@dailephd/my-dev-kit-lab 0.4.0 → 0.4.2

package/dist/src/mobile/android/advancedSecurity/signingConfiguration/checkResult.js

@@ -0,0 +1,119 @@
+import fs from "node:fs";
+import path from "node:path";
+import { buildAndroidSourceLocation } from "../sourceLocation.js";
+import { makeCandidateEvidence } from "../candidateEvidence.js";
+import { sortCandidateEvidence } from "../ordering.js";
+import { discoverKeystoreCandidates } from "./discoverKeystoreCandidates.js";
+import { analyzeModuleSigningConfiguration } from "./analyzeSigningConfiguration.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 4 — standalone Android signing-configuration check result.
+//
+// Operates over Gradle module metadata rather than parsed manifests, so it
+// cannot reuse buildAndroidManifestCheckResult. Standalone: not called from
+// validateAndroidTarget / any active orchestration, not rendered in reports,
+// no CLI effect. Batch 8 integrates.
+// ---------------------------------------------------------------------------
+export const ANDROID_SIGNING_CONFIGURATION_AUDIT_CHECK_ID = "android-signing-configuration-audit";
+export function auditAndroidSigningConfiguration(targetRoot, detection, gradleModules) {
+    if (detection.projectKind === "non-android") {
+        return {
+            id: ANDROID_SIGNING_CONFIGURATION_AUDIT_CHECK_ID,
+            category: "android-signing-configuration",
+            title: "Android signing configuration audit",
+            status: "unsupported",
+            requirementLevel: "optional",
+            ran: false,
+            skipped: true,
+            skipInfo: {
+                checkId: ANDROID_SIGNING_CONFIGURATION_AUDIT_CHECK_ID,
+                reason: "Target was not detected as an Android project.",
+                requirementLevel: "optional",
+                missingCapability: "android-detection",
+                verdictImpact: "does not apply to a non-Android target",
+                recommendedNextAction: "Re-run against an Android Gradle project, or verify project detection.",
+            },
+            evidence: [],
+            findings: [],
+            warnings: [],
+            errors: [],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+            candidateEvidence: [],
+        };
+    }
+    const modulePaths = gradleModules.map((m) => m.path);
+    const keystoreCandidates = discoverKeystoreCandidates(targetRoot, modulePaths);
+    const findingsById = new Map();
+    const candidatesById = new Map();
+    const evidence = [];
+    const warnings = [];
+    const sourcePaths = [];
+    const correlatedKeystorePaths = new Set();
+    for (const module of gradleModules) {
+        if (module.buildFilePath === undefined) {
+            warnings.push(`${module.path}: no build file path known; signing configuration was not analyzed for this module`);
+            continue;
+        }
+        const absolutePath = path.join(targetRoot, module.buildFilePath);
+        let text;
+        try {
+            text = fs.readFileSync(absolutePath, "utf8");
+        }
+        catch {
+            warnings.push(`${module.buildFilePath}: could not be read; signing configuration was not analyzed for this module`);
+            continue;
+        }
+        sourcePaths.push(module.buildFilePath);
+        const result = analyzeModuleSigningConfiguration(targetRoot, module, text, keystoreCandidates);
+        for (const finding of result.findings) {
+            findingsById.set(finding.id, finding);
+            if (finding.affectedFiles)
+                for (const p of finding.affectedFiles)
+                    correlatedKeystorePaths.add(p);
+        }
+        for (const candidate of result.candidates)
+            candidatesById.set(candidate.id, candidate);
+        evidence.push(`${module.path}: ${result.evidenceText.length} evidence note(s), ${result.findings.length} finding(s)`, ...result.evidenceText);
+    }
+    // Baseline review evidence for every committed keystore not already
+    // covered by a higher-confidence correlation finding above.
+    for (const keystore of keystoreCandidates) {
+        if (correlatedKeystorePaths.has(keystore.relativePath))
+            continue;
+        const absolutePath = path.join(targetRoot, keystore.relativePath);
+        candidatesById.set(`keystore-candidate--${keystore.relativePath}`, makeCandidateEvidence({
+            ruleId: "android-signing-keystore-candidate",
+            category: "android-signing-configuration",
+            confidence: "low",
+            modulePath: keystore.modulePath,
+            location: buildAndroidSourceLocation(targetRoot, absolutePath),
+            summary: `Committed keystore-like file found: ${keystore.relativePath}`,
+            rawValue: undefined,
+            resolutionState: "resolved",
+            staticAnalysisLimitations: [
+                "File contents were not read, opened, or validated; this does not prove the file contains a production release key.",
+            ],
+        }));
+    }
+    const findings = [...findingsById.values()].sort((a, b) => a.id.localeCompare(b.id));
+    const candidateEvidence = sortCandidateEvidence([...candidatesById.values()]);
+    const hasReportableFinding = findings.some((f) => f.severity !== "informational");
+    return {
+        id: ANDROID_SIGNING_CONFIGURATION_AUDIT_CHECK_ID,
+        category: "android-signing-configuration",
+        title: "Android signing configuration audit",
+        status: hasReportableFinding ? "failed" : "passed",
+        requirementLevel: "required",
+        ran: true,
+        skipped: false,
+        evidence,
+        findings,
+        warnings: [...warnings, "Static analysis only: does not open keystores, validate credentials, evaluate Gradle, or inspect APK/AAB signing."],
+        errors: [],
+        sourcePaths,
+        confidence: warnings.length > 0 ? "medium" : "high",
+        environmentRequirements: [],
+        candidateEvidence,
+    };
+}

