@dailephd/my-dev-kit-lab 0.3.4 → 0.4.1

package/dist/src/mobile/android/advancedSecurity/webview/checkResult.js

@@ -0,0 +1,210 @@
+import { makeAndroidFinding } from "../../audit/androidFinding.js";
+import { makeCandidateEvidence } from "../candidateEvidence.js";
+import { sortCandidateEvidence } from "../ordering.js";
+import { buildAndroidSourceLocation } from "../sourceLocation.js";
+import { discoverSecretSourceFiles } from "../secretCandidates/discoverSecretSourceFiles.js";
+export const ANDROID_WEBVIEW_SECURITY_AUDIT_CHECK_ID = "android-webview-security-audit";
+const CALL = /(?:([A-Za-z_][\w.]*(?:\.getSettings\(\))?)\.)?(setJavaScriptEnabled|addJavascriptInterface|setAllowFileAccess|setAllowContentAccess|setAllowFileAccessFromFileURLs|setAllowUniversalAccessFromFileURLs|setMixedContentMode|setWebContentsDebuggingEnabled|loadUrl|postUrl|loadData|loadDataWithBaseURL|proceed|cancel)\s*\(([^\n)]*)\)/g;
+const PROPERTY = /([A-Za-z_][\w.]*)\.(javaScriptEnabled|allowFileAccess|allowContentAccess|allowFileAccessFromFileURLs|allowUniversalAccessFromFileURLs|mixedContentMode)\s*=\s*([^;\n}]+)/g;
+const SETTINGS_ALIAS = /(?:\bWebSettings\s+|\b(?:val|var)\s+)([A-Za-z_]\w*)\s*=\s*([A-Za-z_][\w.]*)\s*(?:\.getSettings\(\)|\.settings)/g;
+const MAX_ARGUMENT = 240;
+function lineAt(text, offset) { return text.slice(0, offset).split("\n").length; }
+// Masks comments and string *contents* while preserving offsets/newlines.
+// Calls are matched only in code; the original text is then used for the
+// bounded argument summary. This intentionally local scanner is not a Java
+// or Kotlin parser and never attempts type/provenance resolution.
+function executableMask(source) {
+    let out = "";
+    let i = 0;
+    let state = "code";
+    let quote = "";
+    while (i < source.length) {
+        const ch = source[i], next = source[i + 1];
+        if (state === "code" && ch === "/" && next === "/") {
+            out += "  ";
+            i += 2;
+            state = "line";
+            continue;
+        }
+        if (state === "code" && ch === "/" && next === "*") {
+            out += "  ";
+            i += 2;
+            state = "block";
+            continue;
+        }
+        if (state === "code" && source.slice(i, i + 3) === '\"\"\"') {
+            out += '\"\"\"';
+            i += 3;
+            state = "raw";
+            continue;
+        }
+        if (state === "code" && (ch === '"' || ch === "'")) {
+            quote = ch;
+            out += ch;
+            i++;
+            state = "quote";
+            continue;
+        }
+        if (state === "line") {
+            out += ch === "\n" ? "\n" : " ";
+            if (ch === "\n")
+                state = "code";
+            i++;
+            continue;
+        }
+        if (state === "block") {
+            out += ch === "\n" ? "\n" : " ";
+            if (ch === "*" && next === "/") {
+                out = out.slice(0, -1) + "  ";
+                i += 2;
+                state = "code";
+            }
+            else
+                i++;
+            continue;
+        }
+        if (state === "raw") {
+            if (source.slice(i, i + 3) === '\"\"\"') {
+                out += '\"\"\"';
+                i += 3;
+                state = "code";
+            }
+            else {
+                out += ch === "\n" ? "\n" : " ";
+                i++;
+            }
+            continue;
+        }
+        if (state === "quote") {
+            if (ch === "\\") {
+                out += "  ";
+                i += 2;
+                continue;
+            }
+            out += ch === "\n" ? "\n" : (ch === quote ? ch : " ");
+            if (ch === quote)
+                state = "code";
+            i++;
+            continue;
+        }
+        out += ch;
