@dailephd/my-dev-kit-lab 0.4.0 → 0.4.1

package/dist/src/mobile/android/advancedSecurity/backupConfiguration/parseBackupRules.js

@@ -0,0 +1,110 @@
+import { findChildren, parseXmlDocument } from "../../manifest/xml/parseXml.js";
+import { BACKUP_DOMAIN_VALUES, MAX_BACKUP_RULES_PER_SCOPE, } from "./types.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 3 — dependency-free parser for the legacy
+// <full-backup-content> and newer <data-extraction-rules> XML formats.
+//
+// Builds on the existing bounded XML tree parser
+// (src/mobile/android/manifest/xml/parseXml.ts), mirroring Batch 2's
+// parseNetworkSecurityConfig.ts layering — no second XML tokenizer. Parses
+// exactly one already-resolved, target-contained file; never merges files,
+// never evaluates resource overlays, never invokes Gradle/Android SDK/
+// network. Malformed XML or an unsupported root never throws.
+// ---------------------------------------------------------------------------
+function getUnprefixedAttribute(element, localName) {
+    return element.attributes.find((attr) => attr.prefix === undefined && attr.localName === localName)?.value;
+}
+function parseBooleanAttribute(element, localName) {
+    const raw = getUnprefixedAttribute(element, localName);
+    if (raw === undefined)
+        return {};
+    if (raw === "true")
+        return { value: true, raw };
+    if (raw === "false")
+        return { value: false, raw };
+    return { raw };
+}
+function isBackupDomainValue(value) {
+    return BACKUP_DOMAIN_VALUES.includes(value);
+}
+function parseRuleEntry(kind, element) {
+    const domainRaw = getUnprefixedAttribute(element, "domain");
+    const path = getUnprefixedAttribute(element, "path");
+    const requireFlagsRaw = getUnprefixedAttribute(element, "requireFlags");
+    const domain = domainRaw !== undefined && isBackupDomainValue(domainRaw) ? domainRaw : undefined;
+    const malformed = domainRaw === undefined || path === undefined || path.length === 0;
+    const malformedReason = domainRaw === undefined ? "Missing domain attribute" : path === undefined || path.length === 0 ? "Missing or empty path attribute" : undefined;
+    return {
+        kind,
+        domainRaw,
+        domain,
+        path,
+        requireFlagsRaw,
+        location: element.location,
+        malformed,
+        malformedReason,
+    };
+}
+function parseRuleEntries(scopeElement) {
+    const includeEntries = findChildren(scopeElement, "include").map((el) => parseRuleEntry("include", el));
+    const excludeEntries = findChildren(scopeElement, "exclude").map((el) => parseRuleEntry("exclude", el));
+    // Preserves document order (include/exclude interleaving is semantically
+    // meaningful in the real format) rather than grouping by kind — includes
+    // are collected first only because findChildren is kind-specific; the
+    // caller should not assume this array reflects source order for mixed
+    // kinds beyond what findChildren naturally preserves per kind.
