Leaking sensitive information through a ResultReceiver¶
ID: java/android/sensitive-result-receiver Kind: path-problem Security severity: 8.2 Severity: error Precision: medium Tags: - security - external/cwe/cwe-927 Query suites: - java-security-extended.qls - java-security-and-quality.qls Click to see the query in the CodeQL repository
If a ResultReceiver is obtained from an untrusted source, such as an Intent received by an exported component, do not send it sensitive data. Otherwise, the information may be leaked to a malicious application.
Recommendation¶
Do not send sensitive data to an untrusted ResultReceiver.
Example¶
In the following (bad) example, sensitive data is sent to an untrusted ResultReceiver.
// BAD: Sensitive data is sent to an untrusted result receiver void bad(String password) { Intent intent = getIntent(); ResultReceiver rec = intent.getParcelableExtra("Receiver"); Bundle b = new Bundle(); b.putCharSequence("pass", password); rec.send(0, b); } References¶
Common Weakness Enumeration: CWE-927.