安全分析报告： 50度灰 v6.2.0

安全分数


安全分数 53/100

风险评级


等级

  1. A
  2. B
  3. C
  4. F

严重性分布 (%)


隐私风险

0

用户/设备跟踪器


调研结果

高危 2
中危 23
信息 3
安全 3
关注 3

高危 不安全的Web视图实现。Web视图忽略SSL证书错误并接受任何SSL证书。此应用程序易受MITM攻击 

不安全的Web视图实现。Web视图忽略SSL证书错误并接受任何SSL证书。此应用程序易受MITM攻击
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#webview-server-certificate-verification

Files:
com/tencent/mm/ui/game/WebActivity.java, line(s) 54,52

高危 默认情况下，调用Cipher.getInstance("AES")将返回AES ECB模式。众所周知，ECB模式很弱，因为它导致相同明文块的密文相同 

默认情况下，调用Cipher.getInstance("AES")将返回AES ECB模式。众所周知，ECB模式很弱，因为它导致相同明文块的密文相同
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-block-cipher-mode

Files:
com/m3u8/download/k/a.java, line(s) 20,34
jaygoo/library/m3u8downloader/p/a.java, line(s) 20,34

中危 应用程序已启用明文网络流量 

[android:usesCleartextTraffic=true]
应用程序打算使用明文网络流量，例如明文HTTP，FTP协议，DownloadManager和MediaPlayer。针对API级别27或更低的应用程序，默认值为“true”。针对API级别28或更高的应用程序，默认值为“false”。避免使用明文流量的主要原因是缺乏机密性，真实性和防篡改保护；网络攻击者可以窃听传输的数据，并且可以在不被检测到的情况下修改它。

中危 应用程序数据可以被备份 

[android:allowBackup=true]
这个标志允许任何人通过adb备份你的应用程序数据。它允许已经启用了USB调试的用户从设备上复制应用程序数据。

中危 Activity-Alias (com.tencent.mm.XiaoHongShuAliasActivity) 未被保护。 

存在一个intent-filter。
发现 Activity-Alias与设备上的其他应用程序共享，因此让它可以被设备上的任何其他应用程序访问。intent-filter的存在表明这个Activity-Alias是显式导出的。

中危 Activity-Alias (com.tencent.mm.XiGuaAliasActivity) 未被保护。 

存在一个intent-filter。
发现 Activity-Alias与设备上的其他应用程序共享，因此让它可以被设备上的任何其他应用程序访问。intent-filter的存在表明这个Activity-Alias是显式导出的。

中危 Activity-Alias (com.tencent.mm.WechatAliasActivity) 未被保护。 

存在一个intent-filter。
发现 Activity-Alias与设备上的其他应用程序共享，因此让它可以被设备上的任何其他应用程序访问。intent-filter的存在表明这个Activity-Alias是显式导出的。

中危 Activity-Alias (com.tencent.mm.TouTiaoAliasActivity) 未被保护。 

存在一个intent-filter。
发现 Activity-Alias与设备上的其他应用程序共享，因此让它可以被设备上的任何其他应用程序访问。intent-filter的存在表明这个Activity-Alias是显式导出的。

中危 Activity-Alias (com.tencent.mm.KuaiShouAliasActivity) 未被保护。 

存在一个intent-filter。
发现 Activity-Alias与设备上的其他应用程序共享，因此让它可以被设备上的任何其他应用程序访问。intent-filter的存在表明这个Activity-Alias是显式导出的。

中危 Activity-Alias (com.tencent.mm.DouYinAliasActivity) 未被保护。 

存在一个intent-filter。
发现 Activity-Alias与设备上的其他应用程序共享，因此让它可以被设备上的任何其他应用程序访问。intent-filter的存在表明这个Activity-Alias是显式导出的。

中危 Activity-Alias (com.tencent.mm.BaiduAliasActivity) 未被保护。 

存在一个intent-filter。
发现 Activity-Alias与设备上的其他应用程序共享，因此让它可以被设备上的任何其他应用程序访问。intent-filter的存在表明这个Activity-Alias是显式导出的。