+    return [...includeEntries, ...excludeEntries].slice(0, MAX_BACKUP_RULES_PER_SCOPE);
+}
+function parseFullBackupContent(root, warnings) {
+    const knownChildren = new Set(["include", "exclude"]);
+    const unsupportedChildren = root.children.filter((child) => !knownChildren.has(child.localName)).map((child) => `<${child.tagName}> at line ${child.location.line}`);
+    const rules = parseRuleEntries(root);
+    if (rules.length >= MAX_BACKUP_RULES_PER_SCOPE) {
+        warnings.push(`<full-backup-content> rule count reached the bounded maximum of ${MAX_BACKUP_RULES_PER_SCOPE}; further rules were not processed.`);
+    }
+    return { rules, unsupportedChildren };
+}
+function parseDataExtractionRuleSet(element) {
+    const disableResult = parseBooleanAttribute(element, "disableIfNoEncryptionCapabilities");
+    return {
+        disableIfNoEncryptionCapabilities: disableResult.value,
+        disableIfNoEncryptionCapabilitiesRaw: disableResult.raw,
+        rules: parseRuleEntries(element),
+        location: element.location,
+    };
+}
+function parseDataExtractionRules(root, warnings) {
+    const knownChildren = new Set(["cloud-backup", "device-transfer"]);
+    const unsupportedChildren = root.children.filter((child) => !knownChildren.has(child.localName)).map((child) => `<${child.tagName}> at line ${child.location.line}`);
+    const cloudBackupEl = findChildren(root, "cloud-backup")[0];
+    if (findChildren(root, "cloud-backup").length > 1) {
+        warnings.push("Multiple <cloud-backup> elements found; only the first was used.");
+    }
+    const deviceTransferEl = findChildren(root, "device-transfer")[0];
+    if (findChildren(root, "device-transfer").length > 1) {
+        warnings.push("Multiple <device-transfer> elements found; only the first was used.");
+    }
+    return {
+        cloudBackup: cloudBackupEl ? parseDataExtractionRuleSet(cloudBackupEl) : undefined,
+        deviceTransfer: deviceTransferEl ? parseDataExtractionRuleSet(deviceTransferEl) : undefined,
+        unsupportedChildren,
+    };
+}
+// Parses either legacy full-backup-content or data-extraction-rules XML
+// text, selecting the semantic model by the document's actual root element.
+// Never throws for ordinary malformed external input.
+export function parseBackupRules(xmlText) {
+    const parsed = parseXmlDocument(xmlText);
+    if (!parsed.ok) {
+        return { state: "malformed-xml", reason: parsed.error.message, location: parsed.error.location };
+    }
+    const root = parsed.root;
+    const warnings = parsed.warnings.map((w) => `${w.message} (line ${w.location.line})`);
+    if (root.localName === "full-backup-content") {
+        return { state: "parsed-full-backup-content", model: parseFullBackupContent(root, warnings), warnings };
+    }
+    if (root.localName === "data-extraction-rules") {
+        return { state: "parsed-data-extraction-rules", model: parseDataExtractionRules(root, warnings), warnings };
+    }
+    return { state: "unsupported-root", rootTagName: root.tagName };
+}

