安全分析报告： 密询 v2.0.1

安全分数


安全分数 46/100

风险评级


等级

  1. A
  2. B
  3. C
  4. F

严重性分布 (%)


隐私风险

1

用户/设备跟踪器


调研结果

高危 5
中危 25
信息 1
安全 2
关注 17

高危 如果一个应用程序使用WebView.loadDataWithBaseURL方法来加载一个网页到WebView，那么这个应用程序可能会遭受跨站脚本攻击 

如果一个应用程序使用WebView.loadDataWithBaseURL方法来加载一个网页到WebView，那么这个应用程序可能会遭受跨站脚本攻击
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#static-analysis-7

Files:
io/dcloud/common/adapter/ui/AdaWebview.java, line(s) 837,10
io/dcloud/feature/weex/adapter/webview/DCWXWebView.java, line(s) 153,29,30

高危 SSL的不安全实现。信任所有证书或接受自签名证书是一个关键的安全漏洞。此应用程序易受MITM攻击 

SSL的不安全实现。信任所有证书或接受自签名证书是一个关键的安全漏洞。此应用程序易受MITM攻击
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#android-network-apis

Files:
com/alipay/android/phone/mrpc/core/b.java, line(s) 105,15,3
com/cmic/gen/sdk/c/d.java, line(s) 10,11,12,13,14,4
io/dcloud/common/adapter/util/DCloudTrustManager.java, line(s) 26,10,11,29,33
io/dcloud/feature/weex/adapter/DCWXHttpAdapter.java, line(s) 224,40

高危 应用程序使用带PKCS5/PKCS7填充的加密模式CBC。此配置容易受到填充oracle攻击。 

应用程序使用带PKCS5/PKCS7填充的加密模式CBC。此配置容易受到填充oracle攻击。
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
com/cmic/gen/sdk/e/a.java, line(s) 12,31
com/cmic/gen/sdk/e/b.java, line(s) 116,141
io/dcloud/h/a/d/b/a.java, line(s) 33,45

高危 不安全的Web视图实现。Web视图忽略SSL证书错误并接受任何SSL证书。此应用程序易受MITM攻击 

不安全的Web视图实现。Web视图忽略SSL证书错误并接受任何SSL证书。此应用程序易受MITM攻击
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#webview-server-certificate-verification

Files:
io/dcloud/feature/x5/X5WebLoadEvent.java, line(s) 559,568,529

高危 该文件是World Writable。任何应用程序都可以写入文件 

该文件是World Writable。任何应用程序都可以写入文件
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#testing-local-storage-for-sensitive-data-mstg-storage-1-and-mstg-storage-2

Files:
com/cmic/gen/sdk/e/k.java, line(s) 109,50,58,66
io/dcloud/common/util/TestUtil.java, line(s) 159

中危 应用程序存在Janus漏洞 

应用程序使用了v1签名方案进行签名，如果只使用v1签名方案，那么它就容易受到安卓5.0-8.0上的Janus漏洞的攻击。在安卓5.0-7.0上运行的使用了v1签名方案的应用程序，以及同时使用了v2/v3签名方案的应用程序也同样存在漏洞。

中危 应用程序可以安装在有漏洞的已更新 Android 版本上 

Android 5.0-5.0.2, [minSdk=21]
该应用程序可以安装在具有多个未修复漏洞的旧版本 Android 上。这些设备不会从 Google 接收合理的安全更新。支持 Android 版本 => 10、API 29 以接收合理的安全更新。

中危 应用程序已启用明文网络流量 

[android:usesCleartextTraffic=true]
应用程序打算使用明文网络流量，例如明文HTTP，FTP协议，DownloadManager和MediaPlayer。针对API级别27或更低的应用程序，默认值为“true”。针对API级别28或更高的应用程序，默认值为“false”。避免使用明文流量的主要原因是缺乏机密性，真实性和防篡改保护；网络攻击者可以窃听传输的数据，并且可以在不被检测到的情况下修改它。

中危 应用程序数据存在被泄露的风险 

未设置[android:allowBackup]标志
这个标志 [android:allowBackup]应该设置为false。默认情况下它被设置为true，允许任何人通过adb备份你的应用程序数据。它允许已经启用了USB调试的用户从设备上复制应用程序数据。

中危 Activity (com.android.mixunmain.wxapi.WXPayEntryActivity) 未被保护。 

[android:exported=true]
发现 Activity与设备上的其他应用程序共享，因此使其对设备上的任何其他应用程序都可访问。

中危 Activity (io.dcloud.PandoraEntryActivity) 未被保护。 

存在一个intent-filter。
发现 Activity与设备上的其他应用程序共享，因此让它可以被设备上的任何其他应用程序访问。intent-filter的存在表明这个Activity是显式导出的。

中危 Service (io.dcloud.debug.WebSocketService) 未被保护。 

[android:exported=true]
发现 Service与设备上的其他应用程序共享，因此使其对设备上的任何其他应用程序都可访问。

中危 Service (io.dcloud.debug.PullService) 未被保护。 

[android:exported=true]
发现 Service与设备上的其他应用程序共享，因此使其对设备上的任何其他应用程序都可访问。

中危 Activity (io.dcloud.debug.PullDebugActivity) 未被保护。 

[android:exported=true]
发现 Activity与设备上的其他应用程序共享，因此使其对设备上的任何其他应用程序都可访问。

中危 Service (com.xiaomi.mipush.sdk.PushMessageHandler) 受权限保护, 但是应该检查权限的保护级别。 

Permission: com.xiaomi.xmsf.permission.MIPUSH_RECEIVE [android:exported=true]
发现一个 Service被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

