@dailephd/my-dev-kit-lab 0.3.3 → 0.4.0

package/dist/src/audits/codeRot/detectors/architectureDriftDetector.js

@@ -42,6 +42,7 @@ export const ARCHITECTURE_DRIFT_DETECTOR = {
     },
     run: (ctx) => {
         const issues = [];
+        const hasAndroidValidationSource = fs.existsSync(path.join(ctx.target.rootPath, "src", "mobile", "android", "validate", "validateAndroidTarget.ts"));
         const currentStateDocs = ctx.inventory.docsFiles.filter((f) => CURRENT_STATE_DOC_BASENAMES.has(path.basename(f.relativePath).toLowerCase()));
         for (const docFile of currentStateDocs) {
             const content = readBoundedFileText(ctx.target.rootPath, docFile.relativePath, docFile.sizeBytes, MAX_READ_BYTES);
@@ -61,7 +62,7 @@ export const ARCHITECTURE_DRIFT_DETECTOR = {
             const content = readBoundedFileText(ctx.target.rootPath, docFile.relativePath, docFile.sizeBytes, MAX_READ_BYTES);
             if (content === null)
                 continue;
-            issues.push(...findUnsupportedCurrentClaims(docFile.relativePath, content));
+            issues.push(...findUnsupportedCurrentClaims(docFile.relativePath, content, hasAndroidValidationSource));
         }
         return deduplicateIssuesById(issues);
     },
@@ -227,13 +228,15 @@ function findMajorDirsAbsentFromArchitectureDoc(ctx, docRelativePath, content) {
     }
     return issues;
 }
-function findUnsupportedCurrentClaims(docRelativePath, content) {
+function findUnsupportedCurrentClaims(docRelativePath, content, hasAndroidValidationSource) {
     const issues = [];
     const subjects = [
         { id: "manual-pentest", label: "manual pentest", pattern: "manual pentest" },
         { id: "android-validation", label: "Android/mobile validation", pattern: "(?:android (?:validation|support))" },
     ];
     for (const subject of subjects) {
+        if (subject.id === "android-validation" && hasAndroidValidationSource)
+            continue;
         const pattern = currentClaimPatternFor(subject.pattern);
         const match = pattern.exec(content);
         if (!match)

package/dist/src/audits/codeRot/detectors/securityValidationAssumptionRotDetector.js

@@ -67,6 +67,7 @@ export const SECURITY_VALIDATION_ASSUMPTION_ROT_DETECTOR = {
         const pkgVersion = ctx.sourceOfTruth.package?.version ?? null;
         const hasSecurityValidationSourceDir = ctx.sourceOfTruth.security.hasSecurityValidationSourceDir;
         const hasAttackScenariosDir = fs.existsSync(path.join(ctx.target.rootPath, "src", "securityValidation", "attackScenarios"));
+        const hasAndroidValidationSource = fs.existsSync(path.join(ctx.target.rootPath, "src", "mobile", "android", "validate", "validateAndroidTarget.ts"));
         for (const docFile of ctx.inventory.docsFiles) {
             const content = readBoundedFileText(ctx.target.rootPath, docFile.relativePath, docFile.sizeBytes, MAX_READ_BYTES);
             if (content === null)
@@ -75,7 +76,7 @@ export const SECURITY_VALIDATION_ASSUMPTION_ROT_DETECTOR = {
             issues.push(...findSkippedEqualsPassed(docFile.relativePath, content));
             issues.push(...findExhaustiveSecretClaim(docFile.relativePath, content));
             issues.push(...findCompleteNetworkIsolationClaim(docFile.relativePath, content));
-            issues.push(...findUnsupportedCurrentClaims(docFile.relativePath, content));
+            issues.push(...findUnsupportedCurrentClaims(docFile.relativePath, content, hasAndroidValidationSource));
             if (pkgVersion)
                 issues.push(...findStaleV021SecurityMention(docFile.relativePath, content, pkgVersion));
             if (hasSecurityValidationSourceDir && hasAttackScenariosDir) {
@@ -237,13 +238,15 @@ function findCompleteNetworkIsolationClaim(relativePath, content) {
         }),
     ];
 }
-function findUnsupportedCurrentClaims(relativePath, content) {
+function findUnsupportedCurrentClaims(relativePath, content, hasAndroidValidationSource) {
     const issues = [];
     const subjects = [
         { id: "manual-pentest", label: "manual pentest", pattern: "manual pentest" },
         { id: "android-validation", label: "Android/mobile validation", pattern: "(?:android (?:validation|support)|mobile validation)" },
     ];
     for (const subject of subjects) {
+        if (subject.id === "android-validation" && hasAndroidValidationSource)
+            continue;
         const match = currentClaimPatternFor(subject.pattern).exec(content);
         if (!match)
             continue;

