安全分析报告： 新蜘蛛纸牌 v1.0.2

安全分数


安全分数 33/100

风险评级


等级

  1. A
  2. B
  3. C
  4. F

严重性分布 (%)


隐私风险

6

用户/设备跟踪器


调研结果

高危 12
中危 20
信息 2
安全 1
关注 17

高危 基本配置不安全地配置为允许到所有域的明文流量。 

Scope:
*

高危 基本配置配置为绕过证书固定。 

Scope:
*

高危 基本配置配置为信任用户安装的证书。 

Scope:
*

高危 基本配置配置为绕过证书固定。 

Scope:
*

高危 域配置不安全地配置为允许明文流量到达范围内的这些域。 

Scope:
127.0.0.1
bigcakegame.com
hiscoregame.com
chesscardgame.top
spidergame.top
cardmania.top
diguotech.com
i.snssdk.com
is.snssdk.com
pangolin.snssdk.com
extlog.snssdk.com
sf3-ttcdn-tos.pstatp.com
bds.snssdk.com
dig.bdurl.net
api-access.pangolin-sdk-toutiao.com
sf1-fe-tos.pglstatp-toutiao.com
sf1-be-pack.pglstatp-toutiao.com
sf3-fe-tos.pglstatp-toutiao.com
log-api.pangolin-sdk-toutiao.com
s3-fe-scm.pglstatp-toutiao.com
s3a.pstatp.com
api-access.pangolin-sdk-toutiao-b.com
log-api.pangolin-sdk-toutiao-b.com
dm.pstatp.com
www.rcub.ac.in/
toblog.ctobsnssdk.com
sdfp.snssdk.com
tosv.byted.org
sf1-ttcdn-tos.pstatp.com
sf6-fe-tos.pglstatp-toutiao.com
log.snssdk.com
tosv.boe.byted.org
dm.toutiao.com
dm.bytedance.com

高危 域配置配置为信任用户安装的证书。 

Scope:
127.0.0.1
bigcakegame.com
hiscoregame.com
chesscardgame.top
spidergame.top
cardmania.top
diguotech.com
i.snssdk.com
is.snssdk.com
pangolin.snssdk.com
extlog.snssdk.com
sf3-ttcdn-tos.pstatp.com
bds.snssdk.com
dig.bdurl.net
api-access.pangolin-sdk-toutiao.com
sf1-fe-tos.pglstatp-toutiao.com
sf1-be-pack.pglstatp-toutiao.com
sf3-fe-tos.pglstatp-toutiao.com
log-api.pangolin-sdk-toutiao.com
s3-fe-scm.pglstatp-toutiao.com
s3a.pstatp.com
api-access.pangolin-sdk-toutiao-b.com
log-api.pangolin-sdk-toutiao-b.com
dm.pstatp.com
www.rcub.ac.in/
toblog.ctobsnssdk.com
sdfp.snssdk.com
tosv.byted.org
sf1-ttcdn-tos.pstatp.com
sf6-fe-tos.pglstatp-toutiao.com
log.snssdk.com
tosv.boe.byted.org
dm.toutiao.com
dm.bytedance.com

高危 如果一个应用程序使用WebView.loadDataWithBaseURL方法来加载一个网页到WebView，那么这个应用程序可能会遭受跨站脚本攻击 

如果一个应用程序使用WebView.loadDataWithBaseURL方法来加载一个网页到WebView，那么这个应用程序可能会遭受跨站脚本攻击
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#static-analysis-7

Files:
com/firefish/admediation/common/DGAdBaseWebView.java, line(s) 67,8
com/firefish/android/WebActivity.java, line(s) 113,15,16

高危 默认情况下，调用Cipher.getInstance("AES")将返回AES ECB模式。众所周知，ECB模式很弱，因为它导致相同明文块的密文相同 

默认情况下，调用Cipher.getInstance("AES")将返回AES ECB模式。众所周知，ECB模式很弱，因为它导致相同明文块的密文相同
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-block-cipher-mode

Files:
com/oplus/instant/router/b/a.java, line(s) 33
com/oplus/quickgame/sdk/engine/utils/b.java, line(s) 31

高危 不安全的Web视图实现。Web视图忽略SSL证书错误并接受任何SSL证书。此应用程序易受MITM攻击 

不安全的Web视图实现。Web视图忽略SSL证书错误并接受任何SSL证书。此应用程序易受MITM攻击
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#webview-server-certificate-verification

Files:
com/firefish/android/WebActivity.java, line(s) 78,77
com/opos/cmn/biz/web/b/b/b/b.java, line(s) 71,334

高危 应用程序在加密算法中使用ECB模式。ECB模式是已知的弱模式，因为它对相同的明文块[UNK]产生相同的密文 

应用程序在加密算法中使用ECB模式。ECB模式是已知的弱模式，因为它对相同的明文块[UNK]产生相同的密文
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-block-cipher-mode

Files:
cn/thinkingdata/analytics/encrypt/c.java, line(s) 37

高危 SSL的不安全实现。信任所有证书或接受自签名证书是一个关键的安全漏洞。此应用程序易受MITM攻击 

SSL的不安全实现。信任所有证书或接受自签名证书是一个关键的安全漏洞。此应用程序易受MITM攻击
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#android-network-apis

Files:
com/firefish/admediation/network/DGAdCustomSSLSocketFactory.java, line(s) 15,16,17,18,3

高危 应用程序包含隐私跟踪程序 

此应用程序有多个6隐私跟踪程序。跟踪器可以跟踪设备或用户，是终端用户的隐私问题。

中危 基本配置配置为信任系统证书。 

Scope:
*

中危 域配置配置为信任系统证书。 

Scope:
127.0.0.1
bigcakegame.com
hiscoregame.com
chesscardgame.top
spidergame.top
cardmania.top
diguotech.com
i.snssdk.com
is.snssdk.com
pangolin.snssdk.com
extlog.snssdk.com
sf3-ttcdn-tos.pstatp.com
bds.snssdk.com
dig.bdurl.net
api-access.pangolin-sdk-toutiao.com
sf1-fe-tos.pglstatp-toutiao.com
sf1-be-pack.pglstatp-toutiao.com
sf3-fe-tos.pglstatp-toutiao.com
log-api.pangolin-sdk-toutiao.com
s3-fe-scm.pglstatp-toutiao.com
s3a.pstatp.com
api-access.pangolin-sdk-toutiao-b.com
log-api.pangolin-sdk-toutiao-b.com
dm.pstatp.com
www.rcub.ac.in/
toblog.ctobsnssdk.com
sdfp.snssdk.com
tosv.byted.org
sf1-ttcdn-tos.pstatp.com
sf6-fe-tos.pglstatp-toutiao.com
log.snssdk.com
tosv.boe.byted.org
dm.toutiao.com
dm.bytedance.com

