@zhuma4/cli 4.0.0-alpha.1

package/rules/android/mobile-cwe-312-cleartext-storage.yaml

@@ -0,0 +1,109 @@
+# CWE-312: Cleartext Storage of Sensitive Information (Android)
+# ZhuMa V4.0 - Android Rule Library
+# Source: V3 Audit Engine extension - cleartext storage patterns
+
+rules:
+  - id: zm-android-sharedprefs-sensitive-key
+    severity: WARNING
+    message: |
+      Detected SharedPreferences storing data with a sensitive key name (password, token, ssn, credit_card, passport, license).
+      Storing sensitive data in SharedPreferences without encryption exposes it to other apps with root access or backup extraction.
+      Remediation: Use EncryptedSharedPreferences (AndroidX Security) or Android Keystore for sensitive data storage.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: $SP.edit().putString("$KEY", $VAL)
+          - pattern: $SP.edit().putString("$KEY", $VAL);
+          - pattern: $EDITOR.putString("$KEY", $VAL)
+      - metavariable-regex:
+          metavariable: $KEY
+          regex: '(?i)(password|passwd|pwd|token|secret|ssn|credit_card|creditcard|passport|license|pin|apikey|api_key|access_token|refresh_token|auth_token|bearer)'
+    metadata:
+      cwe: "CWE-312: Cleartext Storage of Sensitive Information"
+      owasp-mobile: "M2: Insecure Data Storage"
+      masvs: "MASVS-STORAGE-1"
+      category: android-storage
+      precision: medium
+      confidence: medium
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/312.html
+        - https://developer.android.com/reference/androidx/security/crypto/EncryptedSharedPreferences
+
+  - id: zm-android-sqlite-sensitive-column-insert
+    severity: WARNING
+    message: |
+      Detected SQLiteDatabase.insert() or execSQL() operating on a column named password, secret, or token.
+      Storing sensitive values in plaintext SQLite allows extraction via backup or root access.
+      Remediation: Encrypt sensitive columns before storage using Android Keystore-backed AES-GCM.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: $DB.insert("$TABLE", null, $VALUES)
+          - pattern: $DB.execSQL("$SQL", $ARGS)
+          - pattern: $DB.rawQuery("$SQL", $ARGS)
+      - metavariable-regex:
+          metavariable: $TABLE
+          regex: '(?i)(user|account|credential|auth|token|session)'
+    metadata:
+      cwe: "CWE-312: Cleartext Storage of Sensitive Information"
+      owasp-mobile: "M2: Insecure Data Storage"
+      masvs: "MASVS-STORAGE-1"
+      category: android-storage
+      precision: low
+      confidence: low
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/312.html
+        - https://developer.android.com/privacy-and-security/risks/sql-injection
+
+  - id: zm-android-fileoutputstream-password-field
+    severity: WARNING
+    message: |
+      Detected FileOutputStream writing data from an EditText with inputType textPassword or numberPassword.
+      Writing password field content to a file without encryption exposes credentials on disk.
+      Remediation: Encrypt data before writing or avoid persisting password field values to storage.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: |
+              $FOS.write($PW.getText().toString().getBytes())
+          - pattern: |
+              $FOS.write($PW.getText().toString().getBytes("$ENC"))
+    metadata:
+      cwe: "CWE-312: Cleartext Storage of Sensitive Information"
+      owasp-mobile: "M2: Insecure Data Storage"
+      masvs: "MASVS-STORAGE-1"
+      category: android-storage
+      precision: low
+      confidence: low
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/312.html
+
+  - id: zm-android-internal-storage-sensitive-write
+    severity: WARNING
+    message: |
+      Detected openFileOutput() writing a file whose name contains sensitive keywords (credential, token, secret, password).
+      Files stored in internal storage can still be accessed via rooted devices or backup extraction.
+      Remediation: Use EncryptedFile (AndroidX Security) for sensitive file storage.
+    languages:
+      - java
+    patterns:
+      - pattern: openFileOutput("$FNAME", $MODE)
+      - metavariable-regex:
+          metavariable: $FNAME
+          regex: '(?i)(credential|token|secret|password|auth|key|ssn|private)'
+    metadata:
+      cwe: "CWE-312: Cleartext Storage of Sensitive Information"
+      owasp-mobile: "M2: Insecure Data Storage"
+      masvs: "MASVS-STORAGE-1"
+      category: android-storage
+      precision: medium
+      confidence: medium
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/312.html