package/dist/src/mobile/android/advancedSecurity/backupConfiguration/types.js

@@ -0,0 +1,27 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 3 — bounded backup/data-extraction XML parse-tree model.
+//
+// Covers both the legacy <full-backup-content> format (API <=30, still
+// widely used) and the newer <data-extraction-rules> format (API 31+,
+// separates <cloud-backup> from <device-transfer>). Local to Android
+// advanced security, mirroring Batch 2's networkSecurity/types.ts pattern —
+// not pushed into the generic XML tree model. Locations are line/column
+// only; file/module/source-set identity is attached by the caller once a
+// file is resolved (see manifestEvidence.ts).
+// ---------------------------------------------------------------------------
+export const BACKUP_DOMAIN_VALUES = [
+    "root",
+    "file",
+    "database",
+    "sharedpref",
+    "external",
+    "device_root",
+    "device_file",
+    "device_database",
+    "device_sharedpref",
+    "device_external",
+];
+// Defensive bound on the number of rule entries processed from one file —
+// mirrors Batch 2's MAX_DOMAIN_CONFIG_DEPTH bound philosophy (never let a
+// pathological fixture/target cause unbounded work).
+export const MAX_BACKUP_RULES_PER_SCOPE = 500;

package/dist/src/mobile/android/advancedSecurity/candidateEvidence.js

@@ -0,0 +1,50 @@
+import { fingerprintCandidateValue, redactedPreviewForCandidate } from "./redaction.js";
+// Resolution states for a static candidate's underlying evidence (e.g. did a
+// referenced resource file resolve, was a signing config path found). Kept
+// narrow and additive; overlaps deliberately with AndroidCheckStatus/XML
+// resource-resolution states where the underlying concept is the same
+// (resolved and missing/malformed/unsupported are shared vocabulary), but
+// this is not a duplicate of AndroidCheckStatus — a candidate's resolution
+// state describes one piece of referenced evidence, not an entire check.
+export const CANDIDATE_RESOLUTION_STATES = ["resolved", "unresolved", "missing", "malformed", "unsupported", "not-applicable"];
+function slug(value) {
+    return value
+        .replace(/[^a-zA-Z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .toLowerCase();
+}
+// Deterministic, content-derived id (no counter, no timestamp) so equivalent
+// candidate evidence always produces the same id across repeated runs.
+function buildCandidateEvidenceId(ruleId, location, fingerprint) {
+    const locationPart = [location.path, location.line !== undefined ? `l${location.line}` : undefined, location.column !== undefined ? `c${location.column}` : undefined]
+        .filter((part) => Boolean(part))
+        .join(":");
+    return [ruleId, slug(locationPart), fingerprint.slice(0, 16)].join("--");
+}
+// Never accepts a raw secret value as a plain string parameter name to
+// discourage accidental logging at call sites — `rawValue` is redacted and
+// fingerprinted here, once, and the raw value is never stored on the
+// returned object.
+export function makeCandidateEvidence(input) {
+    const fingerprint = fingerprintCandidateValue(input.rawValue);
+    const redactedPreview = redactedPreviewForCandidate(input.rawValue);
+    const id = buildCandidateEvidenceId(input.ruleId, input.location, fingerprint);
+    return {
+        id,
+        ruleId: input.ruleId,
+        category: input.category,
+        sensitiveDataCategory: input.sensitiveDataCategory,
+        confidence: input.confidence,
+        modulePath: input.modulePath,
+        location: input.location,
+        summary: input.summary,
+        redactedPreview,
+        fingerprint,
+        resolutionState: input.resolutionState,
+        staticAnalysisLimitations: input.staticAnalysisLimitations ?? [],
+        relatedManifestComponentIds: input.relatedManifestComponentIds,
+        relatedResourceReferences: input.relatedResourceReferences,
+        relatedFindingIds: input.relatedFindingIds,
+        relatedCheckIds: input.relatedCheckIds,
+    };
+}

package/dist/src/mobile/android/advancedSecurity/clipboard/analyzeClipboardSecurity.js