package/dist/src/mobile/android/advancedSecurity/signingConfiguration/discoverKeystoreCandidates.js

@@ -0,0 +1,55 @@
+import { collectFilesForGlobs } from "../../../../core/fileGlobs.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 4 — committed keystore-file candidate discovery.
+//
+// Reuses the existing target-contained glob collector (src/core/fileGlobs.ts)
+// for traversal — no second traversal engine. Discovery is by file
+// path/extension ONLY: this module never opens, reads, or inspects file
+// contents (per agents.txt Batch 4 section 9.16).
+// ---------------------------------------------------------------------------
+const KEYSTORE_EXTENSIONS = [".jks", ".keystore", ".p12", ".pfx"];
+const KEYSTORE_GLOBS = ["**/*.jks", "**/*.keystore", "**/*.p12", "**/*.pfx"];
+const EXCLUDED_PATH_SEGMENTS = [".gradle/", "build/", "out/", "reports/"];
+function isExcludedPath(relativePath) {
+    const normalized = `${relativePath.replace(/\\/g, "/")}/`;
+    return EXCLUDED_PATH_SEGMENTS.some((segment) => normalized.includes(`/${segment}`) || normalized.startsWith(segment));
+}
+function inferModulePath(relativePath, knownModulePaths) {
+    const normalized = relativePath.replace(/\\/g, "/");
+    let best;
+    for (const modulePath of knownModulePaths) {
+        const prefix = `${modulePath.replace(/\\/g, "/")}/`;
+        if (normalized.startsWith(prefix) && (best === undefined || modulePath.length > best.length)) {
+            best = modulePath;
+        }
+    }
+    return best;
+}
+// Discovers target-contained files whose extension matches a conventional
+// Android/Java signing-container format. Path/metadata only — content is
+// never read, opened, or validated.
+export function discoverKeystoreCandidates(targetRoot, knownModulePaths = []) {
+    const candidateMap = new Map();
+    for (const glob of KEYSTORE_GLOBS) {
+        let matches;
+        try {
+            matches = collectFilesForGlobs(targetRoot, [glob]);
+        }
+        catch {
+            continue;
+        }
+        for (const match of matches) {
+            const normalizedRel = match.relativePath.replace(/\\/g, "/");
+            if (isExcludedPath(normalizedRel))
+                continue;
+            candidateMap.set(normalizedRel, match.absolutePath);
+        }
+    }
+    return [...candidateMap.keys()]
+        .sort((a, b) => a.localeCompare(b))
+        .map((relativePath) => ({
+        relativePath,
+        modulePath: inferModulePath(relativePath, knownModulePaths),
+        extension: KEYSTORE_EXTENSIONS.find((ext) => relativePath.toLowerCase().endsWith(ext)) ?? "",
+    }));
+}

package/dist/src/mobile/android/advancedSecurity/signingConfiguration/extractSigningConfigurations.js

