安全分析报告： NewPipe v0.27.0

[android:allowBackup=true]
这个标志允许任何人通过adb备份你的应用程序数据。它允许已经启用了USB调试的用户从设备上复制应用程序数据。

[android:exported=true]
发现 Broadcast Receiver与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

[android:exported=true]
发现 Service与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

[android:exported=true]
发现 Activity与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

[android:exported=true]
发现 Activity与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

[android:exported=true]
发现 Activity与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

Permission: android.permission.BIND_JOB_SERVICE [android:exported=true]
发现一个 Service被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

Permission: android.permission.DUMP [android:exported=true]
发现一个 Broadcast Receiver被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

Permission: android.permission.DUMP [android:exported=true]
发现一个 Broadcast Receiver被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#external-storage

Files:
org/acra/file/Directory.java, line(s) 50,100
org/schabi/newpipe/settings/NewPipeSettings.java, line(s) 54
org/schabi/newpipe/streams/io/StoredFileHelper.java, line(s) 460,469
org/schabi/newpipe/util/FilePickerActivityHelper.java, line(s) 51,95,98,99
us/shandian/giga/service/DownloadManager.java, line(s) 54,449

应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04h-Testing-Code-Quality.md#injection-flaws-mstg-arch-2-and-mstg-platform-2

Files:
us/shandian/giga/get/sqlite/FinishedMissionStore.java, line(s) 6,7,28,34,38,55

应用程序使用不安全的随机数生成器
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-random-number-generators

Files:
j$/util/concurrent/ThreadLocalRandom.java, line(s) 14
org/schabi/newpipe/extractor/services/youtube/YoutubeParsingHelper.java, line(s) 30
org/schabi/newpipe/extractor/utils/RandomStringFromAlphabetGenerator.java, line(s) 3

文件可能包含硬编码的敏感信息，如用户名、密码、密钥等
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#checking-memory-for-sensitive-data-mstg-storage-10