+        i++;
+    }
+    return out;
+}
+function braceEnd(mask, open) { let depth = 0; for (let i = open; i < mask.length; i++) {
+    if (mask[i] === "{")
+        depth++;
+    else if (mask[i] === "}" && --depth === 0)
+        return i;
+} return mask.length; }
+function scopeRanges(mask) { const ranges = []; const header = /(?:\bfun\s+([A-Za-z_]\w*)\s*\([^)]*\)|\b(?:public|private|protected|override|static|final|suspend|void|[A-Z][\w<>?\[\]]*)[\s\w<>?\[\]]*?\s+([A-Za-z_]\w*)\s*\([^)]*\))\s*\{/g; for (const match of mask.matchAll(header)) {
+    const from = (match.index ?? 0);
+    const open = from + match[0].length - 1;
+    ranges.push({ from, to: braceEnd(mask, open), id: `${match[1] ?? match[2] ?? "scope"}@${from}` });
+} return ranges; }
+function sslRanges(mask) { const ranges = []; for (const match of mask.matchAll(/onReceivedSslError\s*\([^)]*\)\s*\{/g)) {
+    const start = (match.index ?? 0) + match[0].length - 1;
+    ranges.push([start, braceEnd(mask, start)]);
+} return ranges; }
+function literal(argument) {
+    const trimmed = argument.trim();
+    return trimmed === "true" ? "true" : trimmed === "false" ? "false" : undefined;
+}
+function finding(ruleId, title, file, line, identity, severity) {
+    return makeAndroidFinding({ ruleId, title, severity, confidence: "high", description: `${title}. This is static source evidence only and does not prove runtime execution or exploitability.`, manifestPath: file, identity, location: { line }, recommendation: "Review the configuration and keep WebView capabilities limited to documented requirements." });
+}
+function candidate(ruleId, targetRoot, file, line, summary, rawValue) {
+    return makeCandidateEvidence({ ruleId, category: "android-webview", confidence: "medium", modulePath: file.modulePath, location: buildAndroidSourceLocation(targetRoot, file.absolutePath, { line }), summary, rawValue: rawValue.slice(0, MAX_ARGUMENT), resolutionState: "resolved", staticAnalysisLimitations: ["Bounded lexical source analysis; receiver types, call ordering, and dynamic values are not resolved."] });
+}
+export function auditAndroidWebViewSecurity(targetRoot, detection) {
+    if (detection.projectKind === "non-android")
+        return { id: ANDROID_WEBVIEW_SECURITY_AUDIT_CHECK_ID, category: "android-webview", title: "Android WebView security audit", status: "unsupported", requirementLevel: "optional", ran: false, skipped: true, skipInfo: { checkId: ANDROID_WEBVIEW_SECURITY_AUDIT_CHECK_ID, reason: "Target was not detected as Android.", requirementLevel: "optional", verdictImpact: "does not apply", recommendedNextAction: "Run against an Android project." }, evidence: [], findings: [], warnings: [], errors: [], sourcePaths: [], confidence: "unknown", environmentRequirements: [], candidateEvidence: [] };
+    const discovered = discoverSecretSourceFiles(targetRoot, detection.modules.map((m) => m.path));
+    const files = discovered.files.filter((file) => /\.(java|kt)$/.test(file.relativePath));
+    const findings = [];
+    const candidates = [];
+    for (const file of files) {
+        const mask = executableMask(file.content);
+        const ssl = sslRanges(mask);
+        const scopes = scopeRanges(mask);
+        const calls = [];
+        const contextAt = (offset) => scopes.filter((scope) => offset >= scope.from && offset <= scope.to).sort((a, b) => a.to - a.from - (b.to - b.from))[0]?.id ?? "(unresolved-scope)";
+        const aliases = new Map();
+        for (const match of mask.matchAll(SETTINGS_ALIAS))
+            aliases.set(`${contextAt(match.index ?? 0)}:${match[1]}`, match[2]);
+        const normalize = (receiver, method, context) => { const stripped = receiver.replace(/\.getSettings\(\)$|\.settings$/, ""); if (stripped !== receiver)