@@ -0,0 +1,81 @@
+import { extractBooleanLiteral, extractLiteral, extractNamedSubBlocks, stripComments } from "../../gradle/moduleMetadataExtractor.js";
+import { fingerprintCandidateValue, redactedPreviewForCandidate } from "../redaction.js";
+function classifyExpressionState(result) {
+    if (result.value !== undefined)
+        return "literal";
+    if (result.raw === undefined)
+        return "missing";
+    const raw = result.raw;
+    if (/\bSystem\.getenv\b|\bproviders\.environmentVariable\b/.test(raw))
+        return "environment-reference";
+    if (/\bproviders\.gradleProperty\b|\bproject\.findProperty\b|\bfindProperty\(|(?<![A-Za-z0-9_.])\bproperty\(/.test(raw))
+        return "gradle-property-reference";
+    if (/\blocalProperties\b/i.test(raw))
+        return "local-property-reference";
+    if (/[A-Za-z_][A-Za-z0-9_]*\s*\(/.test(raw))
+        return "method-call";
+    if (/^[A-Za-z_][A-Za-z0-9_.]*$/.test(raw))
+        return "variable-reference";
+    return "dynamic";
+}
+// Bounded raw-expression preview for non-literal states. These are
+// expressions (e.g. `System.getenv("STORE_PASSWORD")`), not secrets
+// themselves, but still bounded/control-char-stripped for safety and
+// consistency with the rest of the codebase's evidence conventions.
+function boundedRawExpression(raw) {
+    return redactedPreviewForCandidate(raw, { maxLength: 120, edgeLength: 60 });
+}
+function extractPathValue(content, keys) {
+    const result = extractLiteral(content, keys);
+    const state = classifyExpressionState(result);
+    if (state === "literal")
+        return { state, literalValue: result.value };
+    if (result.raw !== undefined)
+        return { state, rawExpression: boundedRawExpression(result.raw) };
+    return { state: "missing" };
+}
+// storeFile is conventionally wrapped as `storeFile file("name.jks")` /
+// `storeFile = file("name.jks")` in both DSLs — the plain extractLiteral
+// literal-match never fires here (a call expression intervenes before the
+// quoted string), so the literal path is unwrapped explicitly first.
+function extractStoreFileValue(content) {
+    const fileWrapped = content.match(/\bstoreFile\s*=?\s*file\(\s*["']([^"']*)["']\s*\)/);
+    if (fileWrapped)
+        return { state: "literal", literalValue: fileWrapped[1] };
+    return extractPathValue(content, ["storeFile"]);
+}
+function extractCredentialValue(content, keys) {
+    const result = extractLiteral(content, keys);
+    const state = classifyExpressionState(result);
+    if (state === "literal" && result.value !== undefined) {
+        return { state, redactedPreview: redactedPreviewForCandidate(result.value), fingerprint: fingerprintCandidateValue(result.value) };
+    }
+    if (result.raw !== undefined)
+        return { state, rawExpression: boundedRawExpression(result.raw) };
+    return { state: "missing" };
+}
+function extractSigningConfigEntry(name, content) {
+    const v1 = extractBooleanLiteral(content, ["enableV1Signing", "v1SigningEnabled"]);
+    const v2 = extractBooleanLiteral(content, ["enableV2Signing", "v2SigningEnabled"]);
+    const v3 = extractBooleanLiteral(content, ["enableV3Signing", "v3SigningEnabled"]);
+    const v4 = extractBooleanLiteral(content, ["enableV4Signing", "v4SigningEnabled"]);
+    return {
+        name,
+        storeFile: extractStoreFileValue(content),
+        storePassword: extractCredentialValue(content, ["storePassword"]),
+        keyAlias: extractPathValue(content, ["keyAlias"]),
+        keyPassword: extractCredentialValue(content, ["keyPassword"]),
+        enableV1Signing: v1.value,
+        enableV2Signing: v2.value,
+        enableV3Signing: v3.value,
+        enableV4Signing: v4.value,
+    };
+}
+// Extracts every named entry inside a module build file's `signingConfigs { }`
+// block. Returns an empty array (never throws) when no such block exists.
+export function extractSigningConfigurations(rawBuildFileText) {
+    const text = stripComments(rawBuildFileText);
+    return extractNamedSubBlocks(text, "signingConfigs")
+        .map(({ name, content }) => extractSigningConfigEntry(name, content))
+        .sort((a, b) => a.name.localeCompare(b.name));
+}