中危 Activity-Alias (com.tencent.mm.AiQiYiAliasActivity) 未被保护。 

存在一个intent-filter。
发现 Activity-Alias与设备上的其他应用程序共享，因此让它可以被设备上的任何其他应用程序访问。intent-filter的存在表明这个Activity-Alias是显式导出的。

中危 Activity-Alias (com.tencent.mm.DefaultAliasActivity) 未被保护。 

存在一个intent-filter。
发现 Activity-Alias与设备上的其他应用程序共享，因此让它可以被设备上的任何其他应用程序访问。intent-filter的存在表明这个Activity-Alias是显式导出的。

中危 Activity (com.tencent.mm.ui.H5Activity) 未被保护。 

存在一个intent-filter。
发现 Activity与设备上的其他应用程序共享，因此让它可以被设备上的任何其他应用程序访问。intent-filter的存在表明这个Activity是显式导出的。

中危 Activity (com.tencent.mm.ui.WebViewActivity) 未被保护。 

存在一个intent-filter。
发现 Activity与设备上的其他应用程序共享，因此让它可以被设备上的任何其他应用程序访问。intent-filter的存在表明这个Activity是显式导出的。

中危 MD5是已知存在哈希冲突的弱哈希 

MD5是已知存在哈希冲突的弱哈希
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
c/c/a/b/e/b.java, line(s) 363
c/c/c/a/b/c.java, line(s) 42,101
c/c/c/a/f/b/c.java, line(s) 73
com/danikula/videocache/p.java, line(s) 46
com/fynnjason/utils/d.java, line(s) 21
com/m3u8/download/k/b.java, line(s) 10
com/m3u8/download/k/h.java, line(s) 123
com/szcx/lib/encrypt/b.java, line(s) 14
com/szcx/lib/encrypt/e/a.java, line(s) 10
com/szcx/lib/encrypt/e/b.java, line(s) 22
com/szcx/lib/encrypt/e/c.java, line(s) 25
com/tencent/mm/uitls/h2.java, line(s) 125
com/tencent/mm/uitls/n2.java, line(s) 60
jaygoo/library/m3u8downloader/p/c.java, line(s) 9

中危 应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据 

应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#external-storage

Files:
c/a/a/a/i/d.java, line(s) 142,170
c/b/a/c.java, line(s) 48
com/danikula/videocache/s.java, line(s) 15,32
com/fynnjason/utils/q.java, line(s) 81
com/github/mikephil/charting/charts/Chart.java, line(s) 302,349
com/jiajunhui/xapp/medialoader/h/e.java, line(s) 59
com/lxj/xpopup/util/d.java, line(s) 168
com/lzy/okgo/convert/FileConvert.java, line(s) 49,57
com/lzy/okserver/OkDownload.java, line(s) 130
com/m3u8/download/b.java, line(s) 164
com/tencent/mm/c.java, line(s) 55
com/tencent/mm/camera/stmobileapi/d.java, line(s) 171
com/tencent/mm/camera/stmobileapi/e.java, line(s) 86
com/tencent/mm/camera/utils/a.java, line(s) 11
com/tencent/mm/glide/GlideAppModule.java, line(s) 45
com/tencent/mm/p/d.java, line(s) 30,31
com/tencent/mm/ui/LaunchActivity.java, line(s) 615,623
com/tencent/mm/ui/game/WebActivity.java, line(s) 179
com/tencent/mm/uitls/a1.java, line(s) 80,83,85,28,44,77
com/tencent/mm/uitls/h2.java, line(s) 69,80
com/tencent/mm/uitls/j0.java, line(s) 18
com/tencent/mm/uitls/k0.java, line(s) 22,23
com/tencent/mm/uitls/n.java, line(s) 61,70
com/tencent/mm/uitls/t1.java, line(s) 73
com/tencent/mm/uitls/y1.java, line(s) 24,45
com/vector/update_app/c.java, line(s) 189,197
com/watermark/androidwm/utils/a.java, line(s) 67
com/yalantis/ucrop/l/f.java, line(s) 144
jaygoo/library/m3u8downloader/f.java, line(s) 33
top/zibin/luban/g.java, line(s) 78,80

