@dailephd/my-dev-kit-lab 0.4.0 → 0.4.2

package/dist/src/mobile/android/advancedSecurity/externalTools/semgrep/parseSemgrepJson.js

@@ -0,0 +1,141 @@
+import path from "node:path";
+import { makeAndroidFinding } from "../../../audit/androidFinding.js";
+import { makeCandidateEvidence } from "../../candidateEvidence.js";
+import { buildAndroidSourceLocation } from "../../sourceLocation.js";
+import { safeJsonParse, DEFAULT_MAX_MESSAGE_LENGTH } from "../boundedOutput.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 7 — bounded Semgrep JSON normalization.
+//
+// Only the one Batch 1 Semgrep rule id (android-optional-tool-semgrep-
+// evidence) is used internally; the external Semgrep rule id is preserved
+// separately as `externalRuleId`. Full source snippets (extra.lines) and
+// complete metavariable values are never retained.
+// ---------------------------------------------------------------------------
+const MAX_RESULTS = 5_000;
+const MAX_SKIPPED_PATHS = 200;
+function severityToProjectSeverity(severity) {
+    switch (severity) {
+        case "ERROR":
+            return "major";
+        case "WARNING":
+            return "minor";
+        default:
+            return "informational";
+    }
+}
+function boundedMessage(message) {
+    const text = typeof message === "string" ? message : "";
+    return text.length > DEFAULT_MAX_MESSAGE_LENGTH ? `${text.slice(0, DEFAULT_MAX_MESSAGE_LENGTH)}...` : text;
+}
+export function parseSemgrepJson(rawStdout, targetRoot, configFingerprint) {
+    const parsed = safeJsonParse(rawStdout);
+    if (!parsed.ok) {
+        return { malformed: true, findings: [], candidates: [], scannedCount: 0, skippedPaths: [], parserErrors: [], truncated: parsed.truncated };
+    }
+    const doc = parsed.value;
+    const toolVersion = typeof doc.version === "string" ? doc.version : undefined;
+    const results = Array.isArray(doc.results) ? doc.results : [];
+    const errors = Array.isArray(doc.errors) ? doc.errors : [];
+    const pathsSection = doc.paths;
+    const scanned = Array.isArray(pathsSection?.scanned) ? pathsSection.scanned : [];
+    const skipped = Array.isArray(pathsSection?.skipped) ? pathsSection.skipped : [];
+    const findings = [];
+    const candidates = [];
+    let truncated = false;
+    for (const rawResult of results.slice(0, MAX_RESULTS)) {
+        if (results.length > MAX_RESULTS)
+            truncated = true;
+        const result = rawResult;
+        const checkId = typeof result.check_id === "string" ? result.check_id : "(unknown-rule)";
+        const relativePath = typeof result.path === "string" ? result.path : undefined;
+        const start = result.start;
+        const line = typeof start?.line === "number" ? start.line : undefined;
+        const extra = result.extra ?? {};
+        const severity = typeof extra.severity === "string" ? extra.severity : undefined;
+        const message = boundedMessage(extra.message);
+        const projectSeverity = severityToProjectSeverity(severity);
+        if (!relativePath) {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-optional-tool-semgrep-evidence",
+                category: "android-semgrep",
+                confidence: "low",
+                location: { path: "(unknown)" },
+                summary: `Semgrep result "${checkId}" had no reportable path`,
+                rawValue: undefined,
+                resolutionState: "unresolved",
+                staticAnalysisLimitations: ["Semgrep static analysis only; does not prove runtime exploitability."],
+            }));
+            continue;
+        }
+        const absolutePath = path.resolve(targetRoot, relativePath);
+        let location;
+        try {
+            location = buildAndroidSourceLocation(targetRoot, absolutePath, { line });
+        }
+        catch {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-optional-tool-semgrep-evidence",
+                category: "android-semgrep",
+                confidence: "low",
+                location: { path: relativePath },
+                summary: `Semgrep result "${checkId}" reported a path outside the target`,
+                rawValue: relativePath,
+                resolutionState: "unresolved",
+                staticAnalysisLimitations: ["Semgrep static analysis only; does not prove runtime exploitability."],