中危 应用程序已启用明文网络流量 

[android:usesCleartextTraffic=true]
应用程序打算使用明文网络流量，例如明文HTTP，FTP协议，DownloadManager和MediaPlayer。针对API级别27或更低的应用程序，默认值为“true”。针对API级别28或更高的应用程序，默认值为“false”。避免使用明文流量的主要原因是缺乏机密性，真实性和防篡改保护；网络攻击者可以窃听传输的数据，并且可以在不被检测到的情况下修改它。

中危 Activity (com.firefish.android.unity.UnityPlayerActivity) 未被保护。 

存在一个intent-filter。
发现 Activity与设备上的其他应用程序共享，因此让它可以被设备上的任何其他应用程序访问。intent-filter的存在表明这个Activity是显式导出的。

中危 Broadcast Receiver (com.adjust.sdk.AdjustReferrerReceiver) 受权限保护, 但是应该检查权限的保护级别。 

Permission: android.permission.INSTALL_PACKAGES [android:exported=true]
发现一个 Broadcast Receiver被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

中危 Activity (com.nearme.game.sdk.component.proxy.JumpToProxyActivity) 未被保护。 

[android:exported=true]
发现 Activity与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

中危 Broadcast Receiver (com.nearme.game.sdk.component.proxy.ProxyUserCenterOperateReceiver) 未被保护。 

[android:exported=true]
发现 Broadcast Receiver与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

中危 Service (com.nearme.game.sdk.common.serice.OutPutFileService) 未被保护。 

[android:exported=true]
发现 Service与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

中危 Activity (com.qq.e.ads.ADActivity) 未被保护。 

[android:exported=true]
发现 Activity与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

中危 应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据 

应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#external-storage

Files:
com/bykv/vk/component/ttvideo/utils/d.java, line(s) 36
com/bytedance/b/a/h/n.java, line(s) 86,41,108,118
com/cocos2d/diguo/template/SHUtil.java, line(s) 19
com/cocos2d/diguo/template/UnityShare.java, line(s) 75
com/device/tkO000O00000oO/tkO000O0000O0oO.java, line(s) 133
com/device/tkO00O0000OooO/tkO0000O000000oO.java, line(s) 37
com/github/droidfu/cachefu/AbstractCache.java, line(s) 62,63
com/nearme/game/sdk/GCInternal.java, line(s) 548
com/nearme/game/sdk/common/hook/ProxyInstrumentationImp.java, line(s) 43
com/nearme/plugin/framework/LogUtils.java, line(s) 25
com/nostra13/universalimageloader/utils/StorageUtils.java, line(s) 22,48,48,53,53,58
com/opos/cmn/an/d/b/a.java, line(s) 22,117,136
com/opos/cmn/an/f/a/a/d.java, line(s) 99,109
com/opos/cmn/an/f/c/e.java, line(s) 153
com/opos/cmn/biz/web/a/a/a/a.java, line(s) 44
com/opos/cmn/d/a.java, line(s) 30,34
com/opos/cmn/d/c.java, line(s) 41
com/opos/cmn/d/d.java, line(s) 55,67
com/ss/android/downloadlib/addownload/g.java, line(s) 414
com/ss/android/downloadlib/addownload/j.java, line(s) 242,244
com/ss/android/downloadlib/g/l.java, line(s) 484,83,382
com/tinypiece/android/common/support/FileSupport.java, line(s) 33,269,294

中危 应用程序创建临时文件。敏感信息永远不应该被写进临时文件 

应用程序创建临时文件。敏感信息永远不应该被写进临时文件


Files:
ms/bd/c/Pgl/pblg.java, line(s) 30

中危 IP地址泄露 

IP地址泄露


Files:
cn/thinkingdata/analytics/BuildConfig.java, line(s) 12
cn/thinkingdata/analytics/TDAnalytics.java, line(s) 234
cn/thinkingdata/analytics/TDConfig.java, line(s) 24
cn/thinkingdata/analytics/ThinkingAnalyticsSDK.java, line(s) 490
cn/thinkingdata/analytics/e/e.java, line(s) 41
com/bykv/vk/component/ttvideo/DataLoaderHelper.java, line(s) 750
com/bykv/vk/component/ttvideo/a/c.java, line(s) 44
com/bykv/vk/component/ttvideo/player/r.java, line(s) 63
com/diguo/eventusecase/di/ModuleKt.java, line(s) 247
com/diguo/statistics/di/ModuleKt.java, line(s) 268
com/heytap/nearx/okhttp/extension/BuildConfig.java, line(s) 10
com/heytap/nearx/tap/bv.java, line(s) 8
com/heytap/taphttp/env/ExtDnsHost.java, line(s) 24
com/opos/videocache/c.java, line(s) 103,105,110,205

中危 文件可能包含硬编码的敏感信息，如用户名、密码、密钥等 

文件可能包含硬编码的敏感信息，如用户名、密码、密钥等
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#checking-memory-for-sensitive-data-mstg-storage-10

Files:
com/bykv/vk/component/ttvideo/DataLoaderHelper.java, line(s) 1175,1218,765,880,900
com/bykv/vk/component/ttvideo/TTVideoEngine.java, line(s) 194
com/bykv/vk/openvk/component/video/a/b/i.java, line(s) 115
com/cdo/oaps/ad/Launcher.java, line(s) 53
com/cdo/oaps/ad/OapsKey.java, line(s) 24,57,14
com/diguo/sdk/OppoUnions.java, line(s) 31
com/diguo/sdk/TrackingUtils.java, line(s) 45,40
com/firefish/admediation/DGAdConfig.java, line(s) 58
com/firefish/admediation/common/DGAdBrowser.java, line(s) 18
com/firefish/admediation/common/DGAdKey.java, line(s) 10
com/firefish/android/SpreadPrivacyPolicy.java, line(s) 25
com/firefish/android/unity/GlobalApplication.java, line(s) 69,70
com/nearme/game/sdk/common/model/biz/GameCenterSettings.java, line(s) 120
com/oplus/quickgame/sdk/hall/Constant.java, line(s) 21
com/unity/diguo/LocalConfig.java, line(s) 14,15,18
com/unity/diguo/UnityAdjust.java, line(s) 29

中危 应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库 

应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04h-Testing-Code-Quality.md#injection-flaws-mstg-arch-2-and-mstg-platform-2

Files:
cn/thinkingdata/analytics/e/c.java, line(s) 5,6,7,47,48,54,55,56
cn/thinkingdata/core/sqlite/AbstractTEDatabaseHelper.java, line(s) 6,7,59
com/bykv/vk/openvk/component/video/a/b/b/d.java, line(s) 4,5,14,20,22,26
com/bytedance/b/a/b/b/a.java, line(s) 4,36
com/bytedance/b/a/b/b/b.java, line(s) 4,32,33,43
com/heytap/nearx/b/a/a/c.java, line(s) 4,5,81,82,85,86,40,51,60,63,96
com/opos/acs/st/a/a.java, line(s) 4,5,6,53,55,57,89,90,91,92,103,107
com/opos/acs/st/a/b.java, line(s) 6,87,147
com/opos/cmn/biz/monitor/a/b.java, line(s) 6,7,42
com/opos/cmn/biz/requeststatistic/a/b.java, line(s) 6,7,20
com/opos/videocache/c/d.java, line(s) 6,7,78
com/ss/android/downloadlib/d/b.java, line(s) 4,5,18,23