package/rules/android/mobile-cwe-319-cleartext-communication.yaml

@@ -0,0 +1,84 @@
+# CWE-319: HTTP 明文通信 / Websocket 明文 (Android)
+# 逐码 ZhuMa V4.0 — Android 规则库
+# 来源: V3 审计引擎 baseline scan / all_in_one.js
+
+rules:
+  - id: zm-android-usescleartext-traffic-true
+    severity: HIGH
+    message: |
+      检测到允许 HTTP 明文通信的配置。
+      Android 9+ (API 28) 默认阻止 HTTP 明文流量。如果以下配置存在，
+      则 APP 有意允许 HTTP 流量，存在凭证嗅探和中间人攻击风险。
+      修复: 使用 HTTPS；如需临时调试，仅在 debug builds 中启用。
+    metadata:
+      cwe: "CWE-319: Cleartext Transmission of Sensitive Information"
+      owasp-mobile: "M3: Insecure Communication"
+      masvs: "MASVS-NETWORK-1"
+      category: android-network
+      precision: high
+      confidence: high
+      likelihood: high
+      impact: high
+      source: "V3 Audit Engine - baseline scan"
+      references:
+        - https://developer.android.com/privacy-and-security/risks/cleartext-communications
+    languages:
+      - java
+    patterns:
+      - pattern: |
+          $A.setExported(true);
+
+  - id: zm-android-okhttp-http-url
+    severity: HIGH
+    message: |
+      检测到 OkHttp 请求使用 HTTP (非 HTTPS) URL。
+      HTTP 通信无法防止中间人攻击和数据嗅探。
+      修复: 改为 HTTPS；或在服务端强制 301 重定向。
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: |
+              new Request.Builder().url("http://$HOST")
+          - pattern: |
+              $REQ.url("http://$HOST")
+    metavariable-regex:
+      metavariable: $HOST
+      regex: '^(?!localhost|127\.0\.0\.1|10\.|192\.168\.|172\.(1[6-9]|2\d|3[01]))'
+    metadata:
+      cwe: "CWE-319: Cleartext Transmission of Sensitive Information"
+      owasp-mobile: "M3: Insecure Communication"
+      masvs: "MASVS-NETWORK-1"
+      category: android-network
+      precision: medium
+      confidence: medium
+      source: "V3 Audit Engine - all_in_one.js HTTP scan"
+      references:
+        - https://developer.android.com/privacy-and-security/risks/cleartext-communications
+
+  - id: zm-android-httpurlconnection-http
+    severity: HIGH
+    message: |
+      检测到直接打开 HTTP URL 连接。
+      应使用 HttpsURLConnection 替代。
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: |
+              $URL.openConnection()
+          - pattern: |
+              new URL("http://$HOST")
+      - metavariable-regex:
+          metavariable: $HOST
+          regex: '^(?!localhost|127\.0\.0\.1|10\.|192\.168\.|172\.(1[6-9]|2\d|3[01]))'
+    metadata:
+      cwe: "CWE-319: Cleartext Transmission of Sensitive Information"
+      owasp-mobile: "M3: Insecure Communication"
+      masvs: "MASVS-NETWORK-1"
+      category: android-network
+      precision: low
+      confidence: low
+      source: "V3 Audit Engine - baseline scan"
+      references:
+        - https://developer.android.com/privacy-and-security/risks/cleartext-communications