+            }));
+            continue;
+        }
+        if (projectSeverity === "informational" || severity === undefined) {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-optional-tool-semgrep-evidence",
+                category: "android-semgrep",
+                confidence: "medium",
+                location,
+                summary: `Semgrep ${severity ?? "unknown-severity"} result: ${checkId} — ${message}`,
+                rawValue: message,
+                resolutionState: "resolved",
+                staticAnalysisLimitations: [`External rule: ${checkId}`, "Semgrep static analysis only; does not prove runtime exploitability."],
+            }));
+            continue;
+        }
+        findings.push(makeAndroidFinding({
+            ruleId: "android-optional-tool-semgrep-evidence",
+            title: `Semgrep finding: ${checkId}`,
+            severity: projectSeverity,
+            confidence: "medium",
+            description: message || "Semgrep reported a finding for this rule.",
+            manifestPath: relativePath,
+            identity: `semgrep:${checkId}:${configFingerprint.slice(0, 16)}`,
+            location: { line },
+            evidenceDetails: [`externalRuleId=${checkId}`, `toolSeverity=${severity}`],
+            recommendation: "Review the Semgrep rule pack entry and remediate the matched pattern.",
+        }));
+    }
+    for (const rawSkip of skipped.slice(0, MAX_SKIPPED_PATHS)) {
+        const skip = rawSkip;
+        const skippedPath = typeof skip === "string" ? skip : typeof skip.path === "string" ? skip.path : undefined;
+        if (skippedPath) {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-optional-tool-semgrep-evidence",
+                category: "android-semgrep",
+                confidence: "low",
+                location: { path: skippedPath },
+                summary: "Semgrep skipped this path during the scan",
+                rawValue: undefined,
+                resolutionState: "not-applicable",
+                staticAnalysisLimitations: ["Semgrep static analysis only."],
+            }));
+        }
+    }
+    const parserErrors = errors.slice(0, 50).map((e) => (typeof e === "object" && e !== null && "message" in e ? boundedMessage(e.message) : "Semgrep reported an error."));
+    return {
+        malformed: false,
+        toolVersion,
+        findings,
+        candidates,
+        scannedCount: scanned.length,
+        skippedPaths: skipped.map((s) => (typeof s === "string" ? s : typeof s?.path === "string" ? s.path : "")).filter(Boolean),
+        parserErrors,
+        truncated,
+    };
+}

package/dist/src/mobile/android/advancedSecurity/externalTools/semgrep/rules.js

@@ -0,0 +1,105 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 7 — package-owned, bounded Android-focused Semgrep rule pack.
+//
+// Small, stable supplement to the internal checks — NOT a replacement.
+// Deliberately excludes hardcoded-secret rules (owned by Batch 4's
+// secretCandidates analyzer) and manifest-attribute rules (owned by the
+// internal manifest parser); covers source-level patterns those analyzers
+// do not reach. Caller-provided configuration is never accepted — this is
+// the only rule pack Semgrep is ever invoked with.
+// ---------------------------------------------------------------------------
+export const ANDROID_SEMGREP_RULE_PACK = [
+    {
+        id: "android-semgrep-trust-all-hostname-verifier",
+        languages: ["java", "kotlin"],
+        message: "A HostnameVerifier implementation unconditionally returns true, disabling TLS hostname verification.",
+        severity: "ERROR",
+        cwe: ["CWE-297"],
+        owasp: ["A02:2021"],
+        patterns: ["new HostnameVerifier() { ... boolean verify(...) { return true; } ... }"],
+    },
+    {
+        id: "android-semgrep-permissive-x509-trust-manager",
+        languages: ["java", "kotlin"],
+        message: "An X509TrustManager implementation has an empty or no-op certificate validation method, accepting any certificate chain.",
+        severity: "ERROR",
+        cwe: ["CWE-295"],
+        owasp: ["A02:2021"],
+        patterns: [
+            "class $T : X509TrustManager { ... override fun checkServerTrusted(...) { } ... }",