中危 MD5是已知存在哈希冲突的弱哈希 

MD5是已知存在哈希冲突的弱哈希
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
com/bykv/vk/openvk/component/video/api/f/b.java, line(s) 54
com/cdo/oaps/ad/b.java, line(s) 14
com/diguo/common/Security.java, line(s) 27
com/heytap/nearx/b/a/f.java, line(s) 14
com/heytap/nearx/cloudconfig/util/f.java, line(s) 128,129
com/nearme/plugin/framework/MD5Util.java, line(s) 19,81
com/oplus/quickgame/sdk/engine/ui/MD5Util.java, line(s) 34,102
com/opos/cmn/an/a/c.java, line(s) 19,78
com/opos/cmn/func/dl/base/i/a.java, line(s) 26
com/opos/videocache/h.java, line(s) 69

中危 不安全的Web视图实现。可能存在WebView任意代码执行漏洞 

不安全的Web视图实现。可能存在WebView任意代码执行漏洞
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#testing-javascript-execution-in-webviews-mstg-platform-5

Files:
cn/thinkingdata/analytics/ThinkingAnalyticsSDK.java, line(s) 1153,1152
com/opos/cmn/biz/web/b/b/b/b.java, line(s) 220,230

中危 应用程序使用不安全的随机数生成器 

应用程序使用不安全的随机数生成器
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-random-number-generators

Files:
com/bykv/vk/component/ttvideo/utils/k.java, line(s) 5
com/cdo/oaps/ad/c.java, line(s) 4
com/diguo/sdk/OppoUnions.java, line(s) 21
com/diguo/sdk/TA.java, line(s) 32
com/firefish/admediation/DGAdBidCacheGroup.java, line(s) 16
com/firefish/admediation/DGAdLoader.java, line(s) 8
com/firefish/android/ToolKitHelper.java, line(s) 24
com/firefish/android/unity/GlobalApplication.java, line(s) 57
com/heytap/nearx/tap/fg.java, line(s) 19
com/heytap/nearx/tap/fl.java, line(s) 4
com/heytap/nearx/taphttp/statitics/StatRateHelper.java, line(s) 9
com/heytap/trace/TraceUtils.java, line(s) 11
com/oplus/quickgame/sdk/engine/utils/g.java, line(s) 14
com/zk_oaction/adengine/lk_expression/a.java, line(s) 7
com/zk_oaction/adengine/lk_sdkwrapper/a.java, line(s) 24
com/zk_oaction/adengine/lk_view/k.java, line(s) 9

中危 SHA-1是已知存在哈希冲突的弱哈希 

SHA-1是已知存在哈希冲突的弱哈希
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
XI/K0/XI/XI.java, line(s) 77
com/device/tkO000O0000OoO/tkO000O00000OoO.java, line(s) 151
com/diguo/common/Security.java, line(s) 39
com/heytap/trace/TraceUploadManager.java, line(s) 103
com/oplus/log/d/k.java, line(s) 89
org/repackage/a/a/a/a/c.java, line(s) 59
s_a/s_a/s_a/a/a.java, line(s) 61

中危 可能存在跨域漏洞。在 WebView 中启用从 URL 访问文件可能会泄漏文件系统中的敏感信息 

可能存在跨域漏洞。在 WebView 中启用从 URL 访问文件可能会泄漏文件系统中的敏感信息
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#static-analysis-6