+            return stripped; if (method.startsWith("set") && aliases.has(`${context}:${receiver}`))
+            return aliases.get(`${context}:${receiver}`); return receiver; };
+        CALL.lastIndex = 0;
+        for (let match; (match = CALL.exec(mask));) {
+            const start = match.index;
+            const original = file.content.slice(start, start + match[0].length);
+            const argument = original.slice(original.indexOf("(") + 1, -1).slice(0, MAX_ARGUMENT);
+            const line = lineAt(file.content, start);
+            const context = contextAt(start);
+            calls.push({ receiver: normalize(match[1] ?? "(unresolved)", match[2], context), method: match[2], argument, line, context, inSslCallback: ssl.some(([from, to]) => start > from && start < to) });
+        }
+        PROPERTY.lastIndex = 0;
+        for (let match; (match = PROPERTY.exec(mask));) {
+            const start = match.index;
+            const original = file.content.slice(start, start + match[0].length);
+            const eq = original.indexOf("=");
+            const propertyToMethod = { javaScriptEnabled: "setJavaScriptEnabled", allowFileAccess: "setAllowFileAccess", allowContentAccess: "setAllowContentAccess", allowFileAccessFromFileURLs: "setAllowFileAccessFromFileURLs", allowUniversalAccessFromFileURLs: "setAllowUniversalAccessFromFileURLs", mixedContentMode: "setMixedContentMode" };
+            const method = propertyToMethod[match[2]], context = contextAt(start);
+            calls.push({ receiver: normalize(match[1], method, context), method, argument: original.slice(eq + 1).trim().slice(0, MAX_ARGUMENT), line: lineAt(file.content, start), context, inSslCallback: ssl.some(([from, to]) => start > from && start < to) });
+        }
+        for (const call of calls) {
+            const value = literal(call.argument);
+            if (call.method === "setAllowUniversalAccessFromFileURLs" && value === "true")
+                findings.push(finding("android-webview-universal-file-url-access", "WebView universal file URL access is explicitly enabled", file.relativePath, call.line, call.context, "major"));
+            else if (call.method === "setMixedContentMode" && /MIXED_CONTENT_ALWAYS_ALLOW|0\b/.test(call.argument))
+                findings.push(finding("android-webview-mixed-content", "WebView mixed content is explicitly always allowed", file.relativePath, call.line, call.context, "major"));
+            else if (call.method === "setWebContentsDebuggingEnabled" && value === "true" && /(?:^|\.)WebView$/.test(call.receiver))
+                findings.push(finding("android-webview-debugging-enabled", "WebView debugging is explicitly enabled", file.relativePath, call.line, call.context, "minor"));
+            else if (call.method === "proceed" && call.inSslCallback)
+                findings.push(finding("android-webview-ssl-error-proceed", "SSL error callback proceeds despite the certificate error", file.relativePath, call.line, call.context, "major"));
+            else if (call.method === "setJavaScriptEnabled" && value !== "false")
+                candidates.push(candidate("android-webview-javascript-enabled", targetRoot, file, call.line, value === "true" ? "JavaScript is explicitly enabled" : "JavaScript enablement is dynamic or unresolved", call.argument));
+            else if (["setAllowFileAccess", "setAllowContentAccess", "setAllowFileAccessFromFileURLs", "setAllowUniversalAccessFromFileURLs"].includes(call.method) && value !== "false")
+                candidates.push(candidate(call.method === "setAllowUniversalAccessFromFileURLs" ? "android-webview-universal-file-url-access" : "android-webview-file-content-access", targetRoot, file, call.line, `WebView ${call.method} is ${value === "true" ? "enabled" : "dynamic or unresolved"}`, call.argument));