中危 文件可能包含硬编码的敏感信息，如用户名、密码、密钥等 

文件可能包含硬编码的敏感信息，如用户名、密码、密钥等
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#checking-memory-for-sensitive-data-mstg-storage-10

Files:
com/lzy/okgo/cache/CacheEntity.java, line(s) 13,85
com/lzy/okgo/exception/CacheException.java, line(s) 15,11
com/m3u8/download/Progress.java, line(s) 51,13,29
com/tencent/mm/bean/AppStartBean.java, line(s) 114

中危 应用程序使用不安全的随机数生成器 

应用程序使用不安全的随机数生成器
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-random-number-generators

Files:
c/c/a/b/e/b.java, line(s) 23
c/c/a/e/b.java, line(s) 7
com/m3u8/download/k/h.java, line(s) 18
com/sackcentury/shinebuttonlib/ShineView.java, line(s) 15
com/scwang/smartrefresh/header/FunGameBattleCityHeader.java, line(s) 16
com/scwang/smartrefresh/header/TaurusHeader.java, line(s) 27
com/scwang/smartrefresh/header/b/a.java, line(s) 8
com/tencent/mm/f/f/b.java, line(s) 6
com/tencent/mm/uitls/n2.java, line(s) 12
com/tencent/mm/view/LikeView.java, line(s) 18
com/tencent/mm/view/LoveView.java, line(s) 16
com/tencent/mm/view/MusicalNoteLayout.java, line(s) 28
com/tencent/mm/view/ShortVideoPlayer.java, line(s) 22
com/tencent/qmsp/sdk/f/c.java, line(s) 6
com/vector/update_app/g/b.java, line(s) 6
f/b/n/b.java, line(s) 22
org/greenrobot/greendao/n/f.java, line(s) 7
org/jsoup/helper/c.java, line(s) 23

中危 可能存在跨域漏洞。在 WebView 中启用从 URL 访问文件可能会泄漏文件系统中的敏感信息 

可能存在跨域漏洞。在 WebView 中启用从 URL 访问文件可能会泄漏文件系统中的敏感信息
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#static-analysis-6

Files:
com/tencent/mm/ui/H5Activity.java, line(s) 106,98
com/tencent/mm/ui/WebViewActivity.java, line(s) 249,241
com/tencent/mm/ui/game/WebActivity.java, line(s) 306,302

中危 应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库 

应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04h-Testing-Code-Quality.md#injection-flaws-mstg-arch-2-and-mstg-platform-2

Files:
c/c/a/b/d/c.java, line(s) 4,5,26
c/c/a/e/h.java, line(s) 5,6,22
com/danikula/videocache/v/a.java, line(s) 6,7,60
com/lzy/okgo/db/DBHelper.java, line(s) 4,5,32,33,34,35,46,49,52,55
com/lzy/okgo/db/DBUtils.java, line(s) 4,16,45,73
com/m3u8/download/h/c.java, line(s) 4,5,25,36
com/m3u8/download/h/d.java, line(s) 4,15,44,72
org/greenrobot/greendao/j/f.java, line(s) 5,61

中危 IP地址泄露 

IP地址泄露


Files:
com/danikula/videocache/i.java, line(s) 23
org/nanohttpd/protocols/http/b.java, line(s) 603

中危 应用程序创建临时文件。敏感信息永远不应该被写进临时文件 

应用程序创建临时文件。敏感信息永远不应该被写进临时文件


Files:
com/sun/jna/Native.java, line(s) 756
com/tencent/mm/ui/RecordActivity.java, line(s) 556
org/junit/e/j.java, line(s) 15,71
org/nanohttpd/protocols/http/g/a.java, line(s) 14

中危 SHA-1是已知存在哈希冲突的弱哈希 

SHA-1是已知存在哈希冲突的弱哈希
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
c/c/c/a/f/f/e.java, line(s) 78
com/tencent/mm/ui/LaunchActivity.java, line(s) 541
f/b/n/b.java, line(s) 179