Files:
com/firefish/android/WebActivity.java, line(s) 60,54

中危 此应用可能包含硬编码机密信息 

从应用程序中识别出以下机密确保这些不是机密或私人信息
凭证信息=> "Adjust_App_SecretInfo2" : "1589457115"
凭证信息=> "Adjust_App_SecretInfo3" : "747779962"
凭证信息=> "DiguoTrack_App_ID" : "spidersolitairecardoppo"
腾讯Bugly SDK的=> "BUGLY_APP_CHANNEL" : "oppo_Channel"
凭证信息=> "oppoUnion_appSecret" : "cb6c08925db74328be62d70b2b8a5a4f"
凭证信息=> "com.diguo.thinkingdata.appid" : "bdee06f5add24acf8bcad0c09e1a60c7"
凭证信息=> "Adjust_App_SecretInfo1" : "101574619"
友盟统计的=> "UMENG_APPKEY" : "64a7f47abd4b621232ccab05"
凭证信息=> "app_key" : "030b740662be44d09d3914c90f80882f"
凭证信息=> "TRACKING_APPKEY" : "d98847dbdd743ed0ac5b32e1b32caf3a"
腾讯Bugly SDK的=> "BUGLY_APPID" : "25521fd4cf"
凭证信息=> "Adjust_App_SecretInfo4" : "362876465"
"app_id" : "633930388277627"
"ADMOB_APP_ID" : "ca-app-pub-2402956694788689~6067660842"
"AppLovin_SDK_KEY" : "hVr6lOdyyDpkKtIACXsB5PTZg_OPT3C6mDlVlnk2xTDbCIv8dmntnuVbWH7gwN55fGEWJNgKgrkHrv54gKmaBr"
"opos_mob_reward_spilt_key" : "/"
"opos_mob_reward_without_video_complete_key" : "%s"
b21f44f2769e4dd6be3aee238a8b3afa
12004c4942434f52450e494f0e6c4942434f5245
6be3be9837eae5706c4319ca460947b8
0000016742C00BDA259000000168CE0F13200000016588840DCE7118A0002FBF1C31C3275D78
0e007b79684f7571536c796e7d68736e
0a007f7d6c4b7d6a6e717b7d
2e004f485d48494f104c50495b5b59581050594a5950104f5f5d5059104a5350485d5b59104859514c594e5d48494e59
2400515d5f1c535c56405d5b561c5b5c4657405c535e1c5d411c625d45574062405d545b5e57
1a004b4745065a4d515d460645474a4c46490665474a6a5a414c4f4d
Y29tLmhleXRhcC54Z2FtZS5kaXNwYXRjaC5hY3Rpdml0eS5IYXBEaXNwYXRjaGVyQWN0aXZpdHk=
4f47de3cb79fa82c87e49ef127404eb1
Y29tLmhleXRhcC5vcGVuaWQuSU9wZW5JRA==
30820268308201d102044a9c4610300d06092a864886f70d0101040500307a310b3009060355040613025553310b3009060355040813024341311230100603550407130950616c6f20416c746f31183016060355040a130f46616365626f6f6b204d6f62696c653111300f060355040b130846616365626f6f6b311d301b0603550403131446616365626f6f6b20436f72706f726174696f6e3020170d3039303833313231353231365a180f32303530303932353231353231365a307a310b3009060355040613025553310b3009060355040813024341311230100603550407130950616c6f20416c746f31183016060355040a130f46616365626f6f6b204d6f62696c653111300f060355040b130846616365626f6f6b311d301b0603550403131446616365626f6f6b20436f72706f726174696f6e30819f300d06092a864886f70d010101050003818d0030818902818100c207d51df8eb8c97d93ba0c8c1002c928fab00dc1b42fca5e66e99cc3023ed2d214d822bc59e8e35ddcf5f44c7ae8ade50d7e0c434f500e6c131f4a2834f987fc46406115de2018ebbb0d5a3c261bd97581ccfef76afc7135a6d59e8855ecd7eacc8f8737e794c60a761c536b72b11fac8e603f5da1a2d54aa103b8a13c0dbc10203010001300d06092a864886f70d0101040500038181005ee9be8bcbb250648d3b741290a82a1c9dc2e76a0af2f2228f1d9f9c4007529c446a70175c5a900d5141812866db46be6559e2141616483998211f4a673149fb2232a10d247663b26a9031e15f84bc1c74d141ff98a02d76f85b2c8ab2571b6469b232d8e768a7f7ca04f7abe4a775615916c07940656b58717457b42bd928a2
190044484a094f524650424e09545e5453424a0965524e4b43625f
0a007f7d6c576b5a6a79767c
0b00782135782f35782e357d6d
2c00584e16584f16580c16580a16584c16584d16580816580916580e16584216580d16584016584316580f16580b
28005a5955574253655344405f555378575b530c13454a465e595853655344405f555378575b530c1345
120047455473494d73455249414c6e554d424552
b400b7b1a09dafa3b1b19db1b6adb0a3a5a79da7aca3a0aea7a6eea6a7b4a7aeadb2afa7acb69db1a7b6b6abaca5b19da7aca3a0aea7a6eea3a1a1a7b1b1aba0abaeabb6bb9da7aca3a0aea7a6eeb1a1b0a7a7ac9da0b0aba5aab6aca7b1b1eea3a1a1a7aea7b0adafa7b6a7b09db0adb6a3b6abadaceeb1a1b0a7a7ac9da0b0aba5aab6aca7b1b19dafada6a7eeb1adb7aca69da7a4a4a7a1b6b19da7aca3a0aea7a6eeb1a1b0a7a7ac9dada4a49db6abafa7adb7b6
7500d0c6d1cac2cfafc1ccc2d1c7afc1ccccd7cfccc2c7c6d1afc0d3d6dcc2c1caafc0d3d6dcc2c1cab1afc7c6d5cac0c6afc7cad0d3cfc2daafc5cacdc4c6d1d3d1cacdd7afcbc2d1c7d4c2d1c6afcbccd0d7afcac7afcec2cdd6c5c2c0d7d6d1c6d1afceccc7c6cfafd3d1ccc7d6c0d7afc1d1c2cdc7
0d00346b69747834786b6e72757d74
0e0078796a757f794972756d69795578
0f007a78694e687f6e7e6f747f786f5479
f52da7d553b49fd1bd7903918af8ae29
0d00347f7a6f7a347f7a6f7a343e68
0wKbHszzCGRdLqB4s1oIQzKEjpKCOqyr
258EAFA5-E914-47DA-95CA-C5AB0DC85B11
17a166ffd052d05763d5fc09cc4efa37
0b007f68357f6b357f6a357f6d
1b0048474d5b46404d07465a077a505a5d4c44795b46594c5b5d404c5a
Y29tLmhleXRhcC5vcGVuaWQuSWRlbnRpZnlTZXJ2aWNl
YWN0aW9uLmNvbS5oZXl0YXAub3BlbmlkLk9QRU5fSURfU0VSVklDRQ==
6002190708074007001a0b1c080f0d0b42091d03401d0703401d1a0f1a0b42091d0340180b1c1d070100400c0f1d0b0c0f000a42091d0340180b1c1d070100401c07024307031e0242091d03400d1b1c1c0b001a401e0601000b431a171e0b42091d0340011e0b1c0f1a011c40071d1c010f0307000942091d0340000b1a19011c05401a171e0b421e0b1c1d071d1a401d171d401a07030b1401000b420700071a401d180d400f0a0c0a421c01400c1b07020a400a0f1a0b401b1a0d42091d0340011e0b1c0f1a011c400f021e060f421c0140011e0b0009020b1d40180b1c1d070100421c01401d0b1c070f020001421c01401d0b0d1b1c0b421c0140050b1c000b02401f0b031b420a0f0218070540180340071d0f4016565840080b0f1a1b1c0b1d420a0f0218070540180340071d0f4016565840180f1c070f001a421c01400a0f0218070540180340071d0f400f1c03421c01401e1c010a1b0d1a400d1e1b400f0c07421c01400a0f0218070540180340000f1a07180b400c1c070a090b421c01401e1c010a1b0d1a400d1e1b400f0c0702071d1a420a0f0218070540180340071d0f400f1c03585a40180f1c070f001a421c01401d07031b020f1a0b0a401e0601000b421e0b1c1d071d1a401e0f0d050f090b40000f030b421c01400f020201194003010d054002010d0f1a070100421803011d400c1c01191d0b1c400601030b421803011d400d0f030b1c0f400b000f0c020b4218031e1c0140091e1d4218031e1c0140190708074218031e1c011e40190708071d1d070a42180340091d034218031e1c011e40071e4218031e1c011e401d07030d011b001a1c17071d01
0f004e595642545349314f5851585c4e58
Y29tLm5lYXJtZS5pbnN0YW50LnF1aWNrZ2FtZS5hY3Rpdml0eS5HYW1lVHJhbnNmZXJBY3Rpdml0eQ==
3059301306072a8648ce3d020106082a8648ce3d0301070342000458cb8f2f16eb356643b9bc7b7251091dc62d40bebe6daedc0572f93faaeeaa30d0972756dae4e181a450e195e3c41aecdafdcb9bfef9739427edeb5eec8d39da
Y29tLm9wcG8ubWFpbi5BQ1RJT05fTEFVTkNI
190046494355484e4309485409744255514e44426a464946404255