package/dist/src/audits/core/collectSourceFacts.js

@@ -41,17 +41,18 @@ export async function collectSourceFacts(targetRoot, inventory, registry = DEFAU
     // filtering preserves that order, so no re-sort is needed here.
     const eligible = inventory.files.filter((entry) => ANALYZABLE_ROLES.has(entry.role));
     for (const entry of eligible) {
+        const relativePath = normalizeRelativePath(entry.relativePath);
         const analyzer = selectLanguageAnalyzer(registry, entry.language, entry.extension);
         if (!analyzer) {
-            files.push(buildFallbackFacts(entry));
+            files.push(buildFallbackFacts(entry, relativePath));
             continue;
         }
-        const absolutePath = path.join(resolvedRoot, entry.relativePath);
+        const absolutePath = resolveInventoryFilePath(resolvedRoot, relativePath);
         try {
             const content = fs.readFileSync(absolutePath, "utf8");
             const facts = await analyzer.analyzeFile({
                 targetRoot: resolvedRoot,
-                relativePath: entry.relativePath,
+                relativePath,
                 absolutePath,
                 content,
                 inventoryEntry: entry,
@@ -65,13 +66,13 @@ export async function collectSourceFacts(targetRoot, inventory, registry = DEFAU
             const diagnostic = {
                 severity: "error",
                 code: "analyzer-error",
-                message: `Analyzer "${analyzer.id}" failed on "${entry.relativePath}": ${message}`,
-                path: entry.relativePath,
+                message: `Analyzer "${analyzer.id}" failed on "${relativePath}": ${message}`,
+                path: relativePath,
                 analyzerId: analyzer.id,
             };
             analyzerDiagnostics.push(diagnostic);
             files.push({
-                relativePath: entry.relativePath,
+                relativePath,
                 language: entry.language,
                 role: entry.role,
                 parseStatus: "parse-error",
@@ -94,7 +95,7 @@ export async function collectSourceFacts(targetRoot, inventory, registry = DEFAU
         warnings,
     };
 }
-function buildFallbackFacts(entry) {
+function buildFallbackFacts(entry, relativePath) {
     const known = KNOWN_LANGUAGES.has(entry.language);
     const parseStatus = known ? "file-level-only" : "unsupported";
     const diagnostic = known
@@ -102,18 +103,18 @@ function buildFallbackFacts(entry) {
             severity: "info",
             code: "no-analyzer-registered",
             message: `No language analyzer is registered for "${entry.language}" yet; only inventory-level facts are available.`,
-            path: entry.relativePath,
+            path: relativePath,
             analyzerId: null,
         }
         : {
             severity: "info",
             code: "unsupported-language",
             message: `Language "${entry.language}" is not supported for source-fact extraction.`,
-            path: entry.relativePath,
+            path: relativePath,
             analyzerId: null,
         };
     return {
-        relativePath: entry.relativePath,
+        relativePath,
         language: entry.language,
         role: entry.role,
         parseStatus,
@@ -126,6 +127,16 @@ function buildFallbackFacts(entry) {
         diagnostics: [diagnostic],
     };
 }
+function normalizeRelativePath(relativePath) {
+    const normalized = path.posix.normalize(relativePath.replace(/\\/g, "/"));
+    if (normalized === ".")
+        return "";
+    return normalized.replace(/^\/+/, "").replace(/^\.\//, "");
+}
+function resolveInventoryFilePath(root, relativePath) {
+    const parts = relativePath.split("/").filter((part) => part.length > 0);
+    return parts.length === 0 ? root : path.resolve(root, ...parts);
+}
 function countByLanguage(files) {
     const counts = Object.fromEntries(NORMALIZED_LANGUAGES.map((l) => [l, 0]));
     for (const file of files) {