中危 Broadcast Receiver (com.igexin.sdk.MiuiPushReceiver) 未被保护。 

[android:exported=true]
发现 Broadcast Receiver与设备上的其他应用程序共享，因此使其对设备上的任何其他应用程序都可访问。

中危 Activity (com.xiaomi.mipush.sdk.NotificationClickedActivity) 未被保护。 

[android:exported=true]
发现 Activity与设备上的其他应用程序共享，因此使其对设备上的任何其他应用程序都可访问。

中危 Activity (com.sina.weibo.sdk.share.ShareTransActivity) 未被保护。 

[android:exported=true]
发现 Activity与设备上的其他应用程序共享，因此使其对设备上的任何其他应用程序都可访问。

中危 Activity (com.alipay.sdk.app.PayResultActivity) 未被保护。 

[android:exported=true]
发现 Activity与设备上的其他应用程序共享，因此使其对设备上的任何其他应用程序都可访问。

中危 Activity (com.alipay.sdk.app.AlipayResultActivity) 未被保护。 

[android:exported=true]
发现 Activity与设备上的其他应用程序共享，因此使其对设备上的任何其他应用程序都可访问。

中危 MD5是已知存在哈希冲突的弱哈希 

MD5是已知存在哈希冲突的弱哈希
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
com/nostra13/dcloudimageloader/cache/disc/naming/Md5FileNameGenerator.java, line(s) 13

中危 应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库 

应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04h-Testing-Code-Quality.md#injection-flaws-mstg-arch-2-and-mstg-platform-2

Files:
com/dcloud/android/downloader/db/DefaultDownloadDBController.java, line(s) 5,56
com/dcloud/android/downloader/db/DefaultDownloadHelper.java, line(s) 4,5,20
io/dcloud/common/util/db/DCSQLiteOpenHelper.java, line(s) 5,6,7,35
io/dcloud/common/util/db/DCStorage.java, line(s) 7,8,9,252
io/dcloud/feature/sqlite/DataBaseFeature.java, line(s) 5,224

中危 应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据 

应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#external-storage

Files:
com/dmcbig/mediapicker/utils/FileUtils.java, line(s) 24,25,27,52,112
com/nostra13/dcloudimageloader/utils/StorageUtils.java, line(s) 21,43,43,52
com/taobao/gcanvas/audio/GAudioPlayer.java, line(s) 63,64,113,114
com/xiaomi/a/c/c.java, line(s) 137
com/xiaomi/a/c/d.java, line(s) 80
io/dcloud/WebviewActivity.java, line(s) 313
io/dcloud/common/adapter/util/ContentUriUtil.java, line(s) 60
io/dcloud/common/adapter/util/DeviceInfo.java, line(s) 460,467,468,469,470,471,472,473,535,682
io/dcloud/common/adapter/util/Logger.java, line(s) 290,314
io/dcloud/common/adapter/util/PermissionUtil.java, line(s) 668,676,678,723,1204
io/dcloud/common/adapter/util/UEH.java, line(s) 199
io/dcloud/common/util/AppRuntime.java, line(s) 214
io/dcloud/common/util/BaseInfo.java, line(s) 410
io/dcloud/common/util/FileUtil.java, line(s) 808,768
io/dcloud/common/util/LoadAppUtils.java, line(s) 100
io/dcloud/common/util/TelephonyUtil.java, line(s) 379,380,383
io/dcloud/debug/DexSwap.java, line(s) 27
io/dcloud/feature/gallery/imageedit/IMGEditActivity.java, line(s) 141
io/dcloud/feature/weex/WeexInstanceMgr.java, line(s) 438
io/dcloud/h/c/c/b/d/f.java, line(s) 169,173,176
io/dcloud/js/gallery/GalleryFeatureImpl.java, line(s) 55
io/dcloud/sdk/base/dcloud/ADHandler.java, line(s) 354
io/dcloud/sdk/base/dcloud/c.java, line(s) 198
io/src/dcloud/adapter/DCloudBaseActivity.java, line(s) 117,196

中危 不安全的Web视图实现。可能存在WebView任意代码执行漏洞 

不安全的Web视图实现。可能存在WebView任意代码执行漏洞
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#testing-javascript-execution-in-webviews-mstg-platform-5

Files:
io/dcloud/feature/x5/DCWXX5WebView.java, line(s) 379,252
io/dcloud/feature/x5/X5WebView.java, line(s) 651,615

中危 文件可能包含硬编码的敏感信息，如用户名、密码、密钥等 

文件可能包含硬编码的敏感信息，如用户名、密码、密钥等
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#checking-memory-for-sensitive-data-mstg-storage-10

Files:
com/bumptech/glide/load/engine/DataCacheKey.java, line(s) 34
com/bumptech/glide/load/engine/EngineResource.java, line(s) 91
com/bumptech/glide/load/engine/ResourceCacheKey.java, line(s) 81
com/bumptech/glide/manager/RequestManagerRetriever.java, line(s) 32
com/xiaomi/a/a/a.java, line(s) 98
io/dcloud/common/DHInterface/IApp.java, line(s) 62
io/dcloud/common/adapter/util/MessageHandler.java, line(s) 32
io/dcloud/common/adapter/util/SP.java, line(s) 11,42
io/dcloud/common/constant/AbsoluteConst.java, line(s) 9,11,320,294,316,313
io/dcloud/common/constant/DOMException.java, line(s) 81,82
io/dcloud/common/util/BaseInfo.java, line(s) 306
io/dcloud/common/util/TelephonyUtil.java, line(s) 30,32,33,47,50,35
io/dcloud/common/util/db/DCSQLiteOpenHelper.java, line(s) 12
io/dcloud/common/util/language/LanguageUtil.java, line(s) 17
io/dcloud/feature/barcode2/decoding/Intents.java, line(s) 49
io/dcloud/feature/gg/AdSplashUtil.java, line(s) 26
io/dcloud/feature/internal/sdk/SDK.java, line(s) 20
io/dcloud/feature/nativeObj/photoview/PhotoActivity.java, line(s) 48,49,50,51,52,54,55
io/dcloud/feature/oauth/BaseOAuthService.java, line(s) 22,23
io/dcloud/feature/weex/config/AndroidTlsConfig.java, line(s) 45
io/dcloud/share/mm/WeiXinMediator.java, line(s) 26