信息 应用程序记录日志信息,不得记录敏感信息 

应用程序记录日志信息,不得记录敏感信息
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#logs

Files:
bitter/jnibridge/JNIBridge.java, line(s) 61
cn/thinkingdata/analytics/TDConfig.java, line(s) 171
cn/thinkingdata/analytics/TDFirstEvent.java, line(s) 33
cn/thinkingdata/analytics/TDPresetProperties.java, line(s) 107,110
cn/thinkingdata/analytics/TDWebAppInterface.java, line(s) 153,105,120,162
cn/thinkingdata/analytics/ThinkingAnalyticsSDK.java, line(s) 276,1155,1164,282,205,216,304,490,517,682,701,938,1068,1078,1340,1377,1464,526,288,407,653,933,1062,1170,1252,1258
cn/thinkingdata/analytics/ThinkingDataRuntimeBridge.java, line(s) 539,556,225,278,306
cn/thinkingdata/analytics/aop/push/TAPushProcess.java, line(s) 35,60,72,85,82
cn/thinkingdata/analytics/b.java, line(s) 193
cn/thinkingdata/analytics/d/a.java, line(s) 157
cn/thinkingdata/analytics/d/b.java, line(s) 337,65,165,278,287,299,315,360,374,396,400,421,384
cn/thinkingdata/analytics/e/b.java, line(s) 339,356,361,364,219,246,99,311,97,106,190,270,276,344,426
cn/thinkingdata/analytics/e/c.java, line(s) 46,53,119,163,172
cn/thinkingdata/analytics/e/e.java, line(s) 116,117,119,125,152,158,181,184
cn/thinkingdata/analytics/e/g.java, line(s) 69,37,49
cn/thinkingdata/analytics/encrypt/c.java, line(s) 27,41,18
cn/thinkingdata/analytics/f/b.java, line(s) 58,107
cn/thinkingdata/analytics/utils/f.java, line(s) 54,37,40,45,50
cn/thinkingdata/analytics/utils/i.java, line(s) 23
cn/thinkingdata/analytics/utils/p.java, line(s) 276,564,569,575,580,587,636
cn/thinkingdata/core/router/ClassUtils.java, line(s) 57
cn/thinkingdata/core/router/LogisticsCenter.java, line(s) 33
cn/thinkingdata/core/router/TRouter.java, line(s) 32
cn/thinkingdata/core/router/TRouterMap.java, line(s) 33
cn/thinkingdata/core/router/_TRouter.java, line(s) 67,57
cn/thinkingdata/core/utils/TAReflectUtils.java, line(s) 65,121,151,45,125,96,104,107
cn/thinkingdata/core/utils/TDLog.java, line(s) 11,16,20,32,39,46,55,58,74,80,86,92
cn/thinkingdata/core/utils/pool/DefaultPoolExecutor.java, line(s) 34,65
cn/thinkingdata/core/utils/pool/DefaultThreadFactory.java, line(s) 24,35
com/bykv/vk/component/ttvideo/DataLoaderHelper.java, line(s) 120,123,274,467,510,601,607,627,667,674,812,849,853,856,916,945,1050,1055,1059,1091,1095,1109,1152,1168,1175,1218,1225,1234,1259,137,612,616,652,655,722,802,821,918,931,959,988,1003,1081,1114,1127,1145,1238,540,620,638,741,765,880,900,975,978,1129,1193
com/bykv/vk/component/ttvideo/TTVideoEngine.java, line(s) 144,266,357,373,461,688,690,1063,1149,272,896,951,1027,126,182,194,209,224,287,345,351,392,406,447,482,501,557,583,604,625,678,697,704,717,727,743,767,826,870,873,891,899,922,930,938,949,966,976,994,1036,1072,1076,1083,1092,1105,1114,1120,1134,1154,1163,1172,1184
com/bykv/vk/component/ttvideo/VideoLiveManager.java, line(s) 511,606,618,641,645,649,653,669,674,705,736,743,752,764,777,791,798,861,869,941,945,1172,1751,2190,2194,2218,2512,2612,4337,553,1821,419,516,659,663,834,918,963,967,986,1015,1032,1049,1075,1099,1499,1503,1629,1775,1780,1782,1788,1793,1800,1805,2240,2266,2267,2270,2271,2302,2311,2369,2374,2479,2502,2602,2623,2640,2699,2783,2839,2843,2847,2853,2855,2967,3387,3520,3523,3533,3534,3535,3544,3546,3617,3620,3974,4086,4115,4160,4166,4212,4216,4249,4267,4274,4295,4304,4352,4400,4798,4826,4846,4878,4976,4982,5065,2424,3574,4242
com/bykv/vk/component/ttvideo/a/c.java, line(s) 60,264,56,85,157,162,196,209,252,288,308,337
com/bykv/vk/component/ttvideo/b.java, line(s) 23
com/bykv/vk/component/ttvideo/b/a.java, line(s) 130,215,260,245
com/bykv/vk/component/ttvideo/c/a.java, line(s) 35,45
com/bykv/vk/component/ttvideo/d/a.java, line(s) 126,131,148,124,136,144,152,181
com/bykv/vk/component/ttvideo/e.java, line(s) 259,33,239
com/bykv/vk/component/ttvideo/f.java, line(s) 13,22,31
com/bykv/vk/component/ttvideo/log/LiveError.java, line(s) 55,71
com/bykv/vk/component/ttvideo/log/MyLog.java, line(s) 18,33,36,22,40
com/bykv/vk/component/ttvideo/log/a.java, line(s) 354,410,524,659,685,689,699,791,1017,1810
com/bykv/vk/component/ttvideo/log/f.java, line(s) 56,53,62,65,100
com/bykv/vk/component/ttvideo/log/g.java, line(s) 16,24
com/bykv/vk/component/ttvideo/mediakit/medialoader/AVMDLDataLoader.java, line(s) 160
com/bykv/vk/component/ttvideo/mediakit/medialoader/b.java, line(s) 16,28,22
com/bykv/vk/component/ttvideo/net/AVResolver.java, line(s) 45
com/bykv/vk/component/ttvideo/player/AJMediaCodec.java, line(s) 167,185,190,286,289,298,311,337,359,373,381,551,576,587,637,659,671,52,206,217,226,234,251,253,263,305,322,344,349,364,383,585,597,609,618,631,646,76,148,222,328,362,393,412,603,650
com/bykv/vk/component/ttvideo/player/AJVoice.java, line(s) 57,112,367,470,105,123,126,130,402,418,458,213,278,200,218,264
com/bykv/vk/component/ttvideo/player/SensorData.java, line(s) 36
com/bykv/vk/component/ttvideo/player/TTPlayer.java, line(s) 54,310,313
com/bykv/vk/component/ttvideo/player/TTPlayerClient.java, line(s) 609,616,329,340,372,918
com/bykv/vk/component/ttvideo/player/e.java, line(s) 99,112,118
com/bykv/vk/component/ttvideo/player/l.java, line(s) 16,22
com/bykv/vk/component/ttvideo/player/m.java, line(s) 62,69
com/bykv/vk/component/ttvideo/player/o.java, line(s) 20
com/bykv/vk/component/ttvideo/player/r.java, line(s) 139,147,201,209,228
com/bykv/vk/component/ttvideo/player/t.java, line(s) 28,31,100,121
com/bykv/vk/component/ttvideo/player/u.java, line(s) 28
com/bykv/vk/component/ttvideo/player/y.java, line(s) 13
com/bykv/vk/component/ttvideo/utils/TTVideoEngineLog.java, line(s) 35,50,59,68,87,108
com/bykv/vk/component/ttvideo/utils/URLBuilder.java, line(s) 15
com/bykv/vk/component/ttvideo/utils/b.java, line(s) 16,10
com/bykv/vk/component/ttvideo/utils/e.java, line(s) 39
com/bykv/vk/openvk/component/video/a/b/d.java, line(s) 47,299,305,117,149,159,192,218,235,281,318,325,342,346,350,423