package/dist/src/mobile/android/audit/androidFinding.js

@@ -0,0 +1,68 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 3 — Android SecurityFinding factory.
+//
+// Reuses SecurityFinding as-is (no parallel Android finding schema). Android
+// findings use category "static-scan" — an existing SecurityCheckCategory
+// value that already covers static-analysis-derived findings (CodeQL,
+// Semgrep) and accurately describes manifest analysis, so no widening of the
+// shared, heavily-tested SecurityCheckCategory union was needed. Per-finding
+// audit family is instead carried by the owning AndroidCheckResult.category
+// (android-permissions/android-components/android-intent-filters/
+// android-deep-links) and by the finding id/title.
+//
+// SecurityFinding has no `confidence` or structured `location` field (the
+// existing codebase convention, e.g. AttackResult, keeps confidence on the
+// *check result*, not the individual finding — see
+// src/securityValidation/attackScenarios/attackResult.ts). Android check
+// results already carry `confidence: MobileConfidence` (Batch 1). Per-finding
+// confidence and location are therefore folded into the free-text `evidence`
+// field here, consistent with how existing scenario code joins evidence
+// previews into that same field.
+// ---------------------------------------------------------------------------
+function slug(value) {
+    return value
+        .replace(/[^a-zA-Z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .toLowerCase();
+}
+// Deterministic, content-derived id — never depends on a counter, timestamp,
+// or enumeration order, so equivalent evidence always yields the same id.
+function buildFindingId(ruleId, manifestPath, identity, location) {
+    const parts = [ruleId, slug(manifestPath), identity ? slug(identity) : undefined, location?.line !== undefined ? `l${location.line}` : undefined].filter((part) => Boolean(part));
+    return parts.join("--");
+}
+function defaultReleaseImpact(severity) {
+    switch (severity) {
+        case "blocker":
+            return "Must fix before release";
+        case "major":
+            return "Should fix before release";
+        case "minor":
+            return "Review recommended before release";
+        case "informational":
+            return "No release impact; informational only";
+        case "skipped":
+            return "Not evaluated";
+    }
+}
+export function makeAndroidFinding(input) {
+    const id = buildFindingId(input.ruleId, input.manifestPath, input.identity, input.location);
+    const locationSuffix = input.location?.line !== undefined ? `:${input.location.line}` : "";
+    const evidenceParts = [
+        `confidence=${input.confidence}`,
+        input.identity ? `identity=${input.identity}` : undefined,
+        `location=${input.manifestPath}${locationSuffix}`,
+        ...(input.evidenceDetails ?? []),
+    ].filter((part) => Boolean(part));
+    return {
+        id,
+        title: input.title,
+        severity: input.severity,
+        category: "static-scan",
+        description: input.description,
+        evidence: evidenceParts.join(" | "),
+        affectedFiles: [input.manifestPath],
+        recommendation: input.recommendation,
+        releaseImpact: input.releaseImpact ?? defaultReleaseImpact(input.severity),
+    };
+}