package/dist/src/mobile/android/advancedSecurity/signingConfiguration/index.js

@@ -0,0 +1,8 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 4 — public exports for the standalone Android signing-
+// configuration audit.
+// ---------------------------------------------------------------------------
+export { extractSigningConfigurations } from "./extractSigningConfigurations.js";
+export { discoverKeystoreCandidates } from "./discoverKeystoreCandidates.js";
+export { analyzeModuleSigningConfiguration } from "./analyzeSigningConfiguration.js";
+export { auditAndroidSigningConfiguration, ANDROID_SIGNING_CONFIGURATION_AUDIT_CHECK_ID } from "./checkResult.js";

package/dist/src/mobile/android/advancedSecurity/signingConfiguration/types.js

@@ -0,0 +1,20 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 4 — signing-configuration model.
+//
+// Deliberately a NEW, separate type — not an additive field on the shared,
+// already-actively-rendered AndroidGradleModuleInfo/AndroidGradleMetadata
+// (src/mobile/android/gradle/types.ts). That type flows into the real,
+// currently-rendered v0.4.0 Android JSON/text report via the active
+// android-gradle-metadata check; adding a raw or even redacted-preview
+// credential field to it would put secret-shaped data on a path that already
+// renders today, before this batch's own non-disclosure guarantees can be
+// verified end-to-end by Batch 8. Keeping this type local to the standalone,
+// unregistered signingConfiguration feature means it can only ever reach a
+// report once Batch 8 deliberately wires it in.
+//
+// storeFile/keyAlias are not secrets (a path and an alias name), so their
+// literal value is retained directly. storePassword/keyPassword literal
+// values are NEVER retained here — only a redacted preview and fingerprint
+// (Batch 1 owners), computed immediately at extraction time.
+// ---------------------------------------------------------------------------
+export {};

package/dist/src/mobile/android/advancedSecurity/sourceLocation.js

@@ -0,0 +1,15 @@
+import { relativeWithinRoot } from "../../../core/pathSafety.js";
+// `absolutePath` must already be an absolute, filesystem-resolved path (the
+// same convention relativeWithinRoot's existing callers use, e.g. the
+// manifest reader) — a relative path here would be resolved against the
+// process cwd, not root, and silently produce the wrong location.
+export function buildAndroidSourceLocation(root, absolutePath, position) {
+    const relativePath = relativeWithinRoot(root, absolutePath);
+    return {
+        path: relativePath,
+        line: position?.line,
+        column: position?.column,
+        startLine: position?.startLine,
+        endLine: position?.endLine,
+    };
+}