+            "new X509TrustManager() { ... public void checkServerTrusted(...) { } ... }",
+        ],
+    },
+    {
+        id: "android-semgrep-ssl-error-handler-proceed",
+        languages: ["java", "kotlin"],
+        message: "onReceivedSslError calls handler.proceed(), ignoring the certificate error and continuing the connection.",
+        severity: "ERROR",
+        cwe: ["CWE-295"],
+        patterns: ["... onReceivedSslError(...) { ... $HANDLER.proceed() ... }"],
+    },
+    {
+        id: "android-semgrep-webview-universal-file-url-access",
+        languages: ["java", "kotlin"],
+        message: "setAllowUniversalAccessFromFileURLs(true) allows file:// content to access any origin.",
+        severity: "WARNING",
+        cwe: ["CWE-668"],
+        patterns: ["$WEBVIEW.settings.allowUniversalAccessFromFileURLs = true", "$SETTINGS.setAllowUniversalAccessFromFileURLs(true)"],
+    },
+    {
+        id: "android-semgrep-webview-debugging-enabled",
+        languages: ["java", "kotlin"],
+        message: "WebView.setWebContentsDebuggingEnabled(true) is set unconditionally, which may ship to release builds.",
+        severity: "INFO",
+        patterns: ["WebView.setWebContentsDebuggingEnabled(true)"],
+    },
+    {
+        id: "android-semgrep-world-readable-writable-mode",
+        languages: ["java", "kotlin"],
+        message: "A file or preferences API is opened with MODE_WORLD_READABLE or MODE_WORLD_WRITEABLE.",
+        severity: "ERROR",
+        cwe: ["CWE-732"],
+        patterns: ["$CTX.getSharedPreferences($NAME, Context.MODE_WORLD_READABLE)", "$CTX.getSharedPreferences($NAME, Context.MODE_WORLD_WRITEABLE)", "$CTX.openFileOutput($NAME, Context.MODE_WORLD_READABLE)", "$CTX.openFileOutput($NAME, Context.MODE_WORLD_WRITEABLE)"],
+    },
+    {
+        id: "android-semgrep-weak-digest-md5-sha1",
+        languages: ["java", "kotlin"],
+        message: "MessageDigest.getInstance uses a weak digest algorithm (MD5 or SHA-1) for security-sensitive hashing.",
+        severity: "WARNING",
+        cwe: ["CWE-327"],
+        patterns: ['MessageDigest.getInstance("MD5")', 'MessageDigest.getInstance("SHA-1")', 'MessageDigest.getInstance("SHA1")'],
+    },
+    {
+        id: "android-semgrep-insecure-cipher-transformation",
+        languages: ["java", "kotlin"],
+        message: "Cipher.getInstance uses an insecure transformation (ECB mode, DES, or RC4).",
+        severity: "ERROR",
+        cwe: ["CWE-327"],
+        patterns: ['Cipher.getInstance("...ECB...")', 'Cipher.getInstance("DES")', 'Cipher.getInstance("RC4")'],
+    },
+];
+export function assertUniqueSemgrepRuleIds() {
+    const ids = ANDROID_SEMGREP_RULE_PACK.map((rule) => rule.id);
+    const unique = new Set(ids);
+    if (unique.size !== ids.length) {
+        throw new Error("Duplicate Semgrep rule id detected in ANDROID_SEMGREP_RULE_PACK.");
+    }
+}
+// Deterministic YAML-compatible serialization (JSON is valid YAML; Semgrep
+// accepts a .yaml/.yml config file). Key order is fixed so repeated calls
+// produce byte-identical output (config fingerprinting depends on this).
+export function serializeSemgrepRulePack() {
+    const rules = ANDROID_SEMGREP_RULE_PACK.map((rule) => ({
+        id: rule.id,
+        languages: [...rule.languages],
+        message: rule.message,
+        severity: rule.severity,
+        metadata: {
+            ...(rule.cwe ? { cwe: [...rule.cwe] } : {}),
+            ...(rule.owasp ? { owasp: [...rule.owasp] } : {}),
+            "android-package-owned": true,
+        },
+        "pattern-either": rule.patterns.map((pattern) => ({ pattern })),
+    }));
+    return JSON.stringify({ rules }, null, 2);
+}

package/dist/src/mobile/android/advancedSecurity/externalTools/types.js

@@ -0,0 +1,107 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 7 — common contract for optional external Android
+// security-tool evidence (Semgrep, OSV-Scanner, Android Lint,
+// OWASP Dependency-Check).
+//
+// This module defines identities and request/result shapes only. No process
+// ever executes because a type exists here. Every tool remains disconnected
+// from validateAndroidTarget, the CLI, verdict calculation, and active
+// reports until Batch 8 — see each adapter's checkResult.ts for the
+// standalone AndroidCheckResult-compatible builder.