package/dist/src/mobile/android/audit/checkResultBuilder.js

@@ -0,0 +1,97 @@
+function isMalformed(entry) {
+    return entry.manifest.parseWarnings.some((w) => w.startsWith("Malformed XML:"));
+}
+export function buildAndroidManifestCheckResult(input) {
+    const { id, category, title, detection, manifests, findings, evidence, warnings } = input;
+    const sourcePaths = manifests.map((m) => m.manifestPath);
+    if (detection.projectKind === "non-android") {
+        return {
+            id,
+            category,
+            title,
+            status: "unsupported",
+            requirementLevel: "optional",
+            ran: false,
+            skipped: true,
+            skipInfo: {
+                checkId: id,
+                reason: "Target was not detected as an Android project.",
+                requirementLevel: "optional",
+                missingCapability: "android-detection",
+                verdictImpact: "does not apply to a non-Android target",
+                recommendedNextAction: "Re-run against an Android Gradle project, or verify project detection.",
+            },
+            evidence: [],
+            findings: [],
+            warnings: [],
+            errors: [],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+        };
+    }
+    if (manifests.length === 0) {
+        return {
+            id,
+            category,
+            title,
+            status: "inconclusive",
+            requirementLevel: "required",
+            ran: true,
+            skipped: false,
+            evidence,
+            findings: [],
+            warnings: [...warnings, "No AndroidManifest.xml was found for this target; audit could not run."],
+            errors: [],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+        };
+    }
+    const malformedEntries = manifests.filter(isMalformed);
+    const allMalformed = malformedEntries.length === manifests.length;
+    if (allMalformed) {
+        return {
+            id,
+            category,
+            title,
+            status: "error",
+            requirementLevel: "required",
+            ran: true,
+            skipped: false,
+            evidence,
+            findings: [],
+            warnings,
+            errors: malformedEntries.flatMap((entry) => entry.manifest.parseWarnings.filter((w) => w.startsWith("Malformed XML:"))),
+            sourcePaths,
+            confidence: "unknown",
+            environmentRequirements: [],
+        };
+    }
+    const confidence = malformedEntries.length > 0 ? "medium" : "high";
+    // Informational-only findings (e.g. "standard launcher activity is
+    // exported, as expected") are evidence/inventory, not a reportable issue —
+    // only minor/major/blocker findings cause a "failed" status, matching
+    // section 7.17's "completed and found no reportable issues may pass".
+    const hasReportableFinding = findings.some((finding) => finding.severity !== "informational");
+    const status = hasReportableFinding ? "failed" : "passed";
+    return {
+        id,
+        category,
+        title,
+        status,
+        requirementLevel: "required",
+        ran: true,
+        skipped: false,
+        evidence,
+        findings,
+        warnings: [
+            ...warnings,
+            ...malformedEntries.flatMap((entry) => entry.manifest.parseWarnings.filter((w) => w.startsWith("Malformed XML:"))),
+        ],
+        errors: [],
+        sourcePaths,
+        confidence,
+        environmentRequirements: [],
+    };
+}