@@ -0,0 +1,166 @@
+import { makeAndroidFinding } from "../../audit/androidFinding.js";
+import { makeCandidateEvidence } from "../candidateEvidence.js";
+import { buildAndroidSourceLocation } from "../sourceLocation.js";
+import { classifyDirectExpression } from "../sensitiveData/classifyDirectExpression.js";
+import { classifySensitiveIdentifier, splitIdentifierWords } from "../sensitiveData/classifySensitiveIdentifier.js";
+import { executableMask } from "../sensitiveData/localSourceContext.js";
+import { splitTopLevelArguments } from "../sensitiveData/splitArguments.js";
+import { collectClipboardEvidence } from "./collectClipboardEvidence.js";
+const USER_TRIGGER_METHOD_NAMES = /^(onClick|onLongClick|onMenuItemClick|copy|copyToClipboard|handleCopy|share)$/i;
+const BACKGROUND_LIKE_CLASS_SUFFIX = /(Service|Receiver|Worker)$/;
+function literalOf(expression) {
+    if (expression === undefined)
+        return undefined;
+    const classification = classifyDirectExpression(expression);
+    return classification.kind === "string-literal" ? classification.literalValue : undefined;
+}
+function labelSensitive(labelExpression) {
+    if (labelExpression === undefined)
+        return undefined;
+    const literal = literalOf(labelExpression);
+    if (literal !== undefined) {
+        const words = splitIdentifierWords(literal);
+        for (const word of words) {
+            const result = classifySensitiveIdentifier(word);
+            if (result)
+                return result;
+        }
+        return undefined;
+    }
+    const identifier = classifyDirectExpression(labelExpression).kind === "identifier" ? labelExpression : undefined;
+    return identifier ? classifySensitiveIdentifier(identifier) : undefined;
+}
+function valueSensitive(valueExpression) {
+    if (valueExpression === undefined)
+        return undefined;
+    const classification = classifyDirectExpression(valueExpression);
+    if (classification.kind !== "identifier" && classification.kind !== "member-access")
+        return undefined;
+    const name = valueExpression.replace(/^.*\./, "");
+    return classifySensitiveIdentifier(name);
+}
+function nearestBefore(mask, offset, pattern) {
+    const window = mask.slice(Math.max(0, offset - 4000), offset);
+    let last = null;
+    let match;
+    const re = new RegExp(pattern.source, "g");
+    while ((match = re.exec(window)) !== null)
+        last = match;
+    return last?.[1];
+}
+export function analyzeClipboardSecurityFile(targetRoot, file) {
+    const candidates = [];
+    const findings = [];
+    const mask = executableMask(file.content);
+    const matches = collectClipboardEvidence(file.content);
+    const creates = matches.filter((m) => m.kind === "clip-create");
+    const markerOffsets = matches.filter((m) => m.kind === "sensitive-marker").map((m) => m.offset);
+    const clearOffsetsByScope = new Map();
+    for (const m of matches.filter((m) => m.kind === "clip-clear")) {
+        const list = clearOffsetsByScope.get(m.scopeId) ?? [];
+        list.push(m.offset);
+        clearOffsetsByScope.set(m.scopeId, list);
+    }
+    const limitations = [
+        "Bounded lexical source analysis; does not prove clipboard content was actually set or read, that another application accessed the clipboard, or that a UI callback executed.",
+    ];
+    const location = (m) => buildAndroidSourceLocation(targetRoot, file.absolutePath, { line: m.line });
+    const finding = (m, title, evidenceDetails) => findings.push(makeAndroidFinding({
+        ruleId: "android-sensitive-clipboard-write",
+        title,
+        severity: "major",
+        confidence: "high",
+        description: `${title} via ${m.api}. Static source evidence only; does not prove clipboard content was set at runtime or read by another application.`,
+        manifestPath: file.relativePath,
+        identity: `${m.api}:${m.line}`,
+        location: { line: m.line },
+        evidenceDetails,
+        recommendation: "Avoid copying credentials or recovery codes to the system clipboard; mark unavoidable sensitive clips with ClipDescription.EXTRA_IS_SENSITIVE and clear them promptly.",
+    }));
+    const candidate = (ruleId, m, summary, rawValue, confidence = "medium", resolutionState = "resolved") => candidates.push(makeCandidateEvidence({
+        ruleId,
+        category: "android-clipboard",
+        confidence,
+        modulePath: file.modulePath,
+        location: location(m),
+        summary,
+        rawValue,
+        resolutionState,
+        staticAnalysisLimitations: limitations,
+    }));
+    function resolveClip(argumentExpression, scopeId) {
+        if (argumentExpression === undefined)