+// ---------------------------------------------------------------------------
+export const ANDROID_EXTERNAL_TOOL_IDS = ["semgrep", "osv", "android-lint", "dependency-check"];
+export function isAndroidExternalSecurityToolId(value) {
+    return ANDROID_EXTERNAL_TOOL_IDS.includes(value);
+}
+// Deterministic dispatch order — never concurrent, never caller-controlled.
+export const ANDROID_EXTERNAL_TOOL_ORDER = ["semgrep", "osv", "android-lint", "dependency-check"];
+export const ANDROID_EXTERNAL_TOOL_NETWORK_POLICIES = ["deny", "allow-for-requested-tool"];
+const MIN_TIMEOUT_OVERRIDE_MS = 5_000;
+const MAX_TIMEOUT_OVERRIDE_MS = 30 * 60_000;
+// Deduplicates and orders requested tool ids deterministically, and rejects
+// any id outside the closed ANDROID_EXTERNAL_TOOL_IDS union at this single
+// contract boundary — no caller can smuggle an arbitrary tool identity past
+// this point.
+export function normalizeAndroidExternalToolRequest(request) {
+    if (!request || !Array.isArray(request.requestedTools) || request.requestedTools.length === 0) {
+        return {
+            ok: true,
+            value: {
+                tools: [],
+                targetRoot: request?.targetRoot ?? "",
+                artifactRoot: request?.artifactRoot ?? "",
+                networkPolicy: request?.networkPolicy ?? "deny",
+                timeoutOverrideMs: request?.timeoutOverrideMs,
+            },
+        };
+    }
+    const unknown = request.requestedTools.filter((id) => !isAndroidExternalSecurityToolId(id));
+    if (unknown.length > 0) {
+        return { ok: false, error: `Unknown external security tool id(s): ${unknown.join(", ")}` };
+    }
+    if (!request.targetRoot)
+        return { ok: false, error: "targetRoot is required." };
+    if (!request.artifactRoot)
+        return { ok: false, error: "artifactRoot is required." };
+    if (request.timeoutOverrideMs !== undefined) {
+        if (request.timeoutOverrideMs < MIN_TIMEOUT_OVERRIDE_MS || request.timeoutOverrideMs > MAX_TIMEOUT_OVERRIDE_MS) {
+            return { ok: false, error: `timeoutOverrideMs must be between ${MIN_TIMEOUT_OVERRIDE_MS} and ${MAX_TIMEOUT_OVERRIDE_MS}.` };
+        }
+    }
+    const requestedSet = new Set(request.requestedTools);
+    const tools = ANDROID_EXTERNAL_TOOL_ORDER.filter((id) => requestedSet.has(id));
+    return {
+        ok: true,
+        value: {
+            tools,
+            targetRoot: request.targetRoot,
+            artifactRoot: request.artifactRoot,
+            networkPolicy: request.networkPolicy ?? "deny",
+            timeoutOverrideMs: request.timeoutOverrideMs,
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Artifact references — Batch 7 introduces this concept new (no existing
+// owner copies/hashes generated tool output); Batch 8 decides where active
+// reports place these.
+// ---------------------------------------------------------------------------
+export const ANDROID_EXTERNAL_TOOL_ARTIFACT_KINDS = ["json", "xml", "sarif", "text"];
+export const ANDROID_EXTERNAL_TOOL_PARSE_STATUSES = ["parsed", "malformed", "truncated", "not-attempted"];
+// ---------------------------------------------------------------------------
+// Common per-tool execution result — every adapter's checkResult.ts folds
+// this (plus tool-specific findings/candidates) into a standalone
+// AndroidCheckResult, exactly as the existing Gradle operations fold a
+// CommandExecutionResult via buildGradleOperationCheckResult.