Files:
org/jsoup/parser/TokeniserState.java, line(s) 1224,1227

此应用程序有多个1隐私跟踪程序。跟踪器可以跟踪设备或用户，是终端用户的隐私问题。

从应用程序中识别出以下机密确保这些不是机密或私人信息
"add_to_playlist_key" : "add_to_playlist"
"adjustment_step_key" : "adjustment_step_key"
"allow_disposed_exceptions_key" : "allow_disposed_exceptions_key"
"allow_heap_dumping_key" : "allow_heap_dumping_key"
"always_use_exoplayer_set_output_surface_workaround_key" : "always_use_exoplayer_set_output_surface_workaround_key"
"app_language_key" : "app_language_key"
"audio_m4a_key" : "audio_m4a"
"audio_webm_key" : "audio_webm"
"auto_device_theme_key" : "auto_device_theme"
"auto_queue_key" : "auto_queue_key"
"autoplay_always_key" : "autoplay_always_key"
"autoplay_key" : "autoplay_key"
"autoplay_never_key" : "autoplay_never_key"
"autoplay_wifi_key" : "autoplay_wifi_key"
"background_player_key" : "background_player"
"best_resolution_key" : "best_resolution"
"black_theme_key" : "black_theme"
"brightness_control_key" : "brightness_control"
"caption_settings_key" : "caption_settings_key"
"caption_user_set_key" : "caption_user_set_key"
"clear_cookie_key" : "clear_cookie"
"clear_playback_states_key" : "clear_playback_states"
"clear_search_history_key" : "clear_search_history"
"clear_views_history_key" : "clear_play_history"
"content_country_key" : "content_country"
"content_language_key" : "content_language"
"dark_theme_key" : "dark_theme"
"debug_pref_screen_key" : "debug_pref_screen_key"
"default_audio_format_key" : "default_audio_format"
"default_localization_key" : "system"
"default_popup_resolution_key" : "default_popup_resolution"
"default_resolution_key" : "default_resolution"
"default_video_format_key" : "default_video_format"
"disable_media_tunneling_key" : "disable_media_tunneling_key"
"disabled_media_tunneling_automatically_key" : "disabled_media_tunneling_automatically_key"
"download_key" : "download"
"download_path_audio_key" : "download_path_audio"
"download_path_video_key" : "download_path"
"enable_playback_resume_key" : "enable_playback_resume"
"enable_playback_state_lists_key" : "enable_playback_state_lists"
"enable_search_history_key" : "enable_search_history"
"enable_watch_history_key" : "enable_watch_history"
"exoplayer_settings_key" : "exoplayer_settings_key"
"feed_fetch_channel_tabs_key" : "feed_fetch_channel_tabs"
"feed_show_future_items_key" : "feed_show_future_items"
"feed_show_partially_watched_items_key" : "feed_show_partially_watched_items"
"feed_show_watched_items_key" : "feed_show_played_items"
"feed_use_dedicated_fetch_method_key" : "feed_use_dedicated_fetch_method"
"image_quality_high_key" : "image_quality_high"
"image_quality_key" : "image_quality_key"
"image_quality_low_key" : "image_quality_low"
"image_quality_medium_key" : "image_quality_medium"
"image_quality_none_key" : "image_quality_none"
"last_download_type_audio_key" : "last_dl_type_audio"
"last_download_type_video_key" : "last_dl_type_video"
"left_gesture_control_key" : "left_gesture_control"
"light_theme_key" : "light_theme"
"limit_data_usage_none_key" : "limit_data_usage_none"
"limit_mobile_data_usage_key" : "limit_mobile_data_usage"
"list_view_mode_auto_key" : "auto"
"list_view_mode_card_key" : "card"
"list_view_mode_grid_key" : "grid"
"list_view_mode_key" : "list_view_mode"
"list_view_mode_list_key" : "list"
"main_page_content_key" : "main_page_content"
"main_tabs_position_key" : "main_tabs_position"
"metadata_cache_wipe_key" : "cache_wipe_key"
"metadata_privacy_private" : "Private"
"minimize_on_exit_background_key" : "minimize_on_exit_background_key"
"minimize_on_exit_key" : "minimize_on_exit_key"
"minimize_on_exit_none_key" : "minimize_on_exit_none_key"
"minimize_on_exit_popup_key" : "minimize_on_exit_popup_key"
"night_theme_key" : "night_theme"
"none_control_key" : "none_control"
"notification_colorize_key" : "notification_colorize_key"
"notification_slot_0_key" : "notification_slot_0_key"
"notification_slot_1_key" : "notification_slot_1_key"
"notification_slot_2_key" : "notification_slot_2_key"
"notification_slot_3_key" : "notification_slot_3_key"
"notification_slot_4_key" : "notification_slot_4_key"
"notification_slot_compact_0_key" : "notification_slot_compact_0_key"
"notification_slot_compact_1_key" : "notification_slot_compact_1_key"
"notification_slot_compact_2_key" : "notification_slot_compact_2_key"