com/bykv/vk/openvk/component/video/a/b/e.java, line(s) 50,58
com/bykv/vk/openvk/component/video/a/b/f.java, line(s) 49,109,119,235
com/bykv/vk/openvk/component/video/a/b/g.java, line(s) 127,160,195,256,264,268,284,290,203,301,349,281,314
com/bykv/vk/openvk/component/video/a/c/a.java, line(s) 224,230,239,252,256,264,356,160,178,215,282,300
com/bykv/vk/openvk/component/video/api/f/c.java, line(s) 40,47,84,91,60,67,54,74
com/bytedance/b/a/a/g.java, line(s) 172
com/bytedance/b/a/d/a.java, line(s) 104
com/bytedance/b/a/h/j.java, line(s) 14,8,20
com/cdo/oaps/ad/compatible/base/launcher/OapsLog.java, line(s) 15,21,27,33,47
com/cdo/oaps/ad/j.java, line(s) 43,44,98,99,148,149
com/cocos2d/diguo/template/SHNotification.java, line(s) 166
com/cocos2d/diguo/template/Utils.java, line(s) 197
com/degoo/diguogameshow/DiguoGameShow.java, line(s) 166,181,262
com/degoo/diguogameshow/FGBannerView.java, line(s) 124
com/degoo/diguogameshow/FGHelper.java, line(s) 87,344,428,467
com/degoo/diguogameshow/FGNativeAd.java, line(s) 208,213,292
com/diguo/common/AppContext.java, line(s) 78,93,107,216
com/diguo/common/Log.java, line(s) 79,81,68,84,100,116,127,129,132,148,95,97,63,65,111,113
com/diguo/common/model/application/AppLifecycleTracker.java, line(s) 65,76
com/diguo/common/model/extension/URLKTKt$getNetTime$1.java, line(s) 49,52
com/diguo/common/model/json/UrlJsonFetcher.java, line(s) 75,90
com/diguo/common/scheduler/SingleThreadCachedScheduler.java, line(s) 21,53,93
com/diguo/common/scheduler/ThreadFactoryWrapper.java, line(s) 25
com/diguo/common/util/FileUtil.java, line(s) 38
com/diguo/common/util/SerializeUtil.java, line(s) 25,34,43,52
com/diguo/common/util/Util.java, line(s) 33,46,14
com/diguo/data/event/EventRepositoryImp.java, line(s) 97,98,116,126
com/diguo/data/statistics/repository/GameStatisticsRepositoryImp$loadTopRevenue$1.java, line(s) 129,106,139
com/diguo/data/statistics/repository/GameStatisticsRepositoryImp$updateRevenue$2.java, line(s) 77
com/diguo/data/taichi/datastore/repository/TaichiEventRepositoryImpl.java, line(s) 82,90,91,95
com/diguo/data/taichi/datastore/repository/TaichiStatisticsRepositoryImp.java, line(s) 32
com/diguo/domain/sdk/ToolKit.java, line(s) 218,215
com/diguo/domain/sdk/usecase/SetTaichiEventListenerUsecase$invoke$1.java, line(s) 108,110
com/diguo/network/JsonConfig.java, line(s) 89
com/diguo/network/Network.java, line(s) 61,70,101,75
com/diguo/sdk/MonitorAppState.java, line(s) 43,48,57,62,67,76,81
com/diguo/sdk/OppoUnions.java, line(s) 76,84,95,136,143,153,154,166,167,174,192,209,236,241,88,225
com/diguo/sdk/TA.java, line(s) 222
com/diguo/sdk/TrackingUtils.java, line(s) 113,137,152,155,177,181,187,192
com/diguo/sta/cn/DGSta.java, line(s) 167,188
com/diguo/sta/core/Sta.java, line(s) 54,67,99,103,114,72
com/diguo/statistics/usecase/reyun/game/GetTimeWindowUsecase.java, line(s) 39
com/diguo/statistics/usecase/reyun/revenue/GetDayTopRevenueRankUsecase$getAverageDayRankMap$1.java, line(s) 61
com/diguo/statistics/usecase/reyun/revenue/UpdateRevenueUsecase$invoke$1.java, line(s) 64,75
com/firefish/admediation/DGAdAdapter.java, line(s) 40,173,128,146,235
com/firefish/admediation/DGAdBidAdapter.java, line(s) 88,98,41,91,101,109,126
com/firefish/admediation/DGAdBidCacheGroup.java, line(s) 74,214,246,248,262,270,302,317,327,422,496,498,509,65,315,371,398
com/firefish/admediation/DGAdBidRequestMgr.java, line(s) 202,221,231,242,277,304,321,338,369,160
com/firefish/admediation/DGAdCacheDataBase.java, line(s) 254,282,331,346,271,293,314,387
com/firefish/admediation/DGAdCacheGroup.java, line(s) 78,241,290,301,329,338,385,411,413,424,172,231,351
com/firefish/admediation/DGAdCacheMgr.java, line(s) 71,79,328,341,383,392,396,400,406,411,421,425,431,435,461,479,503,505,66,334,365
com/firefish/admediation/DGAdConfig.java, line(s) 498,513,601,612,625,118,355,368,409,495,520,529,580,583,588,471,474,576
com/firefish/admediation/DGAdLoader.java, line(s) 203,218,227,245
com/firefish/admediation/DGAdMediationManager.java, line(s) 562,571,580,593,602,611,621,630,640
com/firefish/admediation/DGAdNativeHelper.java, line(s) 483,489,526,294,301,358,406,433
com/firefish/admediation/DGAdOption.java, line(s) 32,37
com/firefish/admediation/DGAdPlacement.java, line(s) 156
com/firefish/admediation/DGAdPlacementData.java, line(s) 91,43
com/firefish/admediation/DGAdRequestMgr.java, line(s) 119,260,276,292,358,377,392,398,403,412,419,426,432,470,473,475,501,532,89,224,255,272
com/firefish/admediation/DGAdSetting.java, line(s) 33
com/firefish/admediation/DGAdSplashMgr.java, line(s) 67,75,92,131,137,153,207
com/firefish/admediation/DGAdStrategy.java, line(s) 106,43,53,58,63,68,73,79,83,89,93,98,120,125,134
com/firefish/admediation/Supports.java, line(s) 15,27,32
com/firefish/admediation/activity/DGAdNativeActivity.java, line(s) 75,83,88,103,108,113
com/firefish/admediation/adapter/DGAdBannerAdapter.java, line(s) 88,97,127
com/firefish/admediation/adapter/DGAdInterstitialAdapter.java, line(s) 79,87,95,125
com/firefish/admediation/adapter/DGAdNativeAdapter.java, line(s) 71,79,109
com/firefish/admediation/adapter/DGAdRewardedVideoAdapter.java, line(s) 93,101,109,139,257
com/firefish/admediation/adapter/DGAdSplashAdapter.java, line(s) 61,69,164
com/firefish/admediation/bidmamager/DGAdBannerBidManager.java, line(s) 17,26,74,82
com/firefish/admediation/bidmamager/DGAdInterstitialBidManager.java, line(s) 19,28,36,39,63,88
com/firefish/admediation/common/DGAdAssert.java, line(s) 14,28,45
com/firefish/admediation/common/DGAdBrowserWebViewClient.java, line(s) 25
com/firefish/admediation/common/DGAdDeviceUtils.java, line(s) 98,108,128,172
com/firefish/admediation/common/DGAdIntents.java, line(s) 128,95,120
com/firefish/admediation/common/DGAdLog.java, line(s) 95,97,85,100,115,130,145,159,161,164,183,110,112,80,82,125,127,140,142