中危 此应用可能包含硬编码机密信息 

从应用程序中识别出以下机密确保这些不是机密或私人信息
"library_roundedimageview_authorWebsite" : "https://github.com/vinc3m1"
63F06F99D823D33AAB89A0A93DECFEE0
57baaaeaad4e4fda8bdaceafdb9d45c2
e096db7c006958f226bc469c27237b65
DQ0dDWk4aT5rOzs4OD00Pms/OjoyCjAhITEJKjIl
04c9fb02a8c30ae84aa2f943e873af2d
9A04F079-9840-4286-AB92-E65BE0885F95
c36e048e284c459686133e66a79e2eba
75bc6c5227314e63bbfd5d9f0c5c28e4
ca3a2848d4e4417eb6ebfbffdc1f3212
6BBBBAAD-3430-406E-A937-F47917E51112
1aec3637270f465faae52713a7c191c8
81d7beac44a86f4337f534ec93328370
f30dd5f2f09c405c98e7eb6c06c89928
e392fd6aa2abf5633a4f06bc82b85535
A2B55680-6F43-11E0-9A3F-0002A5D5C51B
ac655948c705413b8a63a7aaefd4cde9
f6221d5fb903924aa6bc0b9653415e4316318839
e4c8836bfe154d76a808da38d0733304
9d451a2da3cf42b0a049ba3e249222bc
BwcnBzRjN2U/MmZhYjRmND4xPjI+NWQwZWU0YmI2MWQ3YjAzKw8cEywsIS4BIg==