+            return undefined;
+        const inline = /^ClipData\.(?:newPlainText|newHtmlText|newUri)\(([\s\S]*)\)$/.exec(argumentExpression.trim());
+        if (inline) {
+            const args = splitTopLevelArguments(inline[1]);
+            return { label: args[0], value: args[1], markerNearby: false };
+        }
+        const alias = classifyDirectExpression(argumentExpression).kind === "identifier" ? argumentExpression : undefined;
+        if (alias !== undefined) {
+            const source = creates.find((c) => c.assignedVariable === alias && c.scopeId === scopeId);
+            if (source)
+                return { label: source.labelExpression, value: source.valueExpression, markerNearby: false };
+        }
+        return undefined;
+    }
+    for (const m of matches) {
+        if (m.kind === "clip-set") {
+            const resolved = resolveClip(m.argumentExpression, m.scopeId);
+            const nearMarker = markerOffsets.some((offset) => Math.abs(offset - m.offset) < 400);
+            const clearedNearby = (clearOffsetsByScope.get(m.scopeId) ?? []).some((offset) => offset > m.offset);
+            const methodName = nearestBefore(mask, m.offset, /(?:fun|void)\s+([A-Za-z_]\w*)\s*\(/);
+            const userTriggered = methodName !== undefined && USER_TRIGGER_METHOD_NAMES.test(methodName);
+            if (!resolved) {
+                candidate("android-sensitive-clipboard-write", m, "Dynamic ClipData object set on the clipboard; contents not resolved", m.argumentExpression, "low", "unresolved");
+                continue;
+            }
+            const sensitive = labelSensitive(resolved.label) ?? valueSensitive(resolved.value);
+            if (!sensitive)
+                continue;
+            const valueClassification = resolved.value !== undefined ? classifyDirectExpression(resolved.value) : undefined;
+            if (valueClassification?.kind === "string-literal" || valueClassification?.kind === "identifier" || valueClassification?.kind === "member-access") {
+                const title = nearMarker
+                    ? `Sensitive clipboard write with an EXTRA_IS_SENSITIVE marker present nearby (${sensitive.sensitiveDataCategory})`
+                    : `Direct ${sensitive.sensitiveDataCategory} copied to the system clipboard`;
+                if (nearMarker || userTriggered) {
+                    candidate("android-sensitive-clipboard-write", m, title, resolved.value, "medium");
+                }
+                else {
+                    finding(m, title, [`label=${resolved.label ?? "(none)"}`, `marker=${nearMarker}`, `cleared=${clearedNearby}`]);
+                }
+            }
+            else {
+                candidate("android-sensitive-clipboard-write", m, `Sensitive-looking clipboard label with a dynamic payload (${sensitive.sensitiveDataCategory})`, resolved.value, "medium", "unresolved");
+            }
+            continue;
+        }
+        if (m.kind === "legacy-set-text") {
+            const sensitive = valueSensitive(m.valueExpression);
+            if (!sensitive)
+                continue;
+            const classification = m.valueExpression !== undefined ? classifyDirectExpression(m.valueExpression) : undefined;
+            if (classification?.kind === "string-literal" || classification?.kind === "identifier") {
+                finding(m, `Direct ${sensitive.sensitiveDataCategory} copied via legacy ClipboardManager.setText`, [`value=${m.valueExpression}`]);
+            }
+            else {
+                candidate("android-sensitive-clipboard-write", m, "Sensitive-looking legacy clipboard write with a dynamic value", m.valueExpression, "medium", "unresolved");
+            }
+            continue;
+        }
+        if (m.kind === "clip-get") {
+            const className = nearestBefore(mask, m.offset, /class\s+([A-Za-z_]\w*)/);
+            const methodName = nearestBefore(mask, m.offset, /(?:fun|void)\s+([A-Za-z_]\w*)\s*\(/);
+            const backgroundLike = className !== undefined && BACKGROUND_LIKE_CLASS_SUFFIX.test(className);
+            const userTriggered = methodName !== undefined && USER_TRIGGER_METHOD_NAMES.test(methodName);
+            if (backgroundLike) {
+                candidate("android-sensitive-clipboard-read-review", m, `Clipboard read from a background-like class (${className})`, undefined, "medium", "unresolved");
+            }
+            else if (!userTriggered) {
+                candidate("android-sensitive-clipboard-read-review", m, "Clipboard read outside a recognized user-triggered paste flow", undefined, "low", "unresolved");
+            }
+            continue;
+        }
+    }
+    return { candidates, findings };
+}