中危 IP地址泄露 

IP地址泄露


Files:
com/alipay/android/phone/mrpc/core/q.java, line(s) 303
com/unicom/xiaowo/account/kernel/p.java, line(s) 4,3
io/dcloud/common/util/emulator/EmulatorCheckUtil.java, line(s) 27
io/dcloud/common/util/net/http/LocalServer.java, line(s) 16

中危 应用程序创建临时文件。敏感信息永远不应该被写进临时文件 

应用程序创建临时文件。敏感信息永远不应该被写进临时文件


Files:
com/dmcbig/mediapicker/TakePhotoActivity.java, line(s) 25
com/dmcbig/mediapicker/utils/FileUtils.java, line(s) 35
io/dcloud/common/util/ExifInterface.java, line(s) 3762

中危 SHA-1是已知存在哈希冲突的弱哈希 

SHA-1是已知存在哈希冲突的弱哈希
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
io/dcloud/e/f/a.java, line(s) 381,285,290

中危 应用程序包含隐私跟踪程序 

此应用程序有多个1隐私跟踪程序。跟踪器可以跟踪设备或用户，是终端用户的隐私问题。

中危 此应用可能包含硬编码机密信息 

从应用程序中识别出以下机密确保这些不是机密或私人信息
"dcloud_feature_oauth_weixin_plugin_description" : "wechat"
"dcloud_common_user_refuse_api" : "用户拒绝该API访问"
"dcloud_oauth_token_failed" : "获取token失败"
"dcloud_oauth_logout_tips" : "未登录或登录已注销"
"dcloud_io_without_authorization" : "没有获得授权"
"dcloud_oauth_oauth_not_empower" : "尚未获取oauth授权"
"dcloud_oauth_empower_failed" : "获取授权登录认证服务操作失败"
"dcloud_permissions_reauthorization" : "重新授权"
"dcloud_permissions_reauthorization" : "reauthorize"
"dcloud_oauth_authentication_failed" : "获取授权登录认证服务操作失败"
"dcloud_feature_oauth_weixin_plugin_description" : "微信"
YHx8eHsyJydvaXo6JmxrZGd9bCZhZydrZ2RkbWt8J3hkfXtpeHgnent4
YHx8eHsyJydqaWs5JmxrZGd9bCZmbXwma2YnYHx8eCdpaXs=
e218Qml+aVtremF4fEtpZkd4bWZfYWZsZ397SX18Z2VpfGFraWRkcQ==
YHx8eHsyJydqaXs5JmxrZGd9bCZmbXwma2YnYHx8eCdraWk=
YHx8eHsyJydqfDkmbGtkZ31sJmZtfCZrZidgfHx4J2tpaQ==
nBCau4hdVwFpRmb9NIuqavDeHKP9BKPZ01Ra5/666NGKBqmkRRer3lBCe6EKNUc2U
YHx8eHsyJydpazombGtkZ31sJmZtfCZrZidpeHgnaWt7
p2WH3ao/DPQajXDOBOngAQRJy7HFI6I+rNVrL72Tvjg=
YHx8eHsyJydqaWs5JmxrZGd9bCZmbXwma2YnYHx8eCdpaWs=
YHx8eHsyJydvazkmbGtkZ31sJmZtfCZrZidrZ2RkbWt8J3hkfXtpeHgna2ls
5rPjudJDczZ5DrTBECwfWer9fxhAWnoxI7Hr0jS/XKKlD9cg1eZLP+WDaj1U0IQ9
aHR0cHM6Ly9jci5kY2xvdWQubmV0LmNuLw==
UWV/BnpHVVhMahB0EU1XA15hAEFOAWlGVHBkcgluSF0HFhlQZx15Yhhjb3xCHgRfWxV+cQhPS1ICFxRzdkUfeyo2YTNkODhmYS00YmEwLTQ3OWYtOTQyMi1lNWFhYmUxNTg5N2IxMjQ=
YHx8eHsyJydvaXs6JmxrZGd9bCZmbXwma2Yna2dkZG1rfCd4ZH17aXh4J2lrfGFnZg==
nkO0ykg5qH942X8poQ+a9GgBUeDBpY4GSIv6/qq+zJxiJxpoL0SGKAP3FlcuLr07f
YHx8eHsyJydpazkmbGtkZ31sJmZtfCZrZidpeHgnaWt7
9F89C84A559F573636A47FF8DAED0D33
YHx8eHsyJyd8OSZsa2RnfWwmZm18JmtmJ2tnZGRta3wneGR9e2l4eCdpa3xhZ2Y=
YHx8eHsyJydvaXs5JmxrZGd9bCZhZydrZ2RkbWt8J3hkfXtpeHgnaWt8YWdm
YHx8eHsyJydqb2l6JmxrZGd9bCZhZydrZ2RkbWt8J3hkfXtpeHgnent4
Y29tLmFuZHJvaWQuaW50ZXJuYWwuUiRzdHlsZWFibGU=
YHx8eHsyJydrOSZsa2RnfWwmZm18JmtmJ2tnZGRta3wneGR9e2l4eCdraWw=
YHx8eHsyJyd8OiZsa2RnfWwmZm18JmtmJ2tnZGRta3wneGR9e2l4eCdpa3xhZ2Y=
YHx8eHsyJydvaXo6JmxrZGd9bCZmbXwma2Yna2dkZG1rfCd4ZH17aXh4J3p7eA==