信息 应用程序记录日志信息,不得记录敏感信息 

应用程序记录日志信息,不得记录敏感信息
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#logs

Files:
b/c/a/a/a.java, line(s) 98,101
b/c/a/a/c.java, line(s) 90,92
b/c/a/a/d.java, line(s) 142,144
b/c/a/a/f.java, line(s) 168,170
b/e/b/b.java, line(s) 61,122,136
b/e/b/c.java, line(s) 29,78
b/e/b/e.java, line(s) 145
b/h/a/a.java, line(s) 191,221,230
b/i/b/a.java, line(s) 166,171,178,182,198,208
b/j/a.java, line(s) 155,411,422
b/k/b.java, line(s) 95
c/a/a/a/h/p.java, line(s) 112
c/a/a/a/i/d.java, line(s) 34,53,66,93,119,133,164,175,186
c/a/a/a/i/k.java, line(s) 83,171,186
c/a/c/a/a/b.java, line(s) 222,109,277
c/c/a/b/e/c.java, line(s) 25,31,37,68,53,112,132
c/c/b/a/a/a.java, line(s) 10,10,14,14,18,18,56,22,22,26,26
c/c/c/a/f/b/a.java, line(s) 38,56
c/c/c/a/f/b/b.java, line(s) 19,28,22
cn/bingoogolapple/qrcode/core/a.java, line(s) 47,57
com/alexvasilkov/gestures/e/c.java, line(s) 68,84,105,167,181,272,324,345,397,483,498,505,512,524,532,540,548
com/alexvasilkov/gestures/f/d.java, line(s) 46,33,35
com/alexvasilkov/gestures/g/c.java, line(s) 44,59,112,137
com/alexvasilkov/gestures/g/e.java, line(s) 62,71,89,116,146,176,207
com/coremedia/iso/boxes/sampleentry/AudioSampleEntry.java, line(s) 192
com/danikula/videocache/h.java, line(s) 37,43,53,64,75
com/davemorrissey/labs/subscaleview/SubsamplingScaleImageView.java, line(s) 642,210,214,390,394,462,796,801,812,821,1531,1728,2058
com/davemorrissey/labs/subscaleview/decoder/SkiaPooledImageRegionDecoder.java, line(s) 121
com/dhh/websocket/d.java, line(s) 61,150,186,213,196
com/fynnjason/utils/j.java, line(s) 11
com/fynnjason/utils/q.java, line(s) 109,197,199
com/github/mikephil/charting/charts/BarChart.java, line(s) 129
com/github/mikephil/charting/charts/BarLineChartBase.java, line(s) 189,337,479,208,302,308,722,812,816
com/github/mikephil/charting/charts/Chart.java, line(s) 710,864,208,257,615,620,661
com/github/mikephil/charting/charts/CombinedChart.java, line(s) 137
com/github/mikephil/charting/charts/HorizontalBarChart.java, line(s) 194,166,170
com/github/mikephil/charting/components/a.java, line(s) 219
com/github/mikephil/charting/data/LineDataSet.java, line(s) 150,158
com/github/mikephil/charting/data/PieEntry.java, line(s) 18,26
com/github/mikephil/charting/data/k.java, line(s) 181
com/github/mikephil/charting/data/l.java, line(s) 44,51,58
com/github/mikephil/charting/listener/a.java, line(s) 198
com/github/ybq/android/spinkit/c/d.java, line(s) 172
com/itheima/roundedimageview/RoundedImageView.java, line(s) 137,155
com/itheima/roundedimageview/b.java, line(s) 226
com/jiajunhui/xapp/medialoader/b.java, line(s) 61,80,90,131
com/jiajunhui/xapp/medialoader/bean/a.java, line(s) 59,93
com/kk/taurus/playerbase/d/a.java, line(s) 18
com/kk/taurus/playerbase/f/b.java, line(s) 10,16,22
com/lxj/xpopup/util/XPermission.java, line(s) 110
com/lxj/xpopup/widget/a.java, line(s) 30
com/lzy/okgo/utils/OkLogger.java, line(s) 42,53,59,65,71
com/m3u8/download/c.java, line(s) 52
com/m3u8/download/d.java, line(s) 339
com/m3u8/download/i/b.java, line(s) 60,64
com/m3u8/download/k/d.java, line(s) 15,25,35,48,58
com/m3u8/download/k/e.java, line(s) 26
com/makeramen/roundedimageview/RoundedDrawable.java, line(s) 147
com/makeramen/roundedimageview/RoundedImageView.java, line(s) 136,154
com/nineoldandroids/animation/PropertyValuesHolder.java, line(s) 61,82,150,152,189,191,256,274,276,368,370,460,462
com/sackcentury/shinebuttonlib/PorterImageView.java, line(s) 110
com/sackcentury/shinebuttonlib/ShineButton.java, line(s) 323,343