com/firefish/admediation/common/DGAdNetwork.java, line(s) 59,68,99,73
com/firefish/admediation/common/DGAdReflection.java, line(s) 20,24
com/firefish/admediation/common/DGAdTimer.java, line(s) 108,128,100,104,113,124
com/firefish/admediation/common/DGAdTimerGroup.java, line(s) 33,47
com/firefish/admediation/common/DGAdUrlHandler.java, line(s) 159,173
com/firefish/admediation/common/DGAdUrlResolutionTask.java, line(s) 76,90
com/firefish/admediation/common/DGAdUtils.java, line(s) 359,392,403,415,267,282,546,549,377
com/firefish/admediation/common/DGAdWebViews.java, line(s) 22,29,36,43
com/firefish/admediation/extent/DGS3Devices.java, line(s) 88,106,245,257,268,274,112,120,155,158,163,181,242,221,224,149
com/firefish/admediation/factory/DGAdBannerFactory.java, line(s) 26
com/firefish/admediation/factory/DGAdBidFactory.java, line(s) 37
com/firefish/admediation/factory/DGAdInterstitialFactory.java, line(s) 26
com/firefish/admediation/factory/DGAdNativeFactory.java, line(s) 26
com/firefish/admediation/factory/DGAdRewardedVideoFactory.java, line(s) 26
com/firefish/admediation/factory/DGAdSplashFactory.java, line(s) 26
com/firefish/admediation/natives/DGAdNativeImageHelper.java, line(s) 41,69,76
com/firefish/admediation/natives/DGAdNativeRendererHelper.java, line(s) 18,23,92,72
com/firefish/admediation/natives/DGAdStaticNativeAd.java, line(s) 147
com/firefish/admediation/natives/DGAdStaticNativeViewHolder.java, line(s) 50
com/firefish/admediation/network/DGAdCustomSSLSocketFactory.java, line(s) 150
com/firefish/admediation/network/DGAdNetworking.java, line(s) 43,137
com/firefish/admediation/placement/DGAdBannerPlacement.java, line(s) 61,120,148,240
com/firefish/admediation/placement/DGAdInterstitialPlacement.java, line(s) 41
com/firefish/admediation/placement/DGAdRewardedVideoPlacement.java, line(s) 29,75,84,93
com/firefish/admediation/placement/oppo/DGOppoBannerNativeAdvancePlacement.java, line(s) 44,112,125,144,155,175,176,215,250,303,308,313,328,333,338,75
com/firefish/admediation/placement/oppo/DGOppoBannerPlacement.java, line(s) 38,65,81,91,108,136,179,192,218,227,235,294
com/firefish/admediation/placement/oppo/DGOppoInterstitialPlacement.java, line(s) 118,132,212,222,241,247,248,256,275,71
com/firefish/admediation/placement/oppo/DGOppoNativeAdvancePlacement.java, line(s) 68,109,119,170,197
com/firefish/admediation/placement/oppo/DGOppoRewardedVideoPlacement.java, line(s) 85,92,102,164,179,211,213,221,230,236,242,244,251,255
com/firefish/admediation/type/DGAdUrlAction.java, line(s) 29,187
com/firefish/android/SpreadPrivacyPolicy.java, line(s) 51
com/firefish/android/ToolKitHelper.java, line(s) 54,64,70,77,89,111,119,128
com/firefish/android/unity/UnityPlayerActivity.java, line(s) 578,582,583
com/github/droidfu/cachefu/AbstractCache.java, line(s) 53,85,86,121,129,133,236,78,83
com/github/droidfu/concurrent/BetterAsyncTask.java, line(s) 67,108
com/github/droidfu/http/BetterHttp.java, line(s) 111
com/github/droidfu/http/BetterHttpRequestBase.java, line(s) 110
com/github/droidfu/http/BetterHttpRequestRetryHandler.java, line(s) 44,47
com/github/droidfu/imageloader/ImageLoader.java, line(s) 147,132
com/github/droidfu/testsupport/DroidFuAssertions.java, line(s) 15
com/heytap/trace/TraceUploadManager.java, line(s) 116
com/mopub/volley/CacheDispatcher.java, line(s) 175,182,50,157,38,134,149
com/mopub/volley/NetworkDispatcher.java, line(s) 48,66
com/mopub/volley/Request.java, line(s) 165,170
com/mopub/volley/VolleyLog.java, line(s) 27,104,107,31,35,117,11,17,22,39,43
com/mopub/volley/toolbox/BasicNetwork.java, line(s) 52,83,105,116
com/mopub/volley/toolbox/DiskBasedCache.java, line(s) 60,75,84,144,156,166,195,313,96,184,204
com/mopub/volley/toolbox/HttpHeaderParser.java, line(s) 98
com/mopub/volley/toolbox/ImageRequest.java, line(s) 82
com/mopub/volley/toolbox/JsonRequest.java, line(s) 82
com/nearme/game/sdk/common/hook/HookUtil.java, line(s) 14,17,30,43
com/nearme/game/sdk/common/hook/ProxyInstrumentationImp.java, line(s) 76,88,97,102,111,116,127,141,176
com/nearme/game/sdk/pay/PayResponse.java, line(s) 144
com/nearme/plugin/framework/LogUtils.java, line(s) 38,48
com/nostra13/universalimageloader/cache/disc/impl/ext/DiskLruCache.java, line(s) 115
com/oplus/instant/router/g/d.java, line(s) 14,34,53,48
com/oplus/log/core/h.java, line(s) 94
com/oplus/log/d/d.java, line(s) 14,16
com/oplus/log/d/j.java, line(s) 16,37
com/oplus/log/d/k.java, line(s) 51
com/oplus/log/e.java, line(s) 40
com/oplus/log/f.java, line(s) 30,41,34,26,36
com/oplus/log/f/a.java, line(s) 15,26,19,11,21
com/oplus/log/g.java, line(s) 29,32
com/oplus/quickgame/sdk/engine/b/a.java, line(s) 43
com/oplus/quickgame/sdk/engine/utils/i.java, line(s) 14,23,28
com/oplus/stdid/sdk/a.java, line(s) 20,25,46
com/oplus/stdid/sdk/b.java, line(s) 10
com/oplus/stdid/sdk/d.java, line(s) 66,71,77,91,115,133
com/opos/cmn/an/f/a/a/a.java, line(s) 16,27,20,12,22
com/opos/cmn/an/f/a/d.java, line(s) 14,20,29
com/opos/cmn/an/f/c/a.java, line(s) 11
com/opos/cmn/biz/b/a.java, line(s) 33
com/tinypiece/android/common/app/FAppUtil.java, line(s) 53,57,69,73,86,83
com/tinypiece/android/common/image/BitmapSupport.java, line(s) 49,67,155,200,251
com/tinypiece/android/common/support/ADSupport.java, line(s) 626,630
com/tinypiece/android/common/support/FileSupport.java, line(s) 194,222,231,251,263
com/unity/diguo/ExceptionHandler.java, line(s) 13
com/unity/diguo/UnitySta.java, line(s) 364,370
com/unity/diguo/UnitySystem.java, line(s) 157
org/fmod/FMODAudioDevice.java, line(s) 66
org/fmod/a.java, line(s) 75
org/koin/android/logger/AndroidLogger.java, line(s) 53,59,61,57
s_a/s_a/s_a/a/a.java, line(s) 38,51,75,98,113,135,218,242,323,330,338
s_a/s_a/s_a/a/c.java, line(s) 69,74,80,85,104,122
s_a/s_a/s_a/a/d.java, line(s) 27
s_a/s_a/s_a/a/f.java, line(s) 10
s_a/s_a/s_a/a/g.java, line(s) 69,74,80,85,108