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuyqBGJVxu+5Z2ZwItIhl
5rPjudJDczZ5DrTBECwfWSjBF5HsOIb6t/fa0kExz2phP+SrGrN3+oS6bbF8z8n+
YHx8eHsyJydvaXs5JmxrZGd9bCZmbXwma2Yna2dkZG1rfCd4ZH17aXh4J2lrfGFnZg==
YHx8eHsyJydpazombGtkZ31sJmZtfCZrZidpeHgnfGBhemxLZ2ZuYW8=
YHx8eHsyJydpazkmbGtkZ31sJmZtfCZrZidpeHgnfGBhemxLZ2ZuYW8=
CEroA9kVcgb5YW85GtDBLrVZfsAsUrOdkBRjB/Uh1+E=
258EAFA5-E914-47DA-95CA-C5AB0DC85B11
YHx8eHsyJydqezkmbGtkZ31sJmZtfCZrZidgfHx4J2tpeyd+Og==
eG5/SmdnZHxNYmduSmhobnh4TXlkZk1iZ25eWUd4KjZhM2Q4OGZhLTRiYTAtNDc5Zi05NDIyLWU1YWFiZTE1ODk3Yjc1
YHx8eHsyJydqb2l7JmxrZGd9bCZhZydrZ2RkbWt8J3hkfXtpeHgnaWt8YWdm
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDNFGdEpQ1d8cPqekvvEDQyBGnI
nKwvjX9o3OmnnqWMGbIiFYIpc21QeG7aqizuWdXlgS5M9rstDfHQfG/AaPElJ7Yix
5rPjudJDczZ5DrTBECwfWbr6jIGaA05lJJ4z8IfXa1gko92nDYCi7GietE6VgZMY
YHx8eHsyJydvaXo5JmxrZGd9bCZhZydrZ2RkbWt8J3hkfXtpeHgnent4
amwtZ2BvbHZnLWBsbm5sbS1gcC1HTyo2YTNkODhmYS00YmEwLTQ3OWYtOTQyMi1lNWFhYmUxNTg5N2I2Nw==
nJhjaEmyCOtSU6+mdjcHhbcbF6lKYx8tfQlpPmyM5suFY138qtEoB4b+q/j8q22MI
YHx8eHsyJydvaWs6JmxrZGd9bCZmbXwma2YnaXh4J2lrew==
eW9+S2ZmZX1fZGN8b3h5a2ZLaWlveXlMeGVnTGNmb19YRnkqNmEzZDg4ZmEtNGJhMC00NzlmLTk0MjItZTVhYWJlMTU4OTdiNzQ=
W3v2HgaLzgcTXlUiOoZ7E6RDsIpMd2Glz1MxJdRxdis
YHx8eHsyJyd7OSZsa2RnfWwmZm18JmtmJ2tnZGRta3wneGR9e2l4eCd7fGl6fH14J346
E3F5536A141811DB40EFD6400F1D0A4E
5rPjudJDczZ5DrTBECwfWX3lxIQFlIC/UMsP+phhn+hM5LDHPI8rrfGoWmO4XXwm
YHx8eHsyJydpezombGtkZ31sJmZtfCZrZidrZ2RkbWt8J3hkfXtpeHgnaWt8YWdm
YHx8eHsyJydpejombGtkZ31sJmZtfCZrZidrZ2RkbWt8J3hkfXtpeHgnent4
evs6OIME2yLCyUChqtQTGtxDh4/6wcSpdRw8lh8NGkyLXZQtZ1A7NDehilU2yXH5
YHx8eHsyJydpezkmbGtkZ31sJmZtfCZrZidrZ2RkbWt8J3hkfXtpeHgnaWt8YWdm
amwtZ2BvbHZnLWVmYnd2cWYtYGUtYEVmYnd2cWZKbnNvKjZhM2Q4OGZhLTRiYTAtNDc5Zi05NDIyLWU1YWFiZTE1ODk3YjY3
YHx8eHsyJydqb2l6JmxrZGd9bCZmbXwma2Yna2dkZG1rfCd4ZH17aXh4J3p7eA==
noxI53CVpYUR3OWAQyAQNcMhDDf3nGsxLLHP8kGWqrpLn1uAIgI+EIAl0sM+i1leD
YHx8eHsyJydqb2l7JmxrZGd9bCZmbXwma2Yna2dkZG1rfCd4ZH17aXh4J2lrfGFnZg==
f2l4TWBgY3tKZWBpTW9vaX9/KjZhM2Q4OGZhLTRiYTAtNDc5Zi05NDIyLWU1YWFiZTE1ODk3Yjc2
YHx8eHsyJydvaWs5JmxrZGd9bCZmbXwma2YnaXh4J2lrew==
YHx8eHsyJydqb2lrJmxrZGd9bCZmbXwma2YnaXh4J2lrew==
YHx8eHsyJydqaXo6JmxrZGd9bCZmbXwma2YnYHx8eCdraXo=
YHx8eHsyJyd7OiZsa2RnfWwmZm18JmtmJ2tnZGRta3wneGR9e2l4eCd7fGl6fH14J346
2BGSU2QqUAXYXuDA9OkD2SztJLGWMXqJb5xjvxk4w6dV7K0u
NcnBDcMwCEDRXThXDJBtSKAWiQErjtVWVXcvB0f60j+8L1wrLLCF4UWxUszBA3aesKsXDi9IraFRrYmNb30PN0ls6jwiS+XPxN6RnM9QxlE2pJeYpB/9dtMqWPRpdMgJvz8=
nFD+sYU2rkUVZgpwO7ly+THBFw/YcZNwS094NBdhzxmCCFbCKHVNzDLirlV9T2q4k
YHx8eHsyJydvaXo5JmxrZGd9bCZmbXwma2Yna2dkZG1rfCd4ZH17aXh4J3p7eA==
YHx8eHsyJydpejkmbGtkZ31sJmZtfCZrZidrZ2RkbWt8J3hkfXtpeHgnent4
YHx8eHsyJydvazkmbGtkZ31sJmFnJ2tnZGRta3wneGR9e2l4eCdraWw=
YHx8eHsyJydvaXs6JmxrZGd9bCZhZydrZ2RkbWt8J3hkfXtpeHgnaWt8YWdm