com/scwang/smartrefresh/header/waveswipe/WaveView.java, line(s) 170
com/scwang/smartrefresh/layout/SmartRefreshLayout.java, line(s) 1268
com/scwang/smartrefresh/layout/internal/pathview/a.java, line(s) 547,552
com/sun/jna/Native.java, line(s) 104,410,457,951,954,1016,1019,422,427,435,450,455,464,477,481,502,508,540,543,544,706,729,740
com/sun/jna/Structure.java, line(s) 309,1201
com/sun/jna/r.java, line(s) 375,383,394,400,403,414,425,432,437,444,449,456,461,496
com/szcx/lib/encrypt/c.java, line(s) 113
com/szcx/lib/encrypt/d.java, line(s) 10
com/tbruyelle/rxpermissions3/d.java, line(s) 47,57
com/tencent/mm/TrafficStats/TrafficBean.java, line(s) 115,131,205,220,82,109,126,144,148,162,108,121,143,157,199,211,232,244
com/tencent/mm/activity/ChangeFaceUploadActivity.java, line(s) 104,146
com/tencent/mm/activity/TakeOffActivity.java, line(s) 82
com/tencent/mm/adapter/e4/i.java, line(s) 110,111,113,116
com/tencent/mm/adapter/i3.java, line(s) 63,67,78
com/tencent/mm/adapter/w0.java, line(s) 126,127,129,132
com/tencent/mm/base/l.java, line(s) 24
com/tencent/mm/bean/hot/HotBean.java, line(s) 58,63
com/tencent/mm/camera/stmobileapi/d.java, line(s) 87,94,101,111,128,135,145,152,165,56,82
com/tencent/mm/camera/stmobileapi/e.java, line(s) 126,142,159,166,179,209,225,34,57,82,103,110,117,149,186,193,200
com/tencent/mm/camera/utils/b.java, line(s) 107,112,121,32,138
com/tencent/mm/camera/utils/c.java, line(s) 49,55,66
com/tencent/mm/camera/widget/MagicImageView.java, line(s) 40
com/tencent/mm/database/a.java, line(s) 18,34
com/tencent/mm/database/d.java, line(s) 28
com/tencent/mm/f/c/a/a.java, line(s) 100,109,202,51,46,87
com/tencent/mm/f/c/a/b.java, line(s) 86,107
com/tencent/mm/f/c/b/a.java, line(s) 148,48,40
com/tencent/mm/f/c/b/b.java, line(s) 126,131,136,257,278,78,212,281
com/tencent/mm/f/c/b/c.java, line(s) 61,66,90
com/tencent/mm/f/d/a/e/n.java, line(s) 76,94
com/tencent/mm/f/f/b.java, line(s) 26
com/tencent/mm/glide/d.java, line(s) 74
com/tencent/mm/i/c.java, line(s) 16,27,38,49,60,71,81
com/tencent/mm/location/AlxLocationService.java, line(s) 37,43,62,68,87,93,126,129,131,133,153,160,170,176,185,205,214,217,220,227,230,238,240,249,259
com/tencent/mm/network/f.java, line(s) 620,2104,2172,2227,2520
com/tencent/mm/p/a.java, line(s) 18,29
com/tencent/mm/p/d.java, line(s) 44,48,52,56,169
com/tencent/mm/s/a.java, line(s) 12,17,21,25,29
com/tencent/mm/ui/ChangeCodeActivity.java, line(s) 61
com/tencent/mm/ui/ChatDetailActivity.java, line(s) 50
com/tencent/mm/ui/ContentEditActivity.java, line(s) 191
com/tencent/mm/ui/CunstomDetailActivity.java, line(s) 42,47,103
com/tencent/mm/ui/H5Activity.java, line(s) 44
com/tencent/mm/ui/ImagesActivity.java, line(s) 136
com/tencent/mm/ui/LaunchActivity.java, line(s) 645
com/tencent/mm/ui/MyAccountActivity.java, line(s) 83,88
com/tencent/mm/ui/OrderUploadImgActivity.java, line(s) 58
com/tencent/mm/ui/ScanQrCodeActivity.java, line(s) 77
com/tencent/mm/ui/VideoChoiceActivity.java, line(s) 136
com/tencent/mm/ui/WebViewActivity.java, line(s) 268
com/tencent/mm/ui/game/WebActivity.java, line(s) 66,72,77,93,214,222,229,239,245,251
com/tencent/mm/ui/game/q/c.java, line(s) 103,37,54,71,88,112,170,224
com/tencent/mm/ui/game/q/e/a.java, line(s) 34,40,43,62,65
com/tencent/mm/ui/game/q/e/b.java, line(s) 37,40
com/tencent/mm/ui/game/q/e/c.java, line(s) 33,51,54,67,68,81,93,105,125
com/tencent/mm/ui/game/q/e/d.java, line(s) 26,45,48
com/tencent/mm/ui/game/q/e/e.java, line(s) 49
com/tencent/mm/ui/game/q/g/c.java, line(s) 60,72,84,96,121,133,145,157,169,181,193,205,217,229