package/dist/src/mobile/android/audit/deepLinkAudit.js

@@ -0,0 +1,183 @@
+import { makeAndroidFinding } from "./androidFinding.js";
+import { buildAndroidManifestCheckResult } from "./checkResultBuilder.js";
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 3 — initial deep-link audit.
+//
+// Distinguishes web links (http/https) from custom-scheme deep links, flags
+// missing host/scheme restrictions and broad path patterns, and treats
+// BROWSABLE-without-VIEW and VIEW-without-BROWSABLE as separate "incomplete
+// filter" observations (agents.txt Batch 3 section 7.16). Never claims
+// Digital Asset Links verification, domain ownership, or exploitability —
+// findings are framed as static exposure/configuration review, at most
+// "major" for the narrow high-confidence case of an explicitly exported,
+// unprotected, wildcard-path activity.
+// ---------------------------------------------------------------------------
+const VIEW_ACTION = "android.intent.action.VIEW";
+const BROWSABLE_CATEGORY = "android.intent.category.BROWSABLE";
+const WILDCARD_PATTERN = /[*.]{1,2}\*|\.\*/;
+function isPlaceholder(value) {
+    return value !== undefined && (value.includes("${") || value.startsWith("@"));
+}
+function classifyScheme(dataElements) {
+    const schemes = dataElements.map((d) => d.dataScheme).filter((s) => Boolean(s));
+    if (schemes.length === 0)
+        return "none";
+    if (schemes.some((s) => s === "http" || s === "https"))
+        return "web";
+    return "custom";
+}
+function auditDeepLinkFilter(entry, kind, component, filter, findings) {
+    const identity = component.name || "(unnamed component)";
+    const actions = filter.actions ?? [];
+    const categories = filter.categories ?? [];
+    const dataElements = filter.dataElements ?? filter.filterData;
+    const hasView = actions.includes(VIEW_ACTION);
+    const hasBrowsable = categories.includes(BROWSABLE_CATEGORY);
+    if (!hasView && !hasBrowsable)
+        return;
+    if (hasBrowsable && !hasView) {
+        findings.push(makeAndroidFinding({
+            ruleId: "android-deep-link-browsable-without-view",
+            title: `BROWSABLE category without a VIEW action on ${kind} "${identity}"`,
+            severity: "informational",
+            confidence: "high",
+            description: "This <intent-filter> declares category BROWSABLE without action VIEW, so it will not actually be treated as a browsable web/deep link by the platform.",
+            manifestPath: entry.manifestPath,
+            identity,
+            location: filter.location,
+        }));
+        return;
+    }
+    if (hasView && !hasBrowsable && dataElements.length === 0) {
+        // Plain VIEW with no data and no BROWSABLE — not a deep link, nothing to audit here.
+        return;
+    }
+    const exportedExplicitTrue = component.exported === true;
+    const unprotected = !component.permission;
+    const scheme = classifyScheme(dataElements);
+    const hasHost = dataElements.some((d) => Boolean(d.dataHost));
+    const placeholderEvidence = dataElements.some((d) => isPlaceholder(d.dataScheme) || isPlaceholder(d.dataHost) || isPlaceholder(d.dataPath) || isPlaceholder(d.dataPathPrefix) || isPlaceholder(d.dataPathPattern));
+    const broadPattern = dataElements.some((d) => (d.dataPathPattern && WILDCARD_PATTERN.test(d.dataPathPattern)) || d.dataPathPattern === ".*" || d.dataPathPattern === "*");
+    const evidenceDetails = [
+        `scheme=${scheme}`,
+        `hasHost=${hasHost}`,
+        `exported=${component.exported ?? "unspecified"}`,
+        `hasComponentPermission=${!unprotected}`,
+        `dataElementCount=${dataElements.length}`,
+    ];
+    if (placeholderEvidence) {
+        findings.push(makeAndroidFinding({
+            ruleId: "android-deep-link-placeholder-value",
+            title: `Deep-link data on ${kind} "${identity}" contains an unresolved placeholder or resource reference`,
+            severity: "informational",
+            confidence: "low",
+            description: "One or more deep-link data attributes (scheme/host/path) reference an unresolved manifest placeholder (e.g. ${applicationId}) or Android resource (e.g. @string/...). Effective exposure cannot be assessed statically.",
+            manifestPath: entry.manifestPath,
+            identity,
+            location: filter.location,
+            evidenceDetails,
+        }));
+        return;
+    }
+    if (broadPattern) {
+        const strongEvidence = exportedExplicitTrue && unprotected;
+        findings.push(makeAndroidFinding({
+            ruleId: "android-deep-link-broad-path-pattern",
+            title: `Broad/wildcard deep-link path pattern on ${kind} "${identity}"`,