信息 应用程序记录日志信息,不得记录敏感信息 

应用程序记录日志信息,不得记录敏感信息
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#logs

Files:
androidtranscoder/MediaTranscoder.java, line(s) 74,151,184,71,68
androidtranscoder/engine/MediaTranscoderEngine.java, line(s) 76,84,167,197
androidtranscoder/engine/QueuedMuxer.java, line(s) 94,96,104
androidtranscoder/engine/TextureRender.java, line(s) 50,60,61,76,80,100
androidtranscoder/format/ExportPreset960x540Strategy.java, line(s) 19
cn/com/chinatelecom/account/api/ClientUtils.java, line(s) 34
com/alibaba/android/bindingx/core/LogProxy.java, line(s) 51,57,75,81,27,33,39,45,63,69
com/alibaba/android/bindingx/plugin/weex/WXBindingXModule.java, line(s) 90
com/alipay/android/phone/mrpc/core/b.java, line(s) 78
com/bumptech/glide/Glide.java, line(s) 203,212,131,130,202,209,237,238
com/bumptech/glide/gifdecoder/GifHeaderParser.java, line(s) 236,275,235,274
com/bumptech/glide/gifdecoder/StandardGifDecoder.java, line(s) 153,171,187,152,170,186,208,217
com/bumptech/glide/load/data/AssetPathFetcher.java, line(s) 36,35
com/bumptech/glide/load/data/HttpUrlFetcher.java, line(s) 53,133,52,56,61,68,132,65,69
com/bumptech/glide/load/data/LocalUriFetcher.java, line(s) 38,37
com/bumptech/glide/load/data/mediastore/ThumbFetcher.java, line(s) 52,51
com/bumptech/glide/load/data/mediastore/ThumbnailStreamOpener.java, line(s) 61,60
com/bumptech/glide/load/engine/DecodeJob.java, line(s) 335,381,442
com/bumptech/glide/load/engine/DecodePath.java, line(s) 57,58
com/bumptech/glide/load/engine/Engine.java, line(s) 27,96
com/bumptech/glide/load/engine/GlideException.java, line(s) 82
com/bumptech/glide/load/engine/SourceGenerator.java, line(s) 66,67
com/bumptech/glide/load/engine/bitmap_recycle/LruArrayPool.java, line(s) 90,144,91,145
com/bumptech/glide/load/engine/bitmap_recycle/LruBitmapPool.java, line(s) 129,159,167,191,74,81,128,138,158,166,180,190,199,75,82,139,205,181
com/bumptech/glide/load/engine/cache/DiskLruCacheWrapper.java, line(s) 52,62,76,82,112,123,53,77,63,83,113,124
com/bumptech/glide/load/engine/cache/MemorySizeCalculator.java, line(s) 64,48
com/bumptech/glide/load/engine/executor/GlideExecutor.java, line(s) 165,162
com/bumptech/glide/load/engine/executor/RuntimeCompat.java, line(s) 37,36
com/bumptech/glide/load/engine/prefill/BitmapPreFillRunner.java, line(s) 70,69
com/bumptech/glide/load/model/ByteBufferEncoder.java, line(s) 20,19
com/bumptech/glide/load/model/ByteBufferFileLoader.java, line(s) 59,58
com/bumptech/glide/load/model/FileLoader.java, line(s) 64,63
com/bumptech/glide/load/model/ResourceLoader.java, line(s) 39,40
com/bumptech/glide/load/model/StreamEncoder.java, line(s) 39,38
com/bumptech/glide/load/resource/bitmap/BitmapEncoder.java, line(s) 62,61,78,79
com/bumptech/glide/load/resource/bitmap/DefaultImageHeaderParser.java, line(s) 117,124,140,147,180,190,202,216,230,236,240,245,251,255,116,123,139,146,179,189,201,215,229,235,239,244,250,254
com/bumptech/glide/load/resource/bitmap/Downsampler.java, line(s) 177,296,333,135,151,176,258,295,332,136,259,360
com/bumptech/glide/load/resource/bitmap/DrawableToBitmapConverter.java, line(s) 44,49,45,50
com/bumptech/glide/load/resource/bitmap/HardwareConfigState.java, line(s) 55,56
com/bumptech/glide/load/resource/bitmap/TransformationUtils.java, line(s) 164,108,117,124,141,146,163,109,118,125,126,127,131,142,147
com/bumptech/glide/load/resource/bitmap/VideoDecoder.java, line(s) 129,128
com/bumptech/glide/load/resource/gif/ByteBufferGifDecoder.java, line(s) 82,87,92,101,83,88,93,102
com/bumptech/glide/load/resource/gif/GifDrawableEncoder.java, line(s) 25,26
com/bumptech/glide/load/resource/gif/StreamGifDecoder.java, line(s) 55,56