+            else if (call.method === "addJavascriptInterface")
+                candidates.push(candidate("android-webview-javascript-interface-exposure", targetRoot, file, call.line, "JavaScript interface registration source evidence", call.argument));
+            else if (call.method === "setMixedContentMode" && /MIXED_CONTENT_COMPATIBILITY_MODE|1\b/.test(call.argument))
+                candidates.push(candidate("android-webview-mixed-content", targetRoot, file, call.line, "WebView mixed-content compatibility mode is configured", call.argument));
+            else if (call.method === "setMixedContentMode" && !/MIXED_CONTENT_NEVER_ALLOW|2\b/.test(call.argument))
+                candidates.push(candidate("android-webview-mixed-content", targetRoot, file, call.line, "WebView mixed-content mode is dynamic or unresolved", call.argument));
+            else if (call.method === "setWebContentsDebuggingEnabled" && value !== "false")
+                candidates.push(candidate("android-webview-debugging-enabled", targetRoot, file, call.line, "WebView debugging state is dynamic or receiver context is unresolved", call.argument));
+            else if (["loadUrl", "postUrl", "loadData", "loadDataWithBaseURL"].includes(call.method)) {
+                if (/^\s*["']javascript:/i.test(call.argument))
+                    candidates.push(candidate("android-webview-suspicious-url-loading", targetRoot, file, call.line, "javascript: WebView URL loading evidence", call.argument));
+                else if (/^\s*["'](?:http|file|content):/i.test(call.argument))
+                    candidates.push(candidate("android-webview-suspicious-url-loading", targetRoot, file, call.line, "WebView loads a review-oriented literal scheme", call.argument));
+                else if (!/^\s*["']https:/i.test(call.argument))
+                    candidates.push(candidate("android-webview-suspicious-url-loading", targetRoot, file, call.line, "Dynamic or unsupported WebView content loading argument", call.argument));
+            }
+        }
+        for (const [from, to] of ssl) {
+            const contained = calls.filter((call) => call.inSslCallback && call.method === "proceed" || call.inSslCallback && call.method === "cancel");
+            if (contained.length === 0)
+                candidates.push(candidate("android-webview-ssl-error-proceed", targetRoot, file, lineAt(file.content, from), mask.slice(from, Math.min(to, from + MAX_ARGUMENT)).trim() ? "SSL error callback delegates or has unresolved local behavior" : "SSL error callback is empty", file.content.slice(from, Math.min(to, from + MAX_ARGUMENT))));
+        }
+        const same = (a, b) => a.receiver !== "(unresolved)" && a.receiver === b.receiver && a.context === b.context;
+        for (const js of calls.filter((c) => c.method === "setJavaScriptEnabled" && literal(c.argument) === "true"))
+            for (const bridge of calls.filter((c) => c.method === "addJavascriptInterface" && same(c, js)))
+                findings.push(finding("android-webview-javascript-interface-exposure", "JavaScript and addJavascriptInterface occur on the same receiver in one method", file.relativePath, bridge.line, `${js.receiver}:${js.context}`, "major"));
+        for (const js of calls.filter((c) => c.method === "setJavaScriptEnabled" && literal(c.argument) === "true"))
+            for (const access of calls.filter((c) => ["setAllowFileAccessFromFileURLs", "setAllowUniversalAccessFromFileURLs"].includes(c.method) && literal(c.argument) === "true" && same(c, js)))
+                findings.push(finding("android-webview-file-content-access", "JavaScript and file URL access occur on the same receiver in one method", file.relativePath, access.line, `${js.receiver}:${js.context}`, "major"));