package/dist/src/mobile/android/advancedSecurity/webview/checkResult.js

@@ -0,0 +1,210 @@
+import { makeAndroidFinding } from "../../audit/androidFinding.js";
+import { makeCandidateEvidence } from "../candidateEvidence.js";
+import { sortCandidateEvidence } from "../ordering.js";
+import { buildAndroidSourceLocation } from "../sourceLocation.js";
+import { discoverSecretSourceFiles } from "../secretCandidates/discoverSecretSourceFiles.js";
+export const ANDROID_WEBVIEW_SECURITY_AUDIT_CHECK_ID = "android-webview-security-audit";
+const CALL = /(?:([A-Za-z_][\w.]*(?:\.getSettings\(\))?)\.)?(setJavaScriptEnabled|addJavascriptInterface|setAllowFileAccess|setAllowContentAccess|setAllowFileAccessFromFileURLs|setAllowUniversalAccessFromFileURLs|setMixedContentMode|setWebContentsDebuggingEnabled|loadUrl|postUrl|loadData|loadDataWithBaseURL|proceed|cancel)\s*\(([^\n)]*)\)/g;
+const PROPERTY = /([A-Za-z_][\w.]*)\.(javaScriptEnabled|allowFileAccess|allowContentAccess|allowFileAccessFromFileURLs|allowUniversalAccessFromFileURLs|mixedContentMode)\s*=\s*([^;\n}]+)/g;
+const SETTINGS_ALIAS = /(?:\bWebSettings\s+|\b(?:val|var)\s+)([A-Za-z_]\w*)\s*=\s*([A-Za-z_][\w.]*)\s*(?:\.getSettings\(\)|\.settings)/g;
+const MAX_ARGUMENT = 240;
+function lineAt(text, offset) { return text.slice(0, offset).split("\n").length; }
+// Masks comments and string *contents* while preserving offsets/newlines.
+// Calls are matched only in code; the original text is then used for the
+// bounded argument summary. This intentionally local scanner is not a Java
+// or Kotlin parser and never attempts type/provenance resolution.
+function executableMask(source) {
+    let out = "";
+    let i = 0;
+    let state = "code";
+    let quote = "";
+    while (i < source.length) {
+        const ch = source[i], next = source[i + 1];
+        if (state === "code" && ch === "/" && next === "/") {
+            out += "  ";
+            i += 2;
+            state = "line";
+            continue;
+        }
+        if (state === "code" && ch === "/" && next === "*") {
+            out += "  ";
+            i += 2;
+            state = "block";
+            continue;
+        }
+        if (state === "code" && source.slice(i, i + 3) === '\"\"\"') {
+            out += '\"\"\"';
+            i += 3;
+            state = "raw";
+            continue;
+        }
+        if (state === "code" && (ch === '"' || ch === "'")) {
+            quote = ch;
+            out += ch;
+            i++;
+            state = "quote";
+            continue;
+        }
+        if (state === "line") {
+            out += ch === "\n" ? "\n" : " ";
+            if (ch === "\n")
+                state = "code";
+            i++;
+            continue;
+        }
+        if (state === "block") {
+            out += ch === "\n" ? "\n" : " ";
+            if (ch === "*" && next === "/") {
+                out = out.slice(0, -1) + "  ";
+                i += 2;
+                state = "code";
+            }
+            else
+                i++;
+            continue;
+        }
+        if (state === "raw") {
+            if (source.slice(i, i + 3) === '\"\"\"') {
+                out += '\"\"\"';
+                i += 3;
+                state = "code";
+            }
+            else {
+                out += ch === "\n" ? "\n" : " ";
+                i++;
+            }
+            continue;
+        }
+        if (state === "quote") {
+            if (ch === "\\") {
+                out += "  ";
+                i += 2;
+                continue;
+            }
+            out += ch === "\n" ? "\n" : (ch === quote ? ch : " ");
+            if (ch === quote)
+                state = "code";
+            i++;
+            continue;
+        }
+        out += ch;
+        i++;
+    }
+    return out;
+}
+function braceEnd(mask, open) { let depth = 0; for (let i = open; i < mask.length; i++) {
+    if (mask[i] === "{")
+        depth++;
+    else if (mask[i] === "}" && --depth === 0)
+        return i;
+} return mask.length; }
+function scopeRanges(mask) { const ranges = []; const header = /(?:\bfun\s+([A-Za-z_]\w*)\s*\([^)]*\)|\b(?:public|private|protected|override|static|final|suspend|void|[A-Z][\w<>?\[\]]*)[\s\w<>?\[\]]*?\s+([A-Za-z_]\w*)\s*\([^)]*\))\s*\{/g; for (const match of mask.matchAll(header)) {