+// ---------------------------------------------------------------------------
+export const ANDROID_EXTERNAL_TOOL_STATUSES = [
+    "not-requested",
+    "skipped",
+    "completed-without-findings",
+    "completed-with-findings",
+    "inconclusive",
+    "failed",
+];
+export function notRequestedResult(toolId, targetRoot, networkPolicy) {
+    return {
+        toolId,
+        requested: false,
+        available: false,
+        executed: false,
+        status: "not-requested",
+        commandSummary: "(not requested)",
+        workingDirectory: targetRoot,
+        networkPolicy,
+        durationMs: 0,
+        exitCode: null,
+        timedOut: false,
+        stdoutTruncated: false,
+        stderrTruncated: false,
+        artifacts: [],
+        warnings: [],
+        errors: [],
+        skips: [],
+        mutationEvidence: { comparable: true, expectedGeneratedChanges: [], unexpectedChanges: [] },
+        limitations: [],
+    };
+}

package/dist/src/mobile/android/advancedSecurity/fileProvider/checkResult.js

@@ -0,0 +1,188 @@
+import fs from "node:fs";
+import path from "node:path";
+import { parseXmlDocument } from "../../manifest/xml/parseXml.js";
+import { makeAndroidFinding } from "../../audit/androidFinding.js";
+import { makeCandidateEvidence } from "../candidateEvidence.js";
+import { sortCandidateEvidence } from "../ordering.js";
+import { resolveAndroidXmlResourceReference } from "../resourceResolution.js";
+import { buildAndroidSourceLocation } from "../sourceLocation.js";
+import { discoverSecretSourceFiles } from "../secretCandidates/discoverSecretSourceFiles.js";
+export const ANDROID_FILE_PROVIDER_AUDIT_CHECK_ID = "android-file-provider-audit";
+const FILE_PROVIDER_METADATA = "android.support.FILE_PROVIDER_PATHS";
+const PATH_TAGS = new Set(["root-path", "files-path", "cache-path", "external-path", "external-files-path", "external-cache-path", "external-media-path"]);
+const EXTERNAL_TAGS = new Set(["external-path", "external-files-path", "external-cache-path", "external-media-path"]);
+const MAX_PATH_ENTRIES = 256;
+const MAX_EVIDENCE_VALUE = 240;
+function sourceLocation(root, relativePath, line) {
+    return buildAndroidSourceLocation(root, path.join(root, relativePath), { line });
+}
+function standardProvider(name) {
+    return name === "androidx.core.content.FileProvider" || name === "android.support.v4.content.FileProvider";
+}
+function directCustomProviders(root, detection) {
+    const byModule = new Map();
+    const discovery = discoverSecretSourceFiles(root, detection.modules.map((module) => module.path));
+    for (const file of discovery.files.filter((candidate) => /\.(java|kt)$/.test(candidate.relativePath))) {
+        const moduleKey = file.modulePath ?? "";
+        const names = byModule.get(moduleKey) ?? new Set();
+        const executable = file.content.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/\/\/[^\r\n]*/g, " ");
+        for (const match of executable.matchAll(/\bclass\s+([A-Za-z_]\w*)\s*(?:extends\s+|:\s*)(?:androidx\.core\.content\.|android\.support\.v4\.content\.)?FileProvider\s*(?:\(\s*\))?/g))
+            names.add(match[1]);
+        byModule.set(moduleKey, names);
+    }
+    return byModule;
+}
+function finding(ruleId, title, artifactPath, line, identity, severity) {
+    return makeAndroidFinding({ ruleId, title, severity, confidence: "high", description: `${title}. This is static manifest/XML evidence and does not prove runtime reachability, URI access, or file exposure.`, manifestPath: artifactPath, identity, location: line === undefined ? undefined : { line }, recommendation: "Keep FileProvider non-exported and restrict configured roots to the narrowest required paths." });
+}
+function candidate(ruleId, root, artifactPath, modulePath, line, summary, raw, state = "resolved", confidence = "medium") {
+    return makeCandidateEvidence({ ruleId, category: "android-file-provider", confidence, modulePath, location: sourceLocation(root, artifactPath, line), summary, rawValue: (raw ?? "(missing)").slice(0, MAX_EVIDENCE_VALUE), resolutionState: state, staticAnalysisLimitations: ["Manifest sources are not merged; resource overlays, installed authorities, URI grants, permission protection levels, and runtime filesystem behavior are not evaluated."] });
+}
+function protectedProvider(provider) {
+    return Boolean(provider.permission || provider.readPermission || provider.writePermission);
+}
+function broadPath(tag, rawPath) {
+    const value = (rawPath ?? "").trim().replace(/\\/g, "/").replace(/\/{2,}/g, "/");
