) 133,422,485
com/vicman/photolab/sdvideo/SdVideoShareActivity.java, line(s) 202,217,242
com/vicman/photolab/services/CacheAndUpload.java, line(s) 412,424,160,359
com/vicman/photolab/services/CacheRecentCheckerService.java, line(s) 96,168
com/vicman/photolab/services/LoadCloudMessagingAttachmentWorker.java, line(s) 88
com/vicman/photolab/services/OpeProcessor$processAsync$1.java, line(s) 105
com/vicman/photolab/services/OpeProcessor.java, line(s) 265
com/vicman/photolab/services/RemoteRecentCheckerService.java, line(s) 79
com/vicman/photolab/services/Share.java, line(s) 235,191,196,199
com/vicman/photolab/services/ShareCacheCleanerService.java, line(s) 58
com/vicman/photolab/services/download/Downloader$startDownload$ready$1.java, line(s) 93
com/vicman/photolab/sync/CheckNewConfigService.java, line(s) 57
com/vicman/photolab/utils/AdHelper.java, line(s) 72,121,126,131
com/vicman/photolab/utils/AppVersionChecker.java, line(s) 60
com/vicman/photolab/utils/AsyncPhotoChooseProcessor.java, line(s) 56,51,53
com/vicman/photolab/utils/ErrorHandler.java, line(s) 46,52,109
com/vicman/photolab/utils/ErrorLocalization.java, line(s) 90
com/vicman/photolab/utils/GDPRChecker.java, line(s) 105,140,336,78,119,130
com/vicman/photolab/utils/Utils.java, line(s) 292,1073
com/vicman/photolab/utils/VideoAdsClient.java, line(s) 157
com/vicman/photolab/utils/analytics/AnalyticsDeviceInfo.java, line(s) 204
com/vicman/photolab/utils/analytics/AnalyticsEvent.java, line(s) 1286,1338,1564
com/vicman/photolab/utils/analytics/AnalyticsWrapper.java, line(s) 137,141,183
com/vicman/photolab/utils/analytics/AppsFlyerHelper.java, line(s) 78,68,72
com/vicman/photolab/utils/analytics/a.java, line(s) 44
com/vicman/photolab/utils/face/DetectorFit.java, line(s) 23,33,48,24,34,49,50,51,54
com/vicman/photolab/utils/face/FaceFinderWorker.java, line(s) 145
com/vicman/photolab/utils/glide/GlideUtils.java, line(s) 253
com/vicman/photolab/utils/share/ShareActivityHelper.java, line(s) 147
com/vicman/photolab/utils/video/VideoPlayerFactory$DelegateEventsListener.java, line(s) 33
com/vicman/photolab/utils/web/LoggingWebChromeClient.java, line(s) 65,69,73,79
com/vicman/photolab/utils/web/PhotoPackChecker$innerCheckPhotoPack$checkResult$1.java, line(s) 64
com/vicman/photolab/utils/web/WebActionCallback.java, line(s) 65
com/vicman/photolab/utils/web/WebActionUriParser.java, line(s) 36
com/vicman/photolab/utils/web/WebComboBuilderUtils.java, line(s) 90,95
com/vicman/photolab/utils/web/client/BaseWebViewClient.java, line(s) 92
com/vicman/photolab/utils/web/js/DefaultJsInterface.java, line(s) 1225,82
com/vicman/photolab/utils/web/js/JsPriceSetter.java, line(s) 35
com/vicman/photolab/utils/web/processors/CelebChallengeEventProcessor.java, line(s) 40
com/vicman/photolab/utils/web/processors/DollEventProcessor.java, line(s) 42
com/vicman/photolab/utils/web/processors/NativeAnalyticsEventProcessor.java, line(s) 39
com/vicman/photolab/utils/web/processors/OnBackPressedProcessor.java, line(s) 173
com/vicman/photolab/wastickers/SNDStickerSender$send$1$jpgUri$1.java, line(s) 87
com/vicman/photolab/wastickers/SNDStickersManager.java, line(s) 76,96,92
com/vicman/photolab/wastickers/activities/WAExportActivity.java, line(s) 168,214,294
com/vicman/photolab/wastickers/provider/WAWhatsAppStickerContentProvider.java, line(s) 46
com/vicman/photolab/workers/DumpUserPhotosWorker.java, line(s) 287
com/vicman/stickers/activity/SticksCollection.java, line(s) 421,101,150
com/vicman/stickers/controls/StickersImageView.java, line(s) 925,1023,1001
com/vicman/stickers/controls/TextStickerDrawable.java, line(s) 528
com/vicman/stickers/controls/WatermarkStickerDrawable.java, line(s) 352
com/vicman/stickers/data/AbsDbImpl.java, line(s) 47,52
com/vicman/stickers/data/DbStickers.java, line(s) 45
com/vicman/stickers/editor/PlusEditor.java, line(s) 184,144