com/tencent/mm/uitls/b0.java, line(s) 11,22,40,46,53,57,60
com/tencent/mm/uitls/i1.java, line(s) 17,12
com/tencent/mm/uitls/i2.java, line(s) 34
com/tencent/mm/uitls/j.java, line(s) 94,184
com/tencent/mm/uitls/k0.java, line(s) 146
com/tencent/mm/uitls/v2/b.java, line(s) 70,76,81,84,87,130,152,203
com/tencent/mm/uitls/v2/c.java, line(s) 28,57,80,85,89,108,122,135
com/tencent/mm/uitls/v2/d.java, line(s) 22,61,73,86
com/tencent/mm/uitls/v2/e.java, line(s) 61
com/tencent/mm/uitls/v2/f.java, line(s) 47,55
com/tencent/mm/uitls/v2/h.java, line(s) 18,22,35
com/tencent/mm/uitls/v2/i.java, line(s) 21,114
com/tencent/mm/uitls/w.java, line(s) 144
com/tencent/mm/uitls/x.java, line(s) 128,146
com/tencent/mm/videoplayer/ContentVideoPlayer.java, line(s) 563,1092,1241,1286,1530
com/tencent/mm/videoplayer/NormalVideoPlayer.java, line(s) 287,684
com/tencent/mm/videoplayer/NormalVideoPlayer2.java, line(s) 167,174
com/tencent/mm/view/BubbleImageView.java, line(s) 99,100,101,102
com/tencent/mm/view/JudgeNestedScrollView.java, line(s) 37
com/tencent/mm/view/VerticalViewPager.java, line(s) 1582,1588,1600
com/tencent/mm/view/update/OkGoUpdateHttpUtil.java, line(s) 32
com/tencent/qmsp/sdk/base/e.java, line(s) 11,21,27
com/tencent/qmsp/sdk/f/g.java, line(s) 11,21,27,33
com/tencent/qmsp/sdk/g/e/d.java, line(s) 20
com/vector/update_app/c.java, line(s) 355
com/vincent/videocompressor/VideoController.java, line(s) 61
com/wang/avi/AVLoadingIndicatorView.java, line(s) 332
com/yalantis/ucrop/UCropActivity.java, line(s) 630
com/yalantis/ucrop/k/a.java, line(s) 92,105,184,146
com/yalantis/ucrop/k/b.java, line(s) 52,102,108,115,152,155
com/yalantis/ucrop/l/a.java, line(s) 58,146,180,182,206
com/yalantis/ucrop/l/d.java, line(s) 75
com/yalantis/ucrop/l/f.java, line(s) 152
com/yalantis/ucrop/l/g.java, line(s) 135,148,155,162,172,183,190,197,208,258,268,280,294,310,320,323,326,329,332,346,351,364,369,257,267,279,293,309,319,322,325,328,331,345,350,363,368
com/yalantis/ucrop/view/TransformImageView.java, line(s) 186,228,78,280
com/youngfeng/snake/e/h.java, line(s) 14,21
e/b/a.java, line(s) 261
e/b/c.java, line(s) 12
e/c/b.java, line(s) 28,104,122
eightbitlab/com/blurview/BlurView.java, line(s) 85
f/c/a/d.java, line(s) 15,18,24
h/a/b.java, line(s) 216,234
jaygoo/library/m3u8downloader/p/b.java, line(s) 11,17
jaygoo/library/m3u8downloader/p/e.java, line(s) 21
me/jessyan/autosize/AutoSize.java, line(s) 108
me/jessyan/autosize/AutoSizeConfig.java, line(s) 322,335,348,244
me/jessyan/autosize/DefaultAutoAdaptStrategy.java, line(s) 21,31,34,15,28
me/jessyan/autosize/utils/AutoSizeLog.java, line(s) 15,21,35
org/greenrobot/eventbus/b.java, line(s) 41
org/greenrobot/eventbus/c.java, line(s) 190,141,150,152,457
org/greenrobot/eventbus/util/ErrorDialogManager.java, line(s) 174
org/greenrobot/eventbus/util/a.java, line(s) 36
org/greenrobot/eventbus/util/b.java, line(s) 46
org/greenrobot/eventbus/util/d.java, line(s) 30
org/greenrobot/greendao/d.java, line(s) 19,23,31,39,43,47,55,59,27,63,67,71
org/joda/time/tz/a.java, line(s) 337,338,363
org/joda/time/tz/f.java, line(s) 54,229,230,231,232,233,242,258,338,357,370,382,385,390,456
pub/devrel/easypermissions/b.java, line(s) 133,135,34
pub/devrel/easypermissions/g/a.java, line(s) 37
pub/devrel/easypermissions/g/c.java, line(s) 19
rx/internal/util/e.java, line(s) 63
rx/internal/util/j.java, line(s) 23
rx/s/c.java, line(s) 264
top/zibin/luban/Checker.java, line(s) 136,150,178,186,190
top/zibin/luban/f.java, line(s) 358,357
top/zibin/luban/g.java, line(s) 24
top/zibin/luban/k/i.java, line(s) 111,151,112,152