+    return tag === "root-path" || value === "" || value === "." || value === "/" || /(^|\/)\.\.(\/|$)/.test(value) || /^[A-Za-z]:\//.test(value) || value.startsWith("/") || (EXTERNAL_TAGS.has(tag) && value.split("/").filter(Boolean).length <= 1);
+}
+function analyzeAuthorities(root, entry, provider, seen, out) {
+    const raw = provider.authoritiesRaw;
+    if (raw === undefined || raw.trim() === "") {
+        out.push(candidate("android-file-provider-exported", root, entry.manifestPath, entry.modulePath, provider.location?.line, "FileProvider authority is missing or empty", raw, raw === undefined ? "missing" : "malformed"));
+        return;
+    }
+    const local = new Set();
+    for (const authority of raw.split(";")) {
+        const normalized = authority.trim();
+        if (!normalized) {
+            out.push(candidate("android-file-provider-exported", root, entry.manifestPath, entry.modulePath, provider.location?.line, "FileProvider authority contains an empty entry", authority, "malformed"));
+            continue;
+        }
+        if (/\$\{[^}]+\}/.test(normalized)) {
+            out.push(candidate("android-file-provider-exported", root, entry.manifestPath, entry.modulePath, provider.location?.line, "FileProvider authority contains an unresolved placeholder", normalized, "unresolved"));
+            continue;
+        }
+        if (!/^[A-Za-z0-9_.-]+$/.test(normalized)) {
+            out.push(candidate("android-file-provider-exported", root, entry.manifestPath, entry.modulePath, provider.location?.line, "FileProvider authority is malformed", normalized, "malformed"));
+            continue;
+        }
+        const key = normalized.toLowerCase();
+        if (local.has(key) || seen.has(key))
+            out.push(candidate("android-file-provider-exported", root, entry.manifestPath, entry.modulePath, provider.location?.line, `Duplicate FileProvider authority${seen.has(key) ? " across providers/modules" : " within provider"}`, normalized, "unresolved"));
+        local.add(key);
+        seen.set(key, `${entry.modulePath ?? ""}:${entry.manifestPath}:${provider.name}`);
+    }
+}
+export function auditAndroidFileProviders(targetRoot, detection, manifests) {
+    if (detection.projectKind === "non-android")
+        return { id: ANDROID_FILE_PROVIDER_AUDIT_CHECK_ID, category: "android-file-provider", title: "Android FileProvider audit", status: "unsupported", requirementLevel: "optional", ran: false, skipped: true, skipInfo: { checkId: ANDROID_FILE_PROVIDER_AUDIT_CHECK_ID, reason: "Target was not detected as Android.", requirementLevel: "optional", verdictImpact: "does not apply", recommendedNextAction: "Run against an Android project." }, evidence: [], findings: [], warnings: [], errors: [], sourcePaths: [], confidence: "unknown", environmentRequirements: [], candidateEvidence: [] };
+    const findings = [];
+    const candidates = [];
+    const sources = new Set();
+    const seenAuthorities = new Map();
+    const custom = directCustomProviders(targetRoot, detection);
+    for (const entry of manifests)
+        for (const provider of entry.manifest.providers) {
+            const simpleName = provider.name.split(".").at(-1) ?? provider.name;
+            const confirmed = standardProvider(provider.name) || (custom.get(entry.modulePath ?? "")?.has(simpleName) ?? false);
+            if (!confirmed) {
+                if (/FileProvider$/i.test(provider.name))
+                    candidates.push(candidate("android-file-provider-exported", targetRoot, entry.manifestPath, entry.modulePath, provider.location?.line, "FileProvider-like class is not a directly proven FileProvider subclass", provider.name, "unresolved", "low"));
+                continue;
+            }
+            sources.add(entry.manifestPath);
+            const library = entry.modulePath !== undefined && detection.libraryModules.includes(entry.modulePath);
+            analyzeAuthorities(targetRoot, entry, provider, seenAuthorities, candidates);
+            if (provider.exported === true) {
+                if (library)
+                    candidates.push(candidate("android-file-provider-exported", targetRoot, entry.manifestPath, entry.modulePath, provider.location?.line, "Library manifest explicitly exports a FileProvider; application merged behavior requires review", provider.name, "resolved"));
+                else
+                    findings.push(finding("android-file-provider-exported", "Confirmed FileProvider is explicitly exported", entry.manifestPath, provider.location?.line, provider.name, "major"));
+                // The generic exported-component audit already owns the exact unprotected-provider finding.