+        for (const js of calls.filter((c) => c.method === "setJavaScriptEnabled" && literal(c.argument) === "true"))
+            for (const url of calls.filter((c) => c.method === "loadUrl" && /^\s*["']javascript:/i.test(c.argument) && same(c, js)))
+                findings.push(finding("android-webview-suspicious-url-loading", "JavaScript is enabled and a javascript: URL is loaded on the same receiver", file.relativePath, url.line, `${js.receiver}:${js.context}`, "major"));
+        for (const mixed of calls.filter((c) => c.method === "setMixedContentMode" && /MIXED_CONTENT_ALWAYS_ALLOW|0\b/.test(c.argument)))
+            for (const url of calls.filter((c) => c.method === "loadUrl" && /^\s*["']http:\/\//i.test(c.argument) && same(c, mixed)))
+                findings.push(finding("android-webview-mixed-content", "Always-allowed mixed content and HTTP loading occur on the same receiver", file.relativePath, url.line, `${mixed.receiver}:${mixed.context}`, "major"));
+    }
+    const uniqueFindings = [...new Map(findings.map((item) => [item.id, item])).values()].sort((a, b) => a.id.localeCompare(b.id));
+    const uniqueCandidates = [...new Map(candidates.map((item) => [item.id, item])).values()];
+    return { id: ANDROID_WEBVIEW_SECURITY_AUDIT_CHECK_ID, category: "android-webview", title: "Android WebView security audit", status: uniqueFindings.length ? "failed" : "passed", requirementLevel: "required", ran: true, skipped: false, evidence: [`${files.length} Java/Kotlin file(s) scanned`], findings: uniqueFindings, warnings: [...discovered.skipped.map((item) => `${item.relativePath}: skipped (${item.reason})`), "Static analysis only: no compiler, runtime, URL provenance, or whole-program analysis was used."], errors: [], sourcePaths: files.map((file) => file.relativePath), confidence: discovered.skipped.length ? "medium" : "high", environmentRequirements: [], candidateEvidence: sortCandidateEvidence(uniqueCandidates) };
+}

package/dist/src/mobile/android/advancedSecurity/webview/index.js

@@ -0,0 +1 @@
+export { auditAndroidWebViewSecurity, ANDROID_WEBVIEW_SECURITY_AUDIT_CHECK_ID } from "./checkResult.js";

package/dist/src/mobile/android/audit/androidFinding.js

@@ -0,0 +1,68 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 3 — Android SecurityFinding factory.
+//
+// Reuses SecurityFinding as-is (no parallel Android finding schema). Android
+// findings use category "static-scan" — an existing SecurityCheckCategory
+// value that already covers static-analysis-derived findings (CodeQL,
+// Semgrep) and accurately describes manifest analysis, so no widening of the
+// shared, heavily-tested SecurityCheckCategory union was needed. Per-finding
+// audit family is instead carried by the owning AndroidCheckResult.category
+// (android-permissions/android-components/android-intent-filters/
+// android-deep-links) and by the finding id/title.
+//
+// SecurityFinding has no `confidence` or structured `location` field (the
+// existing codebase convention, e.g. AttackResult, keeps confidence on the
+// *check result*, not the individual finding — see
+// src/securityValidation/attackScenarios/attackResult.ts). Android check
+// results already carry `confidence: MobileConfidence` (Batch 1). Per-finding
+// confidence and location are therefore folded into the free-text `evidence`
+// field here, consistent with how existing scenario code joins evidence
+// previews into that same field.
+// ---------------------------------------------------------------------------
+function slug(value) {
+    return value
+        .replace(/[^a-zA-Z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .toLowerCase();
+}
+// Deterministic, content-derived id — never depends on a counter, timestamp,
+// or enumeration order, so equivalent evidence always yields the same id.