com/bumptech/glide/manager/DefaultConnectivityMonitor.java, line(s) 23,22,52,70,53,71
com/bumptech/glide/manager/DefaultConnectivityMonitorFactory.java, line(s) 15,14
com/bumptech/glide/manager/RequestManagerFragment.java, line(s) 123,124
com/bumptech/glide/manager/RequestManagerRetriever.java, line(s) 314,315,323
com/bumptech/glide/manager/RequestTracker.java, line(s) 24,25
com/bumptech/glide/manager/SupportRequestManagerFragment.java, line(s) 123,124
com/bumptech/glide/module/ManifestParser.java, line(s) 22,29,40,45,21,28,33,39,44,34
com/bumptech/glide/request/SingleRequest.java, line(s) 407,62,498,442
com/bumptech/glide/request/target/CustomViewTarget.java, line(s) 294,295,309,310
com/bumptech/glide/request/target/ViewTarget.java, line(s) 284,285,299,300
com/bumptech/glide/signature/ApplicationVersionSignature.java, line(s) 46
com/bumptech/glide/util/ContentLengthInputStream.java, line(s) 28,27
com/bumptech/glide/util/pool/FactoryPools.java, line(s) 89,90
com/cmic/gen/sdk/e/c.java, line(s) 20,10
com/dcloud/android/downloader/core/DownloadResponseImpl.java, line(s) 89
com/dcloud/android/downloader/core/thread/DownloadThread.java, line(s) 121
com/dcloud/android/v4/view/ViewCompat.java, line(s) 128,178,69
com/dcloud/android/v4/view/ViewCompatEclairMr1.java, line(s) 24,31,33,35
com/dcloud/android/v4/view/ViewParentCompatLollipop.java, line(s) 16,25,34,42,50,58,67
com/dcloud/android/v4/widget/SwipeRefreshLayout.java, line(s) 354
com/dcloud/android/widget/toast/SafeToastContext.java, line(s) 37,35
com/dmcbig/mediapicker/PreviewActivity.java, line(s) 253
com/taobao/gcanvas/GCanvasJNI.java, line(s) 135,137,75,77,123
com/taobao/gcanvas/GFontConfigParser.java, line(s) 61,76,91,105,159,169,175,223,234,240,245
com/taobao/gcanvas/adapters/img/impl/fresco/GCanvasFrescoImageLoader.java, line(s) 49,53
com/taobao/gcanvas/audio/GAudioHandler.java, line(s) 53,93,240,250
com/taobao/gcanvas/audio/GAudioPlayer.java, line(s) 122
com/taobao/gcanvas/bridges/spec/module/AbsGBridgeModule.java, line(s) 94,108,153,164,168,190,203,349,123,175,211,344,360
com/taobao/gcanvas/bridges/weex/GCanvasWeexModule.java, line(s) 104,105,110,174,187,281,282,293,298,306,166,181,277
com/taobao/gcanvas/bridges/weex/WXGCanvasWeexComponent.java, line(s) 114,130,109
com/taobao/gcanvas/surface/GTextureView.java, line(s) 73,77,79
com/taobao/gcanvas/surface/GTextureViewCallback.java, line(s) 68,79,93,110,126,133
com/taobao/gcanvas/util/GCanvasHelper.java, line(s) 26,50
com/taobao/gcanvas/util/GLog.java, line(s) 43,90,96,55,61,74,80,128,134,109,115
com/tencent/tauth/AuthActivity.java, line(s) 38,45,114,206,54,66,78,92,156,167,40,30,73,197
com/tencent/tauth/Tencent.java, line(s) 198,209,214,219,222,79,126,175,179,189,195,110,115,124,139,150,155,163,233,239,245,251,257,263,270,277,283,291,297,303,309,315,321,330,336,342,349,357,363,369,384,391,398,405,412,419,431,442,448,454,457,462,468,474,483,489,498,505,512,519,527,539,554,556,561,567,573,584,590,620,626,632,640
com/unicom/xiaowo/account/kernel/o.java, line(s) 10,19
io/dcloud/WebAppActivity.java, line(s) 396,405,716,789,1234,705,864
io/dcloud/b.java, line(s) 619,766
io/dcloud/common/adapter/ui/AdaFrameView.java, line(s) 612
io/dcloud/common/adapter/ui/AdaWebview.java, line(s) 334,1273
io/dcloud/common/adapter/ui/webview/WebJsEvent.java, line(s) 410,760
io/dcloud/common/adapter/ui/webview/WebLoadEvent.java, line(s) 627,642
io/dcloud/common/adapter/util/DownloadUtil.java, line(s) 104,27,102,121,126,128,129
io/dcloud/common/adapter/util/Logger.java, line(s) 178,422,204,211,327,176,251,420,383
io/dcloud/common/core/ui/a.java, line(s) 1340,1342