com/vicman/stickers/gif/EncodeAndMux.java, line(s) 157,181
com/vicman/stickers/gif/GifToMp4Converter.java, line(s) 39
com/vicman/stickers/models/TargetSizeStrategy.java, line(s) 77
com/vicman/stickers/path/SVGPathParser.java, line(s) 372
com/vicman/stickers/service/ResultProcessorService.java, line(s) 233,200
com/vicman/stickers/utils/GlideUtils.java, line(s) 37,38
com/vicman/stickers/utils/Storage.java, line(s) 19
com/vicman/stickers/utils/UtilsCommon.java, line(s) 226,236
com/vicman/stickers/utils/toast/SafeToastContext.java, line(s) 48,44
com/vicman/stickers/video/ExtractDecodeEditEncodeMux.java, line(s) 34
com/vicman/stickers/video/TextureRender.java, line(s) 35,49,52
com/vungle/mediation/VungleBannerAdapter.java, line(s) 123,127,184,187,273
com/vungle/mediation/VungleInterstitialAdapter.java, line(s) 51,116,131,139,146,168,182,193,236
com/vungle/mediation/VungleManager.java, line(s) 33,28,61,64,105,111
com/vungle/warren/AdEventListener.java, line(s) 98,113,147
com/vungle/warren/AdLoader.java, line(s) 425,679,695,1327,1352,1407,1194,1206,432
com/vungle/warren/AdvertisementPresentationFactory.java, line(s) 113,118,130,138,144,227,261,354,380,388,419,482,487,499,506
com/vungle/warren/Banners.java, line(s) 23
com/vungle/warren/CacheBustManager.java, line(s) 57
com/vungle/warren/NativeAd.java, line(s) 175,170
com/vungle/warren/SessionTracker.java, line(s) 114
com/vungle/warren/Vungle.java, line(s) 174,207,269,284,338,348,358,381,465,521,528,562,581,587,596,603,622,629,633,638,648,670,722,756,927,932,994
com/vungle/warren/VungleApiClient.java, line(s) 299,303,316,332,386,389,397
com/vungle/warren/VungleLogger.java, line(s) 39,52,67
com/vungle/warren/analytics/VungleAnalytics.java, line(s) 58,59,62,64,67,99,106
com/vungle/warren/downloader/AssetDownloader.java, line(s) 391,726,758,785
com/vungle/warren/log/BaseFilePersistor.java, line(s) 97
com/vungle/warren/log/LogManager.java, line(s) 145,152
com/vungle/warren/log/LogPersister.java, line(s) 81,33,63
com/vungle/warren/log/LogSender.java, line(s) 56,85
com/vungle/warren/network/OkHttpCall.java, line(s) 148,154,164
com/vungle/warren/persistence/CacheManager.java, line(s) 64,113
com/vungle/warren/persistence/FutureResult.java, line(s) 31,55,27,51,58
com/vungle/warren/persistence/GraphicDesigner.java, line(s) 37,77
com/vungle/warren/persistence/Repository.java, line(s) 97,105,111,195,351,357,410,413,529,539,587,641,689,438
com/vungle/warren/tasks/CacheBustJob.java, line(s) 52,79,105,108,114,117,217,49
com/vungle/warren/tasks/CleanupJob.java, line(s) 85,102,93,61
com/vungle/warren/tasks/JobInfo.java, line(s) 26
com/vungle/warren/tasks/SendReportsJob.java, line(s) 57
com/vungle/warren/tasks/runnable/JobRunnable.java, line(s) 45,71,73
com/vungle/warren/ui/presenter/LocalAdPresenter.java, line(s) 394
com/vungle/warren/ui/presenter/MRAIDAdPresenter.java, line(s) 642,708,759
com/vungle/warren/ui/view/BaseAdView.java, line(s) 169,154
com/vungle/warren/ui/view/FullAdWidget.java, line(s) 104,353
com/vungle/warren/ui/view/LocalAdView.java, line(s) 107,259,63
com/vungle/warren/ui/view/NativeAdView.java, line(s) 122
com/vungle/warren/ui/view/VungleBannerView.java, line(s) 132
com/vungle/warren/ui/view/VungleWebClient.java, line(s) 236,237,245,246,267,329,330,253,351
com/vungle/warren/utility/ActivityManager.java, line(s) 69
com/vungle/warren/utility/CookieUtil.java, line(s) 19
com/vungle/warren/utility/ExternalRouter.java, line(s) 23,36
com/vungle/warren/utility/FileUtility.java, line(s) 112,123,131,204,65,68
com/vungle/warren/utility/ImageLoader.java, line(s) 28,30,50
com/vungle/warren/utility/NetworkProvider.java, line(s) 143
com/vungle/warren/utility/UnzipUtility.java, line(s) 92
com/vungle/warren/utility/platform/AndroidPlatform.java, line(s) 66,95,119,121,125,108
org/greenrobot/eventbus/Logger.java, line(s) 10,16
org/tensorflow/lite/support/image/TensorBufferContainer.java, line(s) 35