+    const from = (match.index ?? 0);
+    const open = from + match[0].length - 1;
+    ranges.push({ from, to: braceEnd(mask, open), id: `${match[1] ?? match[2] ?? "scope"}@${from}` });
+} return ranges; }
+function sslRanges(mask) { const ranges = []; for (const match of mask.matchAll(/onReceivedSslError\s*\([^)]*\)\s*\{/g)) {
+    const start = (match.index ?? 0) + match[0].length - 1;
+    ranges.push([start, braceEnd(mask, start)]);
+} return ranges; }
+function literal(argument) {
+    const trimmed = argument.trim();
+    return trimmed === "true" ? "true" : trimmed === "false" ? "false" : undefined;
+}
+function finding(ruleId, title, file, line, identity, severity) {
+    return makeAndroidFinding({ ruleId, title, severity, confidence: "high", description: `${title}. This is static source evidence only and does not prove runtime execution or exploitability.`, manifestPath: file, identity, location: { line }, recommendation: "Review the configuration and keep WebView capabilities limited to documented requirements." });
+}
+function candidate(ruleId, targetRoot, file, line, summary, rawValue) {
+    return makeCandidateEvidence({ ruleId, category: "android-webview", confidence: "medium", modulePath: file.modulePath, location: buildAndroidSourceLocation(targetRoot, file.absolutePath, { line }), summary, rawValue: rawValue.slice(0, MAX_ARGUMENT), resolutionState: "resolved", staticAnalysisLimitations: ["Bounded lexical source analysis; receiver types, call ordering, and dynamic values are not resolved."] });
+}
+export function auditAndroidWebViewSecurity(targetRoot, detection) {
+    if (detection.projectKind === "non-android")
+        return { id: ANDROID_WEBVIEW_SECURITY_AUDIT_CHECK_ID, category: "android-webview", title: "Android WebView security audit", status: "unsupported", requirementLevel: "optional", ran: false, skipped: true, skipInfo: { checkId: ANDROID_WEBVIEW_SECURITY_AUDIT_CHECK_ID, reason: "Target was not detected as Android.", requirementLevel: "optional", verdictImpact: "does not apply", recommendedNextAction: "Run against an Android project." }, evidence: [], findings: [], warnings: [], errors: [], sourcePaths: [], confidence: "unknown", environmentRequirements: [], candidateEvidence: [] };
+    const discovered = discoverSecretSourceFiles(targetRoot, detection.modules.map((m) => m.path));
+    const files = discovered.files.filter((file) => /\.(java|kt)$/.test(file.relativePath));
+    const findings = [];
+    const candidates = [];
+    for (const file of files) {
+        const mask = executableMask(file.content);
+        const ssl = sslRanges(mask);
+        const scopes = scopeRanges(mask);
+        const calls = [];
+        const contextAt = (offset) => scopes.filter((scope) => offset >= scope.from && offset <= scope.to).sort((a, b) => a.to - a.from - (b.to - b.from))[0]?.id ?? "(unresolved-scope)";
+        const aliases = new Map();
+        for (const match of mask.matchAll(SETTINGS_ALIAS))
+            aliases.set(`${contextAt(match.index ?? 0)}:${match[1]}`, match[2]);
+        const normalize = (receiver, method, context) => { const stripped = receiver.replace(/\.getSettings\(\)$|\.settings$/, ""); if (stripped !== receiver)
+            return stripped; if (method.startsWith("set") && aliases.has(`${context}:${receiver}`))
+            return aliases.get(`${context}:${receiver}`); return receiver; };
+        CALL.lastIndex = 0;
+        for (let match; (match = CALL.exec(mask));) {
+            const start = match.index;
+            const original = file.content.slice(start, start + match[0].length);
+            const argument = original.slice(original.indexOf("(") + 1, -1).slice(0, MAX_ARGUMENT);
+            const line = lineAt(file.content, start);
+            const context = contextAt(start);
+            calls.push({ receiver: normalize(match[1] ?? "(unresolved)", match[2], context), method: match[2], argument, line, context, inSslCallback: ssl.some(([from, to]) => start > from && start < to) });
+        }
+        PROPERTY.lastIndex = 0;
+        for (let match; (match = PROPERTY.exec(mask));) {
+            const start = match.index;
+            const original = file.content.slice(start, start + match[0].length);
+            const eq = original.indexOf("=");