+function buildFindingId(ruleId, manifestPath, identity, location) {
+    const parts = [ruleId, slug(manifestPath), identity ? slug(identity) : undefined, location?.line !== undefined ? `l${location.line}` : undefined].filter((part) => Boolean(part));
+    return parts.join("--");
+}
+function defaultReleaseImpact(severity) {
+    switch (severity) {
+        case "blocker":
+            return "Must fix before release";
+        case "major":
+            return "Should fix before release";
+        case "minor":
+            return "Review recommended before release";
+        case "informational":
+            return "No release impact; informational only";
+        case "skipped":
+            return "Not evaluated";
+    }
+}
+export function makeAndroidFinding(input) {
+    const id = buildFindingId(input.ruleId, input.manifestPath, input.identity, input.location);
+    const locationSuffix = input.location?.line !== undefined ? `:${input.location.line}` : "";
+    const evidenceParts = [
+        `confidence=${input.confidence}`,
+        input.identity ? `identity=${input.identity}` : undefined,
+        `location=${input.manifestPath}${locationSuffix}`,
+        ...(input.evidenceDetails ?? []),
+    ].filter((part) => Boolean(part));
+    return {
+        id,
+        title: input.title,
+        severity: input.severity,
+        category: "static-scan",
+        description: input.description,
+        evidence: evidenceParts.join(" | "),
+        affectedFiles: [input.manifestPath],
+        recommendation: input.recommendation,
+        releaseImpact: input.releaseImpact ?? defaultReleaseImpact(input.severity),
+    };
+}

package/dist/src/mobile/android/audit/checkResultBuilder.js

@@ -0,0 +1,97 @@
+function isMalformed(entry) {
+    return entry.manifest.parseWarnings.some((w) => w.startsWith("Malformed XML:"));
+}
+export function buildAndroidManifestCheckResult(input) {
+    const { id, category, title, detection, manifests, findings, evidence, warnings } = input;
+    const sourcePaths = manifests.map((m) => m.manifestPath);
+    if (detection.projectKind === "non-android") {
+        return {
+            id,
+            category,
+            title,
+            status: "unsupported",
+            requirementLevel: "optional",
+            ran: false,
+            skipped: true,
+            skipInfo: {
+                checkId: id,
+                reason: "Target was not detected as an Android project.",
+                requirementLevel: "optional",
+                missingCapability: "android-detection",
+                verdictImpact: "does not apply to a non-Android target",
+                recommendedNextAction: "Re-run against an Android Gradle project, or verify project detection.",
+            },
+            evidence: [],
+            findings: [],
+            warnings: [],
+            errors: [],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+        };
+    }
+    if (manifests.length === 0) {
+        return {
+            id,
+            category,
+            title,
+            status: "inconclusive",
+            requirementLevel: "required",
+            ran: true,
+            skipped: false,
+            evidence,
+            findings: [],
+            warnings: [...warnings, "No AndroidManifest.xml was found for this target; audit could not run."],
+            errors: [],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+        };
+    }
+    const malformedEntries = manifests.filter(isMalformed);
+    const allMalformed = malformedEntries.length === manifests.length;
+    if (allMalformed) {
+        return {
+            id,
+            category,
+            title,
+            status: "error",
+            requirementLevel: "required",
+            ran: true,
+            skipped: false,
+            evidence,
+            findings: [],
+            warnings,
+            errors: malformedEntries.flatMap((entry) => entry.manifest.parseWarnings.filter((w) => w.startsWith("Malformed XML:"))),
+            sourcePaths,
+            confidence: "unknown",
+            environmentRequirements: [],
+        };
+    }
+    const confidence = malformedEntries.length > 0 ? "medium" : "high";
+    // Informational-only findings (e.g. "standard launcher activity is
+    // exported, as expected") are evidence/inventory, not a reportable issue —
+    // only minor/major/blocker findings cause a "failed" status, matching
+    // section 7.17's "completed and found no reportable issues may pass".
+    const hasReportableFinding = findings.some((finding) => finding.severity !== "informational");
+    const status = hasReportableFinding ? "failed" : "passed";
+    return {
+        id,
+        category,
+        title,
+        status,
+        requirementLevel: "required",
+        ran: true,
+        skipped: false,
+        evidence,
+        findings,
+        warnings: [
+            ...warnings,
+            ...malformedEntries.flatMap((entry) => entry.manifest.parseWarnings.filter((w) => w.startsWith("Malformed XML:"))),
+        ],
+        errors: [],
+        sourcePaths,
+        confidence,
+        environmentRequirements: [],
+    };
+}

package/dist/src/mobile/android/audit/deepLinkAudit.js

@@ -0,0 +1,183 @@
+import { makeAndroidFinding } from "./androidFinding.js";
+import { buildAndroidManifestCheckResult } from "./checkResultBuilder.js";
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 3 — initial deep-link audit.
+//
+// Distinguishes web links (http/https) from custom-scheme deep links, flags
+// missing host/scheme restrictions and broad path patterns, and treats
+// BROWSABLE-without-VIEW and VIEW-without-BROWSABLE as separate "incomplete
+// filter" observations (agents.txt Batch 3 section 7.16). Never claims
+// Digital Asset Links verification, domain ownership, or exploitability —
+// findings are framed as static exposure/configuration review, at most
+// "major" for the narrow high-confidence case of an explicitly exported,
+// unprotected, wildcard-path activity.