+                if (!protectedProvider(provider))
+                    candidates.push(candidate("android-file-provider-missing-protection", targetRoot, entry.manifestPath, entry.modulePath, provider.location?.line, "Exported FileProvider has no provider/read/write permission (generic exported audit owns the equivalent finding)", provider.name, "resolved", "high"));
+            }
+            else if (provider.exported === undefined)
+                candidates.push(candidate("android-file-provider-exported", targetRoot, entry.manifestPath, entry.modulePath, provider.location?.line, "FileProvider exported state is missing or unresolved", provider.exportedRaw, provider.exportedRaw === undefined ? "missing" : "unresolved"));
+            if (provider.grantUriPermissions === undefined)
+                candidates.push(candidate("android-file-provider-exported", targetRoot, entry.manifestPath, entry.modulePath, provider.location?.line, "FileProvider grantUriPermissions is missing or unresolved", provider.grantUriPermissionsRaw, provider.grantUriPermissionsRaw === undefined ? "missing" : "unresolved", "low"));
+            for (const value of [provider.permission, provider.readPermission, provider.writePermission].filter((item) => item !== undefined))
+                if (value.trim() === "" || /\$\{[^}]+\}/.test(value))
+                    candidates.push(candidate("android-file-provider-missing-protection", targetRoot, entry.manifestPath, entry.modulePath, provider.location?.line, "Provider permission value is empty or unresolved", value, value.trim() === "" ? "malformed" : "unresolved"));
+            const metadata = (provider.metadata ?? []).filter((item) => item.name === FILE_PROVIDER_METADATA);
+            if (metadata.length === 0) {
+                candidates.push(candidate("android-file-provider-missing-paths-xml", targetRoot, entry.manifestPath, entry.modulePath, provider.location?.line, "FileProvider has no FILE_PROVIDER_PATHS metadata", undefined, "missing"));
+                continue;
+            }
+            const references = [...new Set(metadata.map((item) => item.resource ?? item.value ?? ""))];
+            if (references.length > 1) {
+                candidates.push(candidate("android-file-provider-unresolved-reference", targetRoot, entry.manifestPath, entry.modulePath, metadata[0].location?.line, "Conflicting FILE_PROVIDER_PATHS metadata entries were not selected arbitrarily", references.join(";"), "unresolved"));
+                continue;
+            }
+            const reference = references[0];
+            if (!reference || metadata.some((item) => !item.resource)) {
+                candidates.push(candidate("android-file-provider-missing-paths-xml", targetRoot, entry.manifestPath, entry.modulePath, metadata[0].location?.line, "FILE_PROVIDER_PATHS metadata has no concrete android:resource", reference, reference ? "unsupported" : "missing"));
+                continue;
+            }
+            const resolution = resolveAndroidXmlResourceReference(targetRoot, path.join(targetRoot, entry.modulePath ?? "."), reference);
+            if (resolution.state !== "resolved") {
+                const state = resolution.state === "missing" ? "missing" : resolution.state === "malformed-reference" ? (/\$\{/.test(reference) ? "unresolved" : "malformed") : resolution.state === "unsupported-reference" ? "unsupported" : "unresolved";
+                candidates.push(candidate(resolution.state === "missing" ? "android-file-provider-missing-paths-xml" : "android-file-provider-unresolved-reference", targetRoot, entry.manifestPath, entry.modulePath, metadata[0].location?.line, `FILE_PROVIDER_PATHS resource is ${resolution.state}${resolution.state === "ambiguous" ? ` (${resolution.candidates.length} candidates)` : ""}`, reference, state));
+                continue;
+            }
+            const resource = resolution.candidates[0];
+            sources.add(resource.relativePath);
+            let xml;
+            try {
+                xml = fs.readFileSync(path.join(targetRoot, resource.relativePath), "utf8");
+            }
+            catch {
+                candidates.push(candidate("android-file-provider-missing-paths-xml", targetRoot, resource.relativePath, entry.modulePath, undefined, "Resolved paths XML could not be read", resource.relativePath, "missing"));
+                continue;
+            }
+            const parsed = parseXmlDocument(xml);
+            if (!parsed.ok) {
+                candidates.push(candidate("android-file-provider-malformed-paths-xml", targetRoot, resource.relativePath, entry.modulePath, parsed.error.location.line, "FileProvider paths XML is malformed", parsed.error.message, "malformed"));
+                continue;
+            }
+            if (parsed.root.localName !== "paths") {