+            const propertyToMethod = { javaScriptEnabled: "setJavaScriptEnabled", allowFileAccess: "setAllowFileAccess", allowContentAccess: "setAllowContentAccess", allowFileAccessFromFileURLs: "setAllowFileAccessFromFileURLs", allowUniversalAccessFromFileURLs: "setAllowUniversalAccessFromFileURLs", mixedContentMode: "setMixedContentMode" };
+            const method = propertyToMethod[match[2]], context = contextAt(start);
+            calls.push({ receiver: normalize(match[1], method, context), method, argument: original.slice(eq + 1).trim().slice(0, MAX_ARGUMENT), line: lineAt(file.content, start), context, inSslCallback: ssl.some(([from, to]) => start > from && start < to) });
+        }
+        for (const call of calls) {
+            const value = literal(call.argument);
+            if (call.method === "setAllowUniversalAccessFromFileURLs" && value === "true")
+                findings.push(finding("android-webview-universal-file-url-access", "WebView universal file URL access is explicitly enabled", file.relativePath, call.line, call.context, "major"));
+            else if (call.method === "setMixedContentMode" && /MIXED_CONTENT_ALWAYS_ALLOW|0\b/.test(call.argument))
+                findings.push(finding("android-webview-mixed-content", "WebView mixed content is explicitly always allowed", file.relativePath, call.line, call.context, "major"));
+            else if (call.method === "setWebContentsDebuggingEnabled" && value === "true" && /(?:^|\.)WebView$/.test(call.receiver))
+                findings.push(finding("android-webview-debugging-enabled", "WebView debugging is explicitly enabled", file.relativePath, call.line, call.context, "minor"));
+            else if (call.method === "proceed" && call.inSslCallback)
+                findings.push(finding("android-webview-ssl-error-proceed", "SSL error callback proceeds despite the certificate error", file.relativePath, call.line, call.context, "major"));
+            else if (call.method === "setJavaScriptEnabled" && value !== "false")
+                candidates.push(candidate("android-webview-javascript-enabled", targetRoot, file, call.line, value === "true" ? "JavaScript is explicitly enabled" : "JavaScript enablement is dynamic or unresolved", call.argument));
+            else if (["setAllowFileAccess", "setAllowContentAccess", "setAllowFileAccessFromFileURLs", "setAllowUniversalAccessFromFileURLs"].includes(call.method) && value !== "false")
+                candidates.push(candidate(call.method === "setAllowUniversalAccessFromFileURLs" ? "android-webview-universal-file-url-access" : "android-webview-file-content-access", targetRoot, file, call.line, `WebView ${call.method} is ${value === "true" ? "enabled" : "dynamic or unresolved"}`, call.argument));
+            else if (call.method === "addJavascriptInterface")
+                candidates.push(candidate("android-webview-javascript-interface-exposure", targetRoot, file, call.line, "JavaScript interface registration source evidence", call.argument));
+            else if (call.method === "setMixedContentMode" && /MIXED_CONTENT_COMPATIBILITY_MODE|1\b/.test(call.argument))
+                candidates.push(candidate("android-webview-mixed-content", targetRoot, file, call.line, "WebView mixed-content compatibility mode is configured", call.argument));
+            else if (call.method === "setMixedContentMode" && !/MIXED_CONTENT_NEVER_ALLOW|2\b/.test(call.argument))
+                candidates.push(candidate("android-webview-mixed-content", targetRoot, file, call.line, "WebView mixed-content mode is dynamic or unresolved", call.argument));
+            else if (call.method === "setWebContentsDebuggingEnabled" && value !== "false")
+                candidates.push(candidate("android-webview-debugging-enabled", targetRoot, file, call.line, "WebView debugging state is dynamic or receiver context is unresolved", call.argument));
+            else if (["loadUrl", "postUrl", "loadData", "loadDataWithBaseURL"].includes(call.method)) {
+                if (/^\s*["']javascript:/i.test(call.argument))
+                    candidates.push(candidate("android-webview-suspicious-url-loading", targetRoot, file, call.line, "javascript: WebView URL loading evidence", call.argument));
+                else if (/^\s*["'](?:http|file|content):/i.test(call.argument))