package/dist/src/mobile/android/advancedSecurity/clipboard/checkResult.js

@@ -0,0 +1,74 @@
+import { sortCandidateEvidence } from "../ordering.js";
+import { discoverSecretSourceFiles } from "../secretCandidates/discoverSecretSourceFiles.js";
+import { analyzeClipboardSecurityFile } from "./analyzeClipboardSecurity.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — standalone Android clipboard-security check result.
+// Follows the exact Batch 4/5 standalone pattern: not called from
+// validateAndroidTarget / any active orchestration, not rendered in reports,
+// no CLI effect. Batch 8 integrates.
+// ---------------------------------------------------------------------------
+export const ANDROID_CLIPBOARD_SECURITY_AUDIT_CHECK_ID = "android-clipboard-security-audit";
+export function auditAndroidClipboardSecurity(targetRoot, detection) {
+    if (detection.projectKind === "non-android") {
+        return {
+            id: ANDROID_CLIPBOARD_SECURITY_AUDIT_CHECK_ID,
+            category: "android-clipboard",
+            title: "Android clipboard security audit",
+            status: "unsupported",
+            requirementLevel: "optional",
+            ran: false,
+            skipped: true,
+            skipInfo: {
+                checkId: ANDROID_CLIPBOARD_SECURITY_AUDIT_CHECK_ID,
+                reason: "Target was not detected as an Android project.",
+                requirementLevel: "optional",
+                missingCapability: "android-detection",
+                verdictImpact: "does not apply to a non-Android target",
+                recommendedNextAction: "Re-run against an Android Gradle project, or verify project detection.",
+            },
+            evidence: [],
+            findings: [],
+            warnings: [],
+            errors: [],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+            candidateEvidence: [],
+        };
+    }
+    const modulePaths = detection.modules.map((m) => m.path);
+    const { files, skipped } = discoverSecretSourceFiles(targetRoot, modulePaths);
+    const sourceFiles = files.filter((file) => /\.(java|kt)$/.test(file.relativePath));
+    const findingsById = new Map();
+    const candidatesById = new Map();
+    for (const file of sourceFiles) {
+        const result = analyzeClipboardSecurityFile(targetRoot, file);
+        for (const f of result.findings)
+            findingsById.set(f.id, f);
+        for (const c of result.candidates)
+            candidatesById.set(c.id, c);
+    }
+    const findings = [...findingsById.values()].sort((a, b) => a.id.localeCompare(b.id));
+    const candidateEvidence = sortCandidateEvidence([...candidatesById.values()]);
+    const hasReportableFinding = findings.some((f) => f.severity !== "informational");
+    return {
+        id: ANDROID_CLIPBOARD_SECURITY_AUDIT_CHECK_ID,
+        category: "android-clipboard",
+        title: "Android clipboard security audit",
+        status: hasReportableFinding ? "failed" : "passed",
+        requirementLevel: "required",
+        ran: true,
+        skipped: false,
+        evidence: [`${sourceFiles.length} Java/Kotlin file(s) scanned`],
+        findings,
+        warnings: [
+            ...skipped.map((s) => `${s.relativePath}: skipped (${s.reason}${s.detail ? `: ${s.detail}` : ""})`),
+            "Static analysis only: does not prove clipboard content was set or read, or that another application accessed the clipboard.",
+        ],
+        errors: [],
+        sourcePaths: sourceFiles.map((f) => f.relativePath),
+        confidence: skipped.length > 0 ? "medium" : "high",
+        environmentRequirements: [],
+        candidateEvidence,
+    };
+}

package/dist/src/mobile/android/advancedSecurity/clipboard/collectClipboardEvidence.js