"peertube_instance_list_key" : "peertube_instance_list"
"peertube_instance_setup_key" : "peertube_instance_setup"
"peertube_selected_instance_key" : "peertube_selected_instance"
"playback_adjust_by_semitones_key" : "playback_adjust_by_semitones_key"
"playback_pitch_key" : "playback_pitch_key"
"playback_skip_silence_key" : "playback_skip_silence_key"
"playback_speed_key" : "playback_speed_key"
"playback_unhook_key" : "playback_unhook_key"
"player_notification_screen_key" : "player_notification_screen"
"popup_player_key" : "popup_player"
"popup_remember_size_pos_key" : "popup_remember_size_pos_key"
"popup_saved_width_key" : "popup_saved_width"
"popup_saved_x_key" : "popup_saved_x"
"popup_saved_y_key" : "popup_saved_y"
"prefer_descriptive_audio_key" : "prefer_descriptive_audio"
"prefer_original_audio_key" : "prefer_original_audio"
"progressive_load_interval_key" : "progressive_load_interval"
"recaptcha_cookies_key" : "recaptcha_cookies_key"
"resume_on_audio_focus_gain_key" : "resume_on_audio_focus_gain"
"right_gesture_control_key" : "right_gesture_control"
"saved_tabs_key" : "saved_tabs_key"
"scale_to_square_image_in_notifications_key" : "scale_to_square_image_in_notifications"
"screen_brightness_key" : "screen_brightness_key"
"screen_brightness_timestamp_key" : "screen_brightness_timestamp_key"
"seek_duration_key" : "seek_duration"
"seekbar_preview_thumbnail_key" : "seekbar_preview_thumbnail_key"
"settings_file_charset_key" : "file_rename_charset"
"settings_file_replacement_character_key" : "file_replacement_character"
"show_channel_tabs_key" : "channel_tabs"
"show_comments_key" : "show_comments"
"show_description_key" : "show_description"
"show_higher_resolutions_key" : "show_higher_resolutions"
"show_image_indicators_key" : "show_image_indicators_key"
"show_info_key" : "show_info"
"show_local_search_suggestions_key" : "show_local_search_suggestions"
"show_memory_leaks_key" : "show_memory_leaks_key"
"show_meta_info_key" : "show_meta_info"
"show_next_video_key" : "show_next_video"
"show_original_time_ago_key" : "show_original_time_ago_key"
"show_play_with_kodi_key" : "show_play_with_kodi"
"show_remote_search_suggestions_key" : "show_remote_search_suggestions"
"show_search_suggestions_key" : "show_search_suggestions"
"show_thumbnail_key" : "show_thumbnail_key"
"start_main_player_fullscreen_key" : "start_main_player_fullscreen_key"
"stream_info_selected_tab_key" : "stream_info_selected_tab"
"streams_notifications_channels_key" : "streams_notifications_channels"
"streams_notifications_interval_key" : "streams_notifications_interval"
"streams_notifications_network_key" : "streams_notifications_network"
"tablet_mode_auto_key" : "auto"
"tablet_mode_key" : "tablet_mode"
"tablet_mode_off_key" : "off"
"tablet_mode_on_key" : "on"
"theme_key" : "theme"
"use_exoplayer_decoder_fallback_key" : "use_exoplayer_decoder_fallback_key"
"use_external_audio_player_key" : "use_external_audio_player"
"use_external_video_player_key" : "use_external_video_player"
"use_inexact_seek_key" : "use_inexact_seek_key"
"video_3gp_key" : "video_3gp"
"video_mp4_key" : "video_mp4"
"video_player_key" : "video_player"
"video_webm_key" : "video_webm"
"volume_control_key" : "volume_control"
"metadata_privacy_private" : "Privat"
"metadata_privacy_private" : "Privat"
"metadata_privacy_private" : "Privat"
"metadata_privacy_private" : "Yksityinen"
"metadata_privacy_private" : "Privado"
"metadata_privacy_private" : "Prywatny"
"metadata_privacy_private" : "Privasi"
"metadata_privacy_private" : "Privat"
"metadata_privacy_private" : "Private"
"metadata_privacy_private" : "Privatno"
"metadata_privacy_private" : "Gizli"
"metadata_privacy_private" : "Privado"
"metadata_privacy_private" : "Einka"
"metadata_privacy_private" : "Privaatne"
"metadata_privacy_private" : "Privato"
"metadata_privacy_private" : "Privatus"
"metadata_privacy_private" : "Privado"
"metadata_privacy_private" : "Pribatua"
"metadata_privacy_private" : "Privat"
"metadata_privacy_private" : "Privado"
"metadata_privacy_private" : "Pribado"
"metadata_privacy_private" : "Private"
"metadata_privacy_private" : "Privadu"
"metadata_privacy_private" : "Privata"
"metadata_privacy_private" : "Privat"
"metadata_privacy_private" : "Privado"
7591e8039faa74d8c0517dc867af9d3e
cb84069bd68116bafae5ee4ee5b08a567aa6d898404e7cb12f9e756df5cf5cab
d3fe862898d1b6d0c97c76386b82dd78