+                    candidates.push(candidate("android-webview-suspicious-url-loading", targetRoot, file, call.line, "WebView loads a review-oriented literal scheme", call.argument));
+                else if (!/^\s*["']https:/i.test(call.argument))
+                    candidates.push(candidate("android-webview-suspicious-url-loading", targetRoot, file, call.line, "Dynamic or unsupported WebView content loading argument", call.argument));
+            }
+        }
+        for (const [from, to] of ssl) {
+            const contained = calls.filter((call) => call.inSslCallback && call.method === "proceed" || call.inSslCallback && call.method === "cancel");
+            if (contained.length === 0)
+                candidates.push(candidate("android-webview-ssl-error-proceed", targetRoot, file, lineAt(file.content, from), mask.slice(from, Math.min(to, from + MAX_ARGUMENT)).trim() ? "SSL error callback delegates or has unresolved local behavior" : "SSL error callback is empty", file.content.slice(from, Math.min(to, from + MAX_ARGUMENT))));
+        }
+        const same = (a, b) => a.receiver !== "(unresolved)" && a.receiver === b.receiver && a.context === b.context;
+        for (const js of calls.filter((c) => c.method === "setJavaScriptEnabled" && literal(c.argument) === "true"))
+            for (const bridge of calls.filter((c) => c.method === "addJavascriptInterface" && same(c, js)))
+                findings.push(finding("android-webview-javascript-interface-exposure", "JavaScript and addJavascriptInterface occur on the same receiver in one method", file.relativePath, bridge.line, `${js.receiver}:${js.context}`, "major"));
+        for (const js of calls.filter((c) => c.method === "setJavaScriptEnabled" && literal(c.argument) === "true"))
+            for (const access of calls.filter((c) => ["setAllowFileAccessFromFileURLs", "setAllowUniversalAccessFromFileURLs"].includes(c.method) && literal(c.argument) === "true" && same(c, js)))
+                findings.push(finding("android-webview-file-content-access", "JavaScript and file URL access occur on the same receiver in one method", file.relativePath, access.line, `${js.receiver}:${js.context}`, "major"));
+        for (const js of calls.filter((c) => c.method === "setJavaScriptEnabled" && literal(c.argument) === "true"))
+            for (const url of calls.filter((c) => c.method === "loadUrl" && /^\s*["']javascript:/i.test(c.argument) && same(c, js)))
+                findings.push(finding("android-webview-suspicious-url-loading", "JavaScript is enabled and a javascript: URL is loaded on the same receiver", file.relativePath, url.line, `${js.receiver}:${js.context}`, "major"));
+        for (const mixed of calls.filter((c) => c.method === "setMixedContentMode" && /MIXED_CONTENT_ALWAYS_ALLOW|0\b/.test(c.argument)))
+            for (const url of calls.filter((c) => c.method === "loadUrl" && /^\s*["']http:\/\//i.test(c.argument) && same(c, mixed)))
+                findings.push(finding("android-webview-mixed-content", "Always-allowed mixed content and HTTP loading occur on the same receiver", file.relativePath, url.line, `${mixed.receiver}:${mixed.context}`, "major"));
+    }
+    const uniqueFindings = [...new Map(findings.map((item) => [item.id, item])).values()].sort((a, b) => a.id.localeCompare(b.id));
+    const uniqueCandidates = [...new Map(candidates.map((item) => [item.id, item])).values()];
+    return { id: ANDROID_WEBVIEW_SECURITY_AUDIT_CHECK_ID, category: "android-webview", title: "Android WebView security audit", status: uniqueFindings.length ? "failed" : "passed", requirementLevel: "required", ran: true, skipped: false, evidence: [`${files.length} Java/Kotlin file(s) scanned`], findings: uniqueFindings, warnings: [...discovered.skipped.map((item) => `${item.relativePath}: skipped (${item.reason})`), "Static analysis only: no compiler, runtime, URL provenance, or whole-program analysis was used."], errors: [], sourcePaths: files.map((file) => file.relativePath), confidence: discovered.skipped.length ? "medium" : "high", environmentRequirements: [], candidateEvidence: sortCandidateEvidence(uniqueCandidates) };
+}

package/dist/src/mobile/android/advancedSecurity/webview/index.js

@@ -0,0 +1 @@
+export { auditAndroidWebViewSecurity, ANDROID_WEBVIEW_SECURITY_AUDIT_CHECK_ID } from "./checkResult.js";