io/dcloud/common/ui/b.java, line(s) 172,208
io/dcloud/common/util/ADUtils.java, line(s) 183,204,251,266
io/dcloud/common/util/AppConsoleLogUtil.java, line(s) 18,34,41,51,57
io/dcloud/common/util/BaseInfo.java, line(s) 813,898,995
io/dcloud/common/util/CreateShortResultReceiver.java, line(s) 18
io/dcloud/common/util/ExifInterface.java, line(s) 642,1581,1612,1629,1636,1813,1866,1887,1900,1932,1958,2089,2128,2133,2139,2203,2373,2395,2495,2498,2507,2512,2549,2570,2584,2599,2623,2650,2668,2672,2678,2729,2736,2748,2767,2772,2776,2815,2902,2949,3152,3167,3170,3241,3301,3576,3584,3626,3665,4232,4408,4459,4526,1084,1092,1126,1138,1150,1162,1174,1186,1198,1210,1222,1229,1240,1252,1385,1389,500,1235,1806,2104,2156,2159,3206,3215,4211,4281,4288,4365,4400,4417,4425,4583
io/dcloud/common/util/LoadAppUtils.java, line(s) 145,150,158,373
io/dcloud/common/util/net/http/LocalServer2.java, line(s) 92,105,138
io/dcloud/debug/PullManager.java, line(s) 284,302,319,329,330,339
io/dcloud/debug/PullService.java, line(s) 40,46,48,54,57
io/dcloud/e/b/a.java, line(s) 366,867
io/dcloud/e/b/d.java, line(s) 37,39,57,59,109,268,282,288
io/dcloud/e/b/e.java, line(s) 2103
io/dcloud/e/f/a.java, line(s) 184
io/dcloud/feature/barcode2/camera/AutoFocusCallback.java, line(s) 20
io/dcloud/feature/barcode2/camera/CameraConfigurationManager.java, line(s) 241,257,58,79,110,134,165,184,196
io/dcloud/feature/barcode2/camera/FlashlightManager.java, line(s) 22,24,69,73,77,89,101
io/dcloud/feature/barcode2/camera/PreviewCallback.java, line(s) 55
io/dcloud/feature/barcode2/decoding/CaptureActivityHandler.java, line(s) 209,216,221,228
io/dcloud/feature/contacts/ContactAccessor.java, line(s) 40
io/dcloud/feature/contacts/ContactAccessorImpl.java, line(s) 562,624,654,672,766,877,889,901,913,925,937,949,228,295,313,349,362,364,377,390,403,425,772,773,776,777,837,839,976,979
io/dcloud/feature/gallery/imageedit/c/a.java, line(s) 705
io/dcloud/feature/gallery/imageedit/c/j/b.java, line(s) 38,42,51,55
io/dcloud/feature/gallery/imageedit/view/IMGView.java, line(s) 118,165,171,183
io/dcloud/feature/nativeObj/photoview/subscaleview/SubsamplingScaleImageView.java, line(s) 608,210,214,387,391,457,752,763,792,797,1727,1928,2260
io/dcloud/feature/nativeObj/photoview/subscaleview/decoder/SkiaPooledImageRegionDecoder.java, line(s) 117
io/dcloud/feature/nativeObj/richtext/RichTextParser.java, line(s) 199,206,213,222
io/dcloud/feature/nativeObj/richtext/dom/ImgDomElement.java, line(s) 62
io/dcloud/feature/pdr/RuntimeFeatureImpl.java, line(s) 624,649
io/dcloud/feature/pdr/b.java, line(s) 68,73,78,107
io/dcloud/feature/ui/c.java, line(s) 1603,2966
io/dcloud/feature/ui/e.java, line(s) 1032,1219
io/dcloud/feature/ui/nativeui/NativeUIFeatureImpl.java, line(s) 1314
io/dcloud/feature/weex/adapter/Fresco/DCWrappingUtils.java, line(s) 161
io/dcloud/feature/weex/adapter/FrescoImageAdapter.java, line(s) 123,128
io/dcloud/feature/weex/adapter/widget/refresh/DCWeexBaseRefreshLayout.java, line(s) 556,789,800,815
io/dcloud/feature/x5/X5InitImpl.java, line(s) 48,57,66
io/dcloud/feature/x5/X5WebLoadEvent.java, line(s) 760,1092
io/dcloud/h/a/e/b.java, line(s) 61,80,96
io/dcloud/invocation/a.java, line(s) 220,289,314,333
io/dcloud/invocation/c.java, line(s) 363
io/dcloud/js/geolocation/a.java, line(s) 29
io/dcloud/js/geolocation/system/a.java, line(s) 151,173
io/dcloud/net/JsDownload.java, line(s) 121
io/dcloud/net/UploadNetWork.java, line(s) 139
io/dcloud/nineoldandroids/animation/PropertyValuesHolder.java, line(s) 69,71,158,160,251,279,347,349,392,394,460,478,480
io/dcloud/sdk/core/b/a.java, line(s) 73
io/dcloud/sdk/poly/base/utils/e.java, line(s) 7,31,13,37,19,43,25