+// ---------------------------------------------------------------------------
+const VIEW_ACTION = "android.intent.action.VIEW";
+const BROWSABLE_CATEGORY = "android.intent.category.BROWSABLE";
+const WILDCARD_PATTERN = /[*.]{1,2}\*|\.\*/;
+function isPlaceholder(value) {
+    return value !== undefined && (value.includes("${") || value.startsWith("@"));
+}
+function classifyScheme(dataElements) {
+    const schemes = dataElements.map((d) => d.dataScheme).filter((s) => Boolean(s));
+    if (schemes.length === 0)
+        return "none";
+    if (schemes.some((s) => s === "http" || s === "https"))
+        return "web";
+    return "custom";
+}
+function auditDeepLinkFilter(entry, kind, component, filter, findings) {
+    const identity = component.name || "(unnamed component)";
+    const actions = filter.actions ?? [];
+    const categories = filter.categories ?? [];
+    const dataElements = filter.dataElements ?? filter.filterData;
+    const hasView = actions.includes(VIEW_ACTION);
+    const hasBrowsable = categories.includes(BROWSABLE_CATEGORY);
+    if (!hasView && !hasBrowsable)
+        return;
+    if (hasBrowsable && !hasView) {
+        findings.push(makeAndroidFinding({
+            ruleId: "android-deep-link-browsable-without-view",
+            title: `BROWSABLE category without a VIEW action on ${kind} "${identity}"`,
+            severity: "informational",
+            confidence: "high",
+            description: "This <intent-filter> declares category BROWSABLE without action VIEW, so it will not actually be treated as a browsable web/deep link by the platform.",
+            manifestPath: entry.manifestPath,
+            identity,
+            location: filter.location,
+        }));
+        return;
+    }
+    if (hasView && !hasBrowsable && dataElements.length === 0) {
+        // Plain VIEW with no data and no BROWSABLE — not a deep link, nothing to audit here.
+        return;
+    }
+    const exportedExplicitTrue = component.exported === true;
+    const unprotected = !component.permission;
+    const scheme = classifyScheme(dataElements);
+    const hasHost = dataElements.some((d) => Boolean(d.dataHost));
+    const placeholderEvidence = dataElements.some((d) => isPlaceholder(d.dataScheme) || isPlaceholder(d.dataHost) || isPlaceholder(d.dataPath) || isPlaceholder(d.dataPathPrefix) || isPlaceholder(d.dataPathPattern));
+    const broadPattern = dataElements.some((d) => (d.dataPathPattern && WILDCARD_PATTERN.test(d.dataPathPattern)) || d.dataPathPattern === ".*" || d.dataPathPattern === "*");
+    const evidenceDetails = [
+        `scheme=${scheme}`,
+        `hasHost=${hasHost}`,
+        `exported=${component.exported ?? "unspecified"}`,
+        `hasComponentPermission=${!unprotected}`,
+        `dataElementCount=${dataElements.length}`,
+    ];
+    if (placeholderEvidence) {
+        findings.push(makeAndroidFinding({
+            ruleId: "android-deep-link-placeholder-value",
+            title: `Deep-link data on ${kind} "${identity}" contains an unresolved placeholder or resource reference`,
+            severity: "informational",
+            confidence: "low",
+            description: "One or more deep-link data attributes (scheme/host/path) reference an unresolved manifest placeholder (e.g. ${applicationId}) or Android resource (e.g. @string/...). Effective exposure cannot be assessed statically.",
+            manifestPath: entry.manifestPath,
+            identity,
+            location: filter.location,
+            evidenceDetails,
+        }));
+        return;
+    }
+    if (broadPattern) {
+        const strongEvidence = exportedExplicitTrue && unprotected;
+        findings.push(makeAndroidFinding({
+            ruleId: "android-deep-link-broad-path-pattern",
+            title: `Broad/wildcard deep-link path pattern on ${kind} "${identity}"`,
+            severity: strongEvidence ? "major" : "minor",
+            confidence: strongEvidence ? "high" : "medium",
+            description: strongEvidence
+                ? "This deep-link filter uses a highly permissive pathPattern, the component is explicitly exported, and no component-level permission protects it — a strong static combination of broad matching and open reachability."