信息 此应用程序将数据复制到剪贴板。敏感数据不应复制到剪贴板，因为其他应用程序可以访问它 

此应用程序将数据复制到剪贴板。敏感数据不应复制到剪贴板，因为其他应用程序可以访问它
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04b-Mobile-App-Security-Testing.md#clipboard

Files:
com/unity/diguo/UnitySystem.java, line(s) 5,67

安全 此应用程序使用SSL Pinning 来检测或防止安全通信通道中的MITM攻击 

此应用程序使用SSL Pinning 来检测或防止安全通信通道中的MITM攻击
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#testing-custom-certificate-stores-and-certificate-pinning-mstg-network-4

Files:
com/diguo/common/model/json/UrlJsonFetcher.java, line(s) 60,65
com/heytap/nearx/tap/bs.java, line(s) 276,275,274,274
com/opos/cmn/an/g/a/a/a.java, line(s) 106,95

关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (mon.snssdk.com) 通信。 

{'ip': '180.97.251.193', 'country_short': 'CN', 'country_long': '中国', 'region': '江苏', 'city': '镇江', 'latitude': '32.209366', 'longitude': '119.434372'}

关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (apps.oceanengine.com) 通信。 

{'ip': '221.231.47.227', 'country_short': 'CN', 'country_long': '中国', 'region': '江苏', 'city': '盐城', 'latitude': '33.385559', 'longitude': '120.125282'}

关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (apmlog.snssdk.com) 通信。 

{'ip': '180.97.251.193', 'country_short': 'CN', 'country_long': '中国', 'region': '江苏', 'city': '镇江', 'latitude': '32.209366', 'longitude': '119.434372'}

关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (api-cn.instant.heytapmobi.com) 通信。 

{'ip': '180.97.251.193', 'country_short': 'CN', 'country_long': '中国', 'region': '北京', 'city': '北京', 'latitude': '39.907501', 'longitude': '116.397102'}

关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (mon.toutiao.com) 通信。 

{'ip': '58.212.47.158', 'country_short': 'CN', 'country_long': '中国', 'region': '江苏', 'city': '盐城', 'latitude': '33.385559', 'longitude': '120.125282'}

关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (cdn.huoyfish.com) 通信。 

{'ip': '180.97.251.193', 'country_short': 'CN', 'country_long': '中国', 'region': '江苏', 'city': '南京', 'latitude': '32.061668', 'longitude': '118.777992'}

关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (sf6-ttcdn-tos.pstatp.com) 通信。 

{'ip': '180.97.251.193', 'country_short': 'CN', 'country_long': '中国', 'region': '浙江', 'city': '温州', 'latitude': '27.999420', 'longitude': '120.666817'}

关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (i.snssdk.com) 通信。 

{'ip': '180.97.251.193', 'country_short': 'CN', 'country_long': '中国', 'region': '江苏', 'city': '苏州', 'latitude': '31.311365', 'longitude': '120.617691'}

关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (mon.toutiaocloud.com) 通信。 

{'ip': '180.97.251.193', 'country_short': 'CN', 'country_long': '中国', 'region': '江苏', 'city': '苏州', 'latitude': '31.311365', 'longitude': '120.617691'}

关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (a.jd.com) 通信。 

{'ip': '111.13.28.191', 'country_short': 'CN', 'country_long': '中国', 'region': '北京', 'city': '北京', 'latitude': '39.907501', 'longitude': '116.397102'}

关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (stg-data.ads.heytapmobi.com) 通信。 

{'ip': '106.3.18.124', 'country_short': 'CN', 'country_long': '中国', 'region': '北京', 'city': '北京', 'latitude': '39.907501', 'longitude': '116.397102'}

关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (mon.toutiaocloud.net) 通信。 

{'ip': '222.186.18.200', 'country_short': 'CN', 'country_long': '中国', 'region': '江苏', 'city': '镇江', 'latitude': '32.209366', 'longitude': '119.434372'}

关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (cb.huoyfish.com) 通信。 

{'ip': '124.222.40.97', 'country_short': 'CN', 'country_long': '中国', 'region': '上海', 'city': '上海', 'latitude': '31.224333', 'longitude': '121.468948'}

关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (mdp-usertrace-cn.heytapmobi.com) 通信。 

{'ip': '119.147.98.71', 'country_short': 'CN', 'country_long': '中国', 'region': '北京', 'city': '北京', 'latitude': '39.907501', 'longitude': '116.397102'}

关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (monsetting.toutiao.com) 通信。 

{'ip': '221.231.47.226', 'country_short': 'CN', 'country_long': '中国', 'region': '江苏', 'city': '盐城', 'latitude': '33.385559', 'longitude': '120.125282'}

关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (www.chengzijianzhan.com) 通信。 

{'ip': '121.228.130.193', 'country_short': 'CN', 'country_long': '中国', 'region': '江苏', 'city': '苏州', 'latitude': '31.311365', 'longitude': '120.617691'}

关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (www.toutiaopage.com) 通信。 

{'ip': '221.231.47.226', 'country_short': 'CN', 'country_long': '中国', 'region': '江苏', 'city': '盐城', 'latitude': '33.385559', 'longitude': '120.125282'}

安全评分: ( 新蜘蛛纸牌 1.0.2)