安全 此应用程序使用SSL Pinning 来检测或防止安全通信通道中的MITM攻击 

此应用程序使用SSL Pinning 来检测或防止安全通信通道中的MITM攻击
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#testing-custom-certificate-stores-and-certificate-pinning-mstg-network-4

Files:
com/cmic/gen/sdk/c/a/a.java, line(s) 117,167
com/unicom/xiaowo/account/kernel/i.java, line(s) 324,338,420
io/dcloud/feature/weex/config/UserCustomTrustManager.java, line(s) 62,64,141,143,45,59,59,138,138

安全 此应用程序可能具有Root检测功能 

此应用程序可能具有Root检测功能
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05j-Testing-Resiliency-Against-Reverse-Engineering.md#testing-root-detection-mstg-resilience-1

Files:
io/dcloud/common/adapter/util/DeviceInfo.java, line(s) 417,167,167,167,167,167

关注 应用程序可能与位于OFAC制裁国家 (China) 的服务器 (sdk.sms.jpush.cn) 通信。 

{'ip': '114.116.230.119', 'country_short': 'CN', 'country_long': 'China', 'region': 'Beijing', 'city': 'Beijing', 'latitude': '39.907501', 'longitude': '116.397232'}

关注 应用程序可能与位于OFAC制裁国家 (China) 的服务器 (ask.dcloud.net.cn) 通信。 

{'ip': '58.222.30.217', 'country_short': 'CN', 'country_long': 'China', 'region': 'Jiangsu', 'city': 'Taizhou', 'latitude': '32.493328', 'longitude': '119.910629'}

关注 应用程序可能与位于OFAC制裁国家 (China) 的服务器 (api-e189.21cn.com) 通信。 

{'ip': '222.93.106.185', 'country_short': 'CN', 'country_long': 'China', 'region': 'Jiangsu', 'city': 'Suzhou', 'latitude': '31.311390', 'longitude': '120.618057'}

关注 应用程序可能与位于OFAC制裁国家 (China) 的服务器 (er.dcloud.net.cn) 通信。 

{'ip': '118.89.168.191', 'country_short': 'CN', 'country_long': 'China', 'region': 'Beijing', 'city': 'Beijing', 'latitude': '39.907501', 'longitude': '116.397232'}

关注 应用程序可能与位于OFAC制裁国家 (China) 的服务器 (service.weibo.com) 通信。 

{'ip': '49.7.37.74', 'country_short': 'CN', 'country_long': 'China', 'region': 'Beijing', 'city': 'Beijing', 'latitude': '39.907501', 'longitude': '116.397232'}

关注 应用程序可能与位于OFAC制裁国家 (China) 的服务器 (m3w.cn) 通信。 

{'ip': '61.170.44.188', 'country_short': 'CN', 'country_long': 'China', 'region': 'Shanghai', 'city': 'Shanghai', 'latitude': '31.224333', 'longitude': '121.469139'}

关注 应用程序可能与位于OFAC制裁国家 (China) 的服务器 (mobilegw.alipaydev.com) 通信。 

{'ip': '110.75.132.131', 'country_short': 'CN', 'country_long': 'China', 'region': 'Zhejiang', 'city': 'Hangzhou', 'latitude': '30.293650', 'longitude': '120.161423'}

关注 应用程序可能与位于OFAC制裁国家 (China) 的服务器 (sdk.verification.jiguang.cn) 通信。 

{'ip': '122.9.32.239', 'country_short': 'CN', 'country_long': 'China', 'region': 'Guangdong', 'city': 'Guangzhou', 'latitude': '23.127361', 'longitude': '113.264252'}

关注 应用程序可能与位于OFAC制裁国家 (China) 的服务器 (id6.me) 通信。 

{'ip': '42.123.77.138', 'country_short': 'CN', 'country_long': 'China', 'region': 'Beijing', 'city': 'Beijing', 'latitude': '39.907501', 'longitude': '116.397232'}

关注 应用程序可能与位于OFAC制裁国家 (China) 的服务器 (e.189.cn) 通信。 

{'ip': '42.123.76.65', 'country_short': 'CN', 'country_long': 'China', 'region': 'Beijing', 'city': 'Beijing', 'latitude': '39.907501', 'longitude': '116.397232'}

关注 应用程序可能与位于OFAC制裁国家 (China) 的服务器 (open.e.189.cn) 通信。 

{'ip': '42.123.76.52', 'country_short': 'CN', 'country_long': 'China', 'region': 'Beijing', 'city': 'Beijing', 'latitude': '39.907501', 'longitude': '116.397232'}

关注 应用程序可能与位于OFAC制裁国家 (China) 的服务器 (wap.cmpassport.com) 通信。 

{'ip': '120.197.235.27', 'country_short': 'CN', 'country_long': 'China', 'region': 'Guangdong', 'city': 'Guangzhou', 'latitude': '23.127361', 'longitude': '113.264252'}

关注 应用程序可能与位于OFAC制裁国家 (China) 的服务器 (api.weibo.com) 通信。 

{'ip': '49.7.37.118', 'country_short': 'CN', 'country_long': 'China', 'region': 'Beijing', 'city': 'Beijing', 'latitude': '39.907501', 'longitude': '116.397232'}

关注 应用程序可能与位于OFAC制裁国家 (China) 的服务器 (h5.m.taobao.com) 通信。 

{'ip': '121.228.130.198', 'country_short': 'CN', 'country_long': 'China', 'region': 'Jiangsu', 'city': 'Suzhou', 'latitude': '31.311390', 'longitude': '120.618057'}

关注 应用程序可能与位于OFAC制裁国家 (China) 的服务器 (opencloud.wostore.cn) 通信。 

{'ip': '116.128.209.136', 'country_short': 'CN', 'country_long': 'China', 'region': 'Beijing', 'city': 'Beijing', 'latitude': '39.907501', 'longitude': '116.397232'}

关注 应用程序可能与位于OFAC制裁国家 (China) 的服务器 (www.cmpassport.com) 通信。 

{'ip': '120.197.235.28', 'country_short': 'CN', 'country_long': 'China', 'region': 'Guangdong', 'city': 'Guangzhou', 'latitude': '23.127361', 'longitude': '113.264252'}

关注 应用程序可能与位于OFAC制裁国家 (China) 的服务器 (open.weibo.cn) 通信。 

{'ip': '49.7.37.118', 'country_short': 'CN', 'country_long': 'China', 'region': 'Beijing', 'city': 'Beijing', 'latitude': '39.907501', 'longitude': '116.397232'}

安全评分: ( 密询 2.0.1)