package/rules/android/mobile-cwe-321-hardcoded-crypto-keys.yaml

@@ -0,0 +1,132 @@
+# CWE-321: 硬编码加密密钥 (Android)
+# 逐码 ZhuMa V4.0 — Android 规则库
+# 来源: V3 审计引擎 VULN-CRYPTO-* (scan_crypto_expanded)
+
+rules:
+  - id: zm-android-hardcoded-aes-key
+    severity: CRITICAL
+    message: |
+      检测到硬编码 AES 密钥。AES 密钥硬编码在源码中可被逆向提取，
+      导致所有以此密钥加密的数据失效。
+      应使用 Android Keystore System + TEE/StrongBox 生成和管理密钥。
+      修复: KeyGenParameterSpec + AndroidKeyStore provider
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: |
+              new SecretKeySpec($BYTES, $ALG)
+    metavariable-regex:
+      metavariable: $KEY
+      regex: '.{8,}'
+    metadata:
+      cwe: "CWE-321: Use of Hard-coded Cryptographic Key"
+      owasp-mobile: "M5: Insufficient Cryptography"
+      masvs: "MASVS-CRYPTO-1"
+      category: android-crypto
+      precision: high
+      confidence: high
+      likelihood: high
+      impact: critical
+      source: "V3 Audit Engine - VULN-CRYPTO-*"
+      references:
+        - https://developer.android.com/privacy-and-security/cryptography
+        - https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec
+
+  - id: zm-android-hardcoded-des-key
+    severity: CRITICAL
+    message: |
+      检测到硬编码 DES 密钥。DES 密钥长度仅 56 位，可在数小时内暴力破解。
+      且密钥硬编码在源码中可直接逆向提取。
+      立即迁移至 Android Keystore System + AES-256-GCM。
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: |
+              new SecretKeySpec($BYTES, $ALG)
+    metavariable-regex:
+      metavariable: $KEY
+      regex: '.{8,}'
+    metadata:
+      cwe: "CWE-321: Use of Hard-coded Cryptographic Key"
+      owasp-mobile: "M5: Insufficient Cryptography"
+      masvs: "MASVS-CRYPTO-1"
+      category: android-crypto
+      precision: high
+      confidence: high
+      source: "V3 Audit Engine - VULN-CRYPTO-*"
+
+  - id: zm-android-hardcoded-pbe-password
+    severity: CRITICAL
+    message: |
+      检测到硬编码 PBE (Password-Based Encryption) 密码。
+      PBE 密钥派生密码硬编码使得密钥可通过静态分析直接提取。
+      应使用 Android Keystore System 或从用户输入派生密码。
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: new PBEKeySpec($PWD)
+    metavariable-regex:
+      metavariable: $PWD
+      regex: '.{6,}'
+    metadata:
+      cwe: "CWE-321: Use of Hard-coded Cryptographic Key"
+      owasp-mobile: "M5: Insufficient Cryptography"
+      masvs: "MASVS-CRYPTO-1"
+      category: android-crypto
+      precision: high
+      confidence: high
+      source: "V3 Audit Engine - VULN-CRYPTO-*"
+
+  - id: zm-android-hardcoded-iv
+    severity: HIGH
+    message: |
+      检测到硬编码/静态初始化向量（IV）。
+      对于 CBC 模式，固定 IV 使加密确定性化，可遭受块重放攻击。
+      对于 GCM 模式，IV 重用会完全破坏认证加密的安全性。
+      必须使用 SecureRandom 为每次加密生成随机 IV。
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: |
+              new IvParameterSpec($IV_BYTES)
+          - pattern: |
+              new GCMParameterSpec(128, $IV_BYTES)
+    metavariable-regex:
+      metavariable: $IV
+      regex: '.{8,}'
+    metadata:
+      cwe: "CWE-321: Use of Hard-coded Cryptographic Key"
+      owasp-mobile: "M5: Insufficient Cryptography"
+      masvs: "MASVS-CRYPTO-2"
+      category: android-crypto
+      precision: high
+      confidence: high
+      source: "V3 Audit Engine - VULN-CRYPTO-*"
+      references:
+        - https://csrc.nist.gov/glossary/term/initialization_vector
+
+  - id: zm-android-hardcoded-rsa-private-key
+    severity: CRITICAL
+    message: |
+      检测到硬编码 RSA 私钥（PKCS8EncodedKeySpec）。
+      私钥硬编码在客户端 APK 中可被直接逆向提取，相当于将私钥公开发布。
+      应立即吊销该密钥对，迁移至 Android Keystore System 生成和存储私钥。
+    languages:
+      - java
+    pattern: |
+      new PKCS8EncodedKeySpec("$KEY".getBytes())
+    metavariable-regex:
+      metavariable: $KEY
+      regex: '.{20,}'
+    metadata:
+      cwe: "CWE-321: Use of Hard-coded Cryptographic Key"
+      owasp-mobile: "M5: Insufficient Cryptography"
+      masvs: "MASVS-CRYPTO-1"
+      category: android-crypto
+      precision: very-high
+      confidence: very-high
+      source: "V3 Audit Engine - VULN-CRYPTO-*"