+                candidates.push(candidate("android-file-provider-malformed-paths-xml", targetRoot, resource.relativePath, entry.modulePath, parsed.root.location.line, `Unsupported FileProvider paths root <${parsed.root.tagName}>`, parsed.root.tagName, "unsupported"));
+                continue;
+            }
+            if (parsed.root.children.length > MAX_PATH_ENTRIES)
+                candidates.push(candidate("android-file-provider-malformed-paths-xml", targetRoot, resource.relativePath, entry.modulePath, parsed.root.location.line, `FileProvider paths XML exceeds the ${MAX_PATH_ENTRIES}-entry analysis bound`, String(parsed.root.children.length), "unsupported"));
+            const identities = new Map();
+            const exact = new Set();
+            for (const child of parsed.root.children.slice(0, MAX_PATH_ENTRIES)) {
+                const name = child.attributes.find((attribute) => attribute.localName === "name")?.value;
+                const rawPath = child.attributes.find((attribute) => attribute.localName === "path")?.value;
+                if (!PATH_TAGS.has(child.localName)) {
+                    candidates.push(candidate("android-file-provider-broad-paths", targetRoot, resource.relativePath, entry.modulePath, child.location.line, "Unsupported FileProvider path element", child.tagName, "unsupported"));
+                    continue;
+                }
+                if (name === undefined || name.trim() === "")
+                    candidates.push(candidate("android-file-provider-broad-paths", targetRoot, resource.relativePath, entry.modulePath, child.location.line, "FileProvider path entry has a missing or empty name", name, "malformed"));
+                if (rawPath === undefined)
+                    candidates.push(candidate("android-file-provider-broad-paths", targetRoot, resource.relativePath, entry.modulePath, child.location.line, "FileProvider path entry is missing path", undefined, "malformed"));
+                const normalized = (rawPath ?? "").trim().replace(/\\/g, "/").replace(/\/{2,}/g, "/").slice(0, MAX_EVIDENCE_VALUE);
+                const exactKey = `${child.localName}:${name ?? ""}:${normalized}`;
+                const prior = identities.get(name ?? "");
+                if (exact.has(exactKey))
+                    candidates.push(candidate("android-file-provider-broad-paths", targetRoot, resource.relativePath, entry.modulePath, child.location.line, "Duplicate FileProvider path entry", exactKey, "unresolved"));
+                else if (name !== undefined && prior !== undefined && prior !== `${child.localName}:${normalized}`)
+                    candidates.push(candidate("android-file-provider-broad-paths", targetRoot, resource.relativePath, entry.modulePath, child.location.line, "Conflicting FileProvider path entries share the same name", `${name}:${prior}:${child.localName}:${normalized}`, "unresolved"));
+                exact.add(exactKey);
+                if (name !== undefined)
+                    identities.set(name, `${child.localName}:${normalized}`);
+                if (broadPath(child.localName, rawPath)) {
+                    if (provider.exported === true && !library)
+                        findings.push(finding("android-file-provider-broad-paths", `Exported FileProvider has broad <${child.localName}> path`, resource.relativePath, child.location.line, `${entry.modulePath ?? ""}:${provider.name}:${name ?? ""}:${normalized}`, "major"));
+                    else
+                        candidates.push(candidate("android-file-provider-broad-paths", targetRoot, resource.relativePath, entry.modulePath, child.location.line, `Potentially broad <${child.localName}> path`, normalized, "resolved"));
+                }
+            }
+        }
+    const uniqueFindings = [...new Map(findings.map((item) => [item.id, item])).values()].sort((a, b) => a.id.localeCompare(b.id));
+    const uniqueCandidates = [...new Map(candidates.map((item) => [item.id, item])).values()];
+    return { id: ANDROID_FILE_PROVIDER_AUDIT_CHECK_ID, category: "android-file-provider", title: "Android FileProvider audit", status: uniqueFindings.length ? "failed" : "passed", requirementLevel: "required", ran: true, skipped: false, evidence: [`${sources.size} manifest/XML artifact(s) inspected`], findings: uniqueFindings, warnings: ["Static analysis only: manifests are not merged; resource overlays, runtime URI grants, installed authorities, and provider-backed filesystem access are not evaluated."], errors: [], sourcePaths: [...sources].sort((a, b) => a.localeCompare(b)), confidence: "high", environmentRequirements: [], candidateEvidence: sortCandidateEvidence(uniqueCandidates) };
+}

package/dist/src/mobile/android/advancedSecurity/fileProvider/index.js

@@ -0,0 +1 @@
+export { auditAndroidFileProviders, ANDROID_FILE_PROVIDER_AUDIT_CHECK_ID } from "./checkResult.js";