+                : "This deep-link filter uses a broad/wildcard-like pathPattern. Broad path matching is not automatically exploitable, but widens the set of URLs the app will handle.",
+            manifestPath: entry.manifestPath,
+            identity,
+            location: filter.location,
+            evidenceDetails,
+            recommendation: "Narrow the pathPattern to only the routes the app actually needs to handle, and validate any path/query data before use.",
+        }));
+        return;
+    }
+    if (scheme === "web" && !hasHost) {
+        findings.push(makeAndroidFinding({
+            ruleId: "android-deep-link-web-link-without-host",
+            title: `HTTP/HTTPS deep link on ${kind} "${identity}" has no host restriction`,
+            severity: "minor",
+            confidence: "medium",
+            description: "This web-link intent filter declares an http/https scheme without a host, so it is not restricted to a specific domain.",
+            manifestPath: entry.manifestPath,
+            identity,
+            location: filter.location,
+            evidenceDetails,
+            recommendation: "Add android:host to restrict which domains this filter matches.",
+        }));
+        return;
+    }
+    if (scheme === "custom" && !hasHost) {
+        findings.push(makeAndroidFinding({
+            ruleId: "android-deep-link-custom-scheme-without-host",
+            title: `Custom-scheme deep link on ${kind} "${identity}" has no host restriction`,
+            severity: "minor",
+            confidence: "medium",
+            description: "This custom-scheme intent filter declares no host restriction. Custom schemes are not automatically vulnerabilities, but an unrestricted scheme accepts any host/path combination.",
+            manifestPath: entry.manifestPath,
+            identity,
+            location: filter.location,
+            evidenceDetails,
+            recommendation: "Consider restricting the host or validating incoming URIs defensively in the handling code.",
+        }));
+        return;
+    }
+    // Bounded/safe deep link: explicit scheme + host (+ optional path
+    // restriction), no wildcard pattern, no placeholders — recorded for
+    // inventory purposes at informational severity only (ANDROID-B3-24).
+    findings.push(makeAndroidFinding({
+        ruleId: "android-deep-link-bounded",
+        title: `Deep link declared on ${kind} "${identity}"`,
+        severity: "informational",
+        confidence: "high",
+        description: "This deep-link filter declares an explicit scheme and host with bounded path evidence. No static exposure concern was identified.",
+        manifestPath: entry.manifestPath,
+        identity,
+        location: filter.location,
+        evidenceDetails,
+    }));
+}
+function componentGroups(entry) {
+    return [
+        { kind: "activity", components: entry.manifest.activities },
+        { kind: "activity-alias", components: entry.manifest.activityAliases ?? [] },
+    ];
+}
+export function auditAndroidDeepLinks(detection, manifests) {
+    const findings = [];
+    const evidence = [];
+    const warnings = [];
+    for (const entry of manifests) {
+        let candidateCount = 0;
+        for (const group of componentGroups(entry)) {
+            for (const component of group.components) {
+                for (const filter of component.intentFilters) {
+                    const actions = filter.actions ?? [];
+                    const categories = filter.categories ?? [];
+                    if (actions.includes(VIEW_ACTION) || categories.includes(BROWSABLE_CATEGORY)) {
+                        candidateCount += 1;
+                        auditDeepLinkFilter(entry, group.kind, component, filter, findings);
+                    }
+                }
+            }
+        }
+        if (candidateCount > 0) {
+            evidence.push(`${entry.manifestPath}: ${candidateCount} deep-link candidate intent-filter(s) inspected`);
+        }
+    }
+    return buildAndroidManifestCheckResult({
+        id: "android-deep-links-audit",
+        category: "android-deep-links",
+        title: "Android deep-link audit",
+        detection,
+        manifests,
+        findings,
+        evidence,
+        warnings,
+    });
+}