+            severity: strongEvidence ? "major" : "minor",
+            confidence: strongEvidence ? "high" : "medium",
+            description: strongEvidence
+                ? "This deep-link filter uses a highly permissive pathPattern, the component is explicitly exported, and no component-level permission protects it — a strong static combination of broad matching and open reachability."
+                : "This deep-link filter uses a broad/wildcard-like pathPattern. Broad path matching is not automatically exploitable, but widens the set of URLs the app will handle.",
+            manifestPath: entry.manifestPath,
+            identity,
+            location: filter.location,
+            evidenceDetails,
+            recommendation: "Narrow the pathPattern to only the routes the app actually needs to handle, and validate any path/query data before use.",
+        }));
+        return;
+    }
+    if (scheme === "web" && !hasHost) {
+        findings.push(makeAndroidFinding({
+            ruleId: "android-deep-link-web-link-without-host",
+            title: `HTTP/HTTPS deep link on ${kind} "${identity}" has no host restriction`,
+            severity: "minor",
+            confidence: "medium",
+            description: "This web-link intent filter declares an http/https scheme without a host, so it is not restricted to a specific domain.",
+            manifestPath: entry.manifestPath,
+            identity,
+            location: filter.location,
+            evidenceDetails,
+            recommendation: "Add android:host to restrict which domains this filter matches.",
+        }));
+        return;
+    }
+    if (scheme === "custom" && !hasHost) {
+        findings.push(makeAndroidFinding({
+            ruleId: "android-deep-link-custom-scheme-without-host",
+            title: `Custom-scheme deep link on ${kind} "${identity}" has no host restriction`,
+            severity: "minor",
+            confidence: "medium",
+            description: "This custom-scheme intent filter declares no host restriction. Custom schemes are not automatically vulnerabilities, but an unrestricted scheme accepts any host/path combination.",
+            manifestPath: entry.manifestPath,
+            identity,
+            location: filter.location,
+            evidenceDetails,
+            recommendation: "Consider restricting the host or validating incoming URIs defensively in the handling code.",
+        }));
+        return;
+    }
+    // Bounded/safe deep link: explicit scheme + host (+ optional path
+    // restriction), no wildcard pattern, no placeholders — recorded for
+    // inventory purposes at informational severity only (ANDROID-B3-24).
+    findings.push(makeAndroidFinding({
+        ruleId: "android-deep-link-bounded",
+        title: `Deep link declared on ${kind} "${identity}"`,
+        severity: "informational",
+        confidence: "high",
+        description: "This deep-link filter declares an explicit scheme and host with bounded path evidence. No static exposure concern was identified.",
+        manifestPath: entry.manifestPath,
+        identity,
+        location: filter.location,
+        evidenceDetails,
+    }));
+}
+function componentGroups(entry) {
+    return [
+        { kind: "activity", components: entry.manifest.activities },
+        { kind: "activity-alias", components: entry.manifest.activityAliases ?? [] },
+    ];
+}
+export function auditAndroidDeepLinks(detection, manifests) {
+    const findings = [];
+    const evidence = [];
+    const warnings = [];
+    for (const entry of manifests) {
+        let candidateCount = 0;
+        for (const group of componentGroups(entry)) {
+            for (const component of group.components) {
+                for (const filter of component.intentFilters) {
+                    const actions = filter.actions ?? [];
+                    const categories = filter.categories ?? [];
+                    if (actions.includes(VIEW_ACTION) || categories.includes(BROWSABLE_CATEGORY)) {
+                        candidateCount += 1;
+                        auditDeepLinkFilter(entry, group.kind, component, filter, findings);
+                    }
+                }
+            }
+        }
+        if (candidateCount > 0) {
+            evidence.push(`${entry.manifestPath}: ${candidateCount} deep-link candidate intent-filter(s) inspected`);
+        }
+    }
+    return buildAndroidManifestCheckResult({
+        id: "android-deep-links-audit",
+        category: "android-deep-links",
+        title: "Android deep-link audit",
+        detection,
+        manifests,
+        findings,
+        evidence,
+        warnings,
+    });
+}