@@ -0,0 +1,82 @@
+import { executableMask, lineForOffset, methodScopes, scopeAt } from "../sensitiveData/localSourceContext.js";
+import { splitTopLevelArguments } from "../sensitiveData/splitArguments.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — bounded direct evidence collection for clipboard APIs
+// (ClipData creation, setPrimaryClip/getPrimaryClip/clearPrimaryClip, legacy
+// android.text.ClipboardManager, and the EXTRA_IS_SENSITIVE marker). Purely
+// lexical over comment/string-masked text, argument text re-sliced from
+// original content via regex match indices — see
+// sensitiveStorage/collectStorageEvidence.ts for the same pattern.
+// ---------------------------------------------------------------------------
+// Greedy (not lazy) argument capture: setPrimaryClip's single argument is
+// frequently itself a nested ClipData.newPlainText(...) call, and a lazy
+// quantifier would stop at that inner call's closing paren instead of the
+// outer call's. Still bounded to one statement by excluding newlines/`;`.
+const CLIP_CREATE = /(?:(?:val|var|ClipData)\s+([A-Za-z_]\w*)\s*=\s*)?ClipData\.(newPlainText|newHtmlText|newUri)\s*\(([^;\n]*)\)/gd;
+const CLIP_SET = /([A-Za-z_][\w.]*)\.setPrimaryClip\s*\(([^;\n]*)\)/gd;
+const LEGACY_SET_TEXT = /([A-Za-z_][\w.]*[Cc]lipboard[A-Za-z_]*)\.setText\s*\(([^;\n]*)\)/gd;
+const CLIP_GET_CALL = /([A-Za-z_][\w.]*)\.(getPrimaryClip|hasPrimaryClip|getItemAt|coerceToText)\s*\(([^;\n]*?)\)/gd;
+const CLIP_GET_PROPERTY = /([A-Za-z_][\w.]*[Cc]lipboard[A-Za-z_]*)\.(primaryClip|hasText)\b(?!\s*\()/gd;
+const LEGACY_GET_TEXT = /([A-Za-z_][\w.]*[Cc]lipboard[A-Za-z_]*)\.getText\s*\(\s*\)/gd;
+const CLIP_CLEAR = /([A-Za-z_][\w.]*)\.clearPrimaryClip\s*\(\s*\)/gd;
+const SENSITIVE_MARKER = /\bClipDescription\.EXTRA_IS_SENSITIVE\b/g;
+function realGroup(content, match, group) {
+    const span = match.indices?.[group];
+    if (!span)
+        return match[group];
+    return content.slice(span[0], span[1]);
+}
+function push(list, content, scopes, kind, api, offset, extra) {
+    list.push({ kind, api, offset, line: lineForOffset(content, offset), scopeId: scopeAt(scopes, offset)?.id, ...extra });
+}
+export function collectClipboardEvidence(content) {
+    const mask = executableMask(content);
+    const scopes = methodScopes(mask);
+    const matches = [];
+    for (const match of mask.matchAll(CLIP_CREATE)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 3) ?? "");
+        push(matches, content, scopes, "clip-create", `ClipData.${match[2]}`, offset, {
+            assignedVariable: match[1],
+            labelExpression: args[0],
+            valueExpression: args[1],
+        });
+    }
+    for (const match of mask.matchAll(CLIP_SET)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 2) ?? "");
+        push(matches, content, scopes, "clip-set", "ClipboardManager.setPrimaryClip", offset, {
+            receiver: match[1],
+            argumentExpression: args[0],
+        });
+    }
+    for (const match of mask.matchAll(LEGACY_SET_TEXT)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 2) ?? "");
+        push(matches, content, scopes, "legacy-set-text", "ClipboardManager.setText", offset, {
+            receiver: match[1],
+            valueExpression: args[0],
+        });
+    }
+    for (const match of mask.matchAll(CLIP_GET_CALL)) {
+        const offset = match.index ?? 0;
+        push(matches, content, scopes, "clip-get", `ClipboardManager.${match[2]}`, offset, { receiver: match[1] });
+    }
+    for (const match of mask.matchAll(CLIP_GET_PROPERTY)) {
+        const offset = match.index ?? 0;
+        push(matches, content, scopes, "clip-get", `ClipboardManager.${match[2]}`, offset, { receiver: match[1] });
+    }
+    for (const match of mask.matchAll(LEGACY_GET_TEXT)) {
+        const offset = match.index ?? 0;
+        push(matches, content, scopes, "clip-get", "ClipboardManager.getText", offset, { receiver: match[1] });
+    }
+    for (const match of mask.matchAll(CLIP_CLEAR)) {
+        const offset = match.index ?? 0;
+        push(matches, content, scopes, "clip-clear", "ClipboardManager.clearPrimaryClip", offset, { receiver: match[1] });
+    }
+    for (const match of mask.matchAll(SENSITIVE_MARKER)) {
+        const offset = match.index ?? 0;
+        push(matches, content, scopes, "sensitive-marker", "ClipDescription.EXTRA_IS_SENSITIVE", offset, {});
+    }
+    return matches.sort((a, b) => a.offset - b.offset);
+}

package/dist/src/mobile/android/advancedSecurity/clipboard/index.js

@@ -0,0 +1 @@
+export { auditAndroidClipboardSecurity, ANDROID_CLIPBOARD_SECURITY_AUDIT_CHECK_ID } from "./checkResult.js";

package/dist/src/mobile/android/advancedSecurity/clipboard/types.js

@@ -0,0 +1 @@
+export {};