信息 此应用程序将数据复制到剪贴板。敏感数据不应复制到剪贴板，因为其他应用程序可以访问它 

此应用程序将数据复制到剪贴板。敏感数据不应复制到剪贴板，因为其他应用程序可以访问它
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04b-Mobile-App-Security-Testing.md#clipboard

Files:
c/c/a/g/g.java, line(s) 4,33
com/tencent/mm/adapter/c2.java, line(s) 4,25
com/tencent/mm/adapter/k2.java, line(s) 4,23
com/tencent/mm/ui/ShareActivity.java, line(s) 5,136
com/tencent/mm/ui/WebViewActivity.java, line(s) 5,99
com/tencent/mm/ui/dialog/ComicSharePopup.java, line(s) 4,32
com/tencent/mm/ui/dialog/ShareButtomDialog.java, line(s) 4,85
com/tencent/mm/ui/dialog/ShareFanGroupDialog.java, line(s) 4,62
com/tencent/mm/ui/dialog/ShareSeeMoreDialog.java, line(s) 4,68
com/tencent/mm/ui/dialog/VideoShareHPopup.java, line(s) 4,32
com/tencent/mm/ui/dialog/VideoSharePopup.java, line(s) 4,32
com/tencent/mm/uitls/q.java, line(s) 4,38
com/tencent/mm/uitls/r.java, line(s) 4,10

信息 此应用程序使用SQL Cipher。SQLCipher为sqlite数据库文件提供256位AES加密 

此应用程序使用SQL Cipher。SQLCipher为sqlite数据库文件提供256位AES加密


Files:
org/greenrobot/greendao/j/b.java, line(s) 22,6,18

安全 此应用程序使用SSL Pinning 来检测或防止安全通信通道中的MITM攻击 

此应用程序使用SSL Pinning 来检测或防止安全通信通道中的MITM攻击
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#testing-custom-certificate-stores-and-certificate-pinning-mstg-network-4

Files:
com/danikula/videocache/k.java, line(s) 74,71,76
com/lzy/okgo/https/HttpsUtils.java, line(s) 122,71,88,121,109,120,120
com/m3u8/download/g.java, line(s) 147,96,113,146,134,145,145
org/nanohttpd/protocols/http/NanoHTTPD.java, line(s) 166,144,164,166,163,163

安全 此应用程序可能具有Root检测功能 

此应用程序可能具有Root检测功能
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05j-Testing-Resiliency-Against-Reverse-Engineering.md#testing-root-detection-mstg-resilience-1

Files:
c/c/a/b/e/d.java, line(s) 45,34

安全 此应用程序没有隐私跟踪程序 

此应用程序不包括任何用户或设备跟踪器。在静态分析期间没有找到任何跟踪器。

关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (api.t.sina.com.cn) 通信。 

{'ip': '49.7.37.74', 'country_short': 'CN', 'country_long': '中国', 'region': '北京', 'city': '北京', 'latitude': '39.907501', 'longitude': '116.397102'}

关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (open-image.nosdn.127.net) 通信。 

{'ip': '58.221.28.238', 'country_short': 'CN', 'country_long': '中国', 'region': '江苏', 'city': '南通', 'latitude': '32.030296', 'longitude': '120.874779'}

关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (mov.bn.netease.com) 通信。 

{'ip': '61.160.227.227', 'country_short': 'CN', 'country_long': '中国', 'region': '江苏', 'city': '常州', 'latitude': '31.783331', 'longitude': '119.966667'}

安全评分: ( 50度灰 6.2.0)