信息 此应用程序将数据复制到剪贴板。敏感数据不应复制到剪贴板，因为其他应用程序可以访问它 

此应用程序将数据复制到剪贴板。敏感数据不应复制到剪贴板，因为其他应用程序可以访问它
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04b-Mobile-App-Security-Testing.md#clipboard

Files:
com/vicman/photolab/fragments/ShareToInstagramDialogFragment.java, line(s) 6,116
com/vicman/photolab/utils/Utils.java, line(s) 9,1058,1059,1114

信息 应用与Firebase数据库通信 

该应用与位于 https://admob-app-id-1861764684.firebaseio.com 的 Firebase 数据库进行通信

安全 此应用程序使用SSL Pinning 来检测或防止安全通信通道中的MITM攻击 

此应用程序使用SSL Pinning 来检测或防止安全通信通道中的MITM攻击
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#testing-custom-certificate-stores-and-certificate-pinning-mstg-network-4

Files:
com/vicman/photo/opeapi/OpeApi.java, line(s) 133,115
com/vicman/photolab/client/ImageSearchClient.java, line(s) 42,39
com/vicman/photolab/client/PhotoPackClient.java, line(s) 353,350
com/vicman/photolab/client/PurchaseClient.java, line(s) 45,42
com/vicman/photolab/client/RestClient.java, line(s) 86,83
com/vicman/photolab/sdkeyboard/SelfieClient.java, line(s) 504,501

安全 此应用程序可能具有Root检测功能 

此应用程序可能具有Root检测功能
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05j-Testing-Resiliency-Against-Reverse-Engineering.md#testing-root-detection-mstg-resilience-1

Files:
com/apm/insight/nativecrash/c.java, line(s) 292,292,292,292,292

关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (appgallery.cloud.huawei.com) 通信。 

{'ip': '49.4.35.16', 'country_short': 'CN', 'country_long': '中国', 'region': '北京', 'city': '北京', 'latitude': '39.907501', 'longitude': '116.397102'}

安全评分: ( Photo Lab 3.12.85)