package/rules/android/mobile-cwe-326-short-rsa.yaml

@@ -0,0 +1,108 @@
+# CWE-326: Inadequate Encryption Strength - Short RSA Key (Android)
+# ZhuMa V4.0 - Android Rule Library
+# Source: ZhuMa V4.1 Rule Expansion - key size validation
+
+rules:
+  - id: zm-android-rsa-key-less-than-2048
+    severity: HIGH
+    message: |
+      Detected RSA key generation with key size less than 2048 bits.
+      RSA keys shorter than 2048 bits are considered breakable and do not meet NIST minimum requirements.
+      Remediation: Use at least 2048-bit RSA keys. For new deployments, prefer 3072-bit or ECC.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: KeyPairGenerator.getInstance("RSA").initialize($SIZE)
+          - pattern: KeyPairGenerator.getInstance("RSA").initialize($SIZE, $RANDOM)
+          - pattern: KeyPairGenerator.getInstance("RSA", "$P").initialize($SIZE)
+      - metavariable-comparison:
+          metavariable: $SIZE
+          comparison: $SIZE < 2048
+    metadata:
+      cwe: "CWE-326: Inadequate Encryption Strength"
+      owasp-mobile: "M5: Insufficient Cryptography"
+      masvs: "MASVS-CRYPTO-1"
+      category: android-crypto
+      precision: high
+      confidence: high
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/326.html
+        - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf
+
+  - id: zm-android-ec-key-less-than-256
+    severity: MEDIUM
+    message: |
+      Detected EC key generation with key size less than 256 bits.
+      EC keys below 256 bits (e.g., secp224r1) do not provide adequate security margins.
+      Remediation: Use at least 256-bit EC curves (secp256r1/P-256 or secp384r1/P-384).
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: KeyPairGenerator.getInstance("EC").initialize($SIZE)
+          - pattern: KeyPairGenerator.getInstance("EC").initialize($SIZE, $RANDOM)
+          - pattern: KeyPairGenerator.getInstance("ECDSA").initialize($SIZE)
+      - metavariable-comparison:
+          metavariable: $SIZE
+          comparison: $SIZE < 256
+    metadata:
+      cwe: "CWE-326: Inadequate Encryption Strength"
+      owasp-mobile: "M5: Insufficient Cryptography"
+      masvs: "MASVS-CRYPTO-1"
+      category: android-crypto
+      precision: high
+      confidence: high
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/326.html
+
+  - id: zm-android-aes-key-less-than-128
+    severity: CRITICAL
+    message: |
+      Detected AES/SecretKeySpec with key length less than 128 bits.
+      AES minimum security strength is 128 bits. Shorter keys are trivially brute-forceable.
+      Remediation: Use at least 128-bit keys. For long-term security, prefer AES-256.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: KeyGenerator.getInstance("AES").init($SIZE)
+          - pattern: KeyGenerator.getInstance("AES").init($SIZE, $RANDOM)
+      - metavariable-comparison:
+          metavariable: $SIZE
+          comparison: $SIZE < 128
+    metadata:
+      cwe: "CWE-326: Inadequate Encryption Strength"
+      owasp-mobile: "M5: Insufficient Cryptography"
+      masvs: "MASVS-CRYPTO-1"
+      category: android-crypto
+      precision: high
+      confidence: high
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/326.html
+
+  - id: zm-android-secure-random-weak-seed
+    severity: MEDIUM
+    message: |
+      Detected SecureRandom seeded with a predictable or static value.
+      Using a fixed seed (e.g., system time, hardcoded byte array) makes the RNG output predictable,
+      compromising any cryptographic operations that depend on it.
+      Remediation: Use new SecureRandom() without a seed; Android's SecureRandom is automatically seeded from /dev/urandom.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: $SR.setSeed($SEED)
+    metadata:
+      cwe: "CWE-326: Inadequate Encryption Strength"
+      owasp-mobile: "M5: Insufficient Cryptography"
+      masvs: "MASVS-CRYPTO-1"
+      category: android-crypto
+      precision: medium
+      confidence: medium
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/326.html

package/rules/android/mobile-cwe-327-rc4-3des.yaml

@@ -0,0 +1,107 @@
+# CWE-327: Broken/Risky Cryptographic Algorithm (RC4, 3DES, Blowfish)
+# ZhuMa V4.0 - Android Rule Library
+# Source: ZhuMa V4.1 Rule Expansion - legacy cipher detection
+
+rules:
+  - id: zm-android-rc4-cipher
+    severity: HIGH
+    message: |
+      Detected RC4 (ARCFOUR) cipher usage. RC4 has known statistical biases allowing plaintext recovery
+      from ciphertext after observing sufficient encrypted traffic.
+      RC4 is prohibited by RFC 7465 and should never be used.
+      Remediation: Replace RC4 with AES/GCM/NoPadding.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: Cipher.getInstance("RC4")
+          - pattern: Cipher.getInstance("RC4", "$P")
+          - pattern: Cipher.getInstance("ARCFOUR")
+          - pattern: Cipher.getInstance("ARCFOUR", "$P")
+    metadata:
+      cwe: "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
+      owasp-mobile: "M5: Insufficient Cryptography"
+      masvs: "MASVS-CRYPTO-1"
+      category: android-crypto
+      precision: very-high
+      confidence: very-high
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/327.html
+        - https://datatracker.ietf.org/doc/rfc7465/
+
+  - id: zm-android-3des-cipher
+    severity: MEDIUM
+    message: |
+      Detected 3DES (Triple DES / DESede) cipher usage. 3DES has an effective security of only 112 bits
+      and is vulnerable to Sweet32 birthday attacks when encrypting large amounts of data.
+      3DES is being deprecated by NIST and should be replaced.
+      Remediation: Replace 3DES with AES/GCM/NoPadding (minimum AES-128, prefer AES-256).
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: Cipher.getInstance("DESede")
+          - pattern: Cipher.getInstance("DESede/$MODE/$PAD")
+          - pattern: Cipher.getInstance("DESede", "$P")
+          - pattern: Cipher.getInstance("DESede/$MODE/$PAD", "$P")
+    metadata:
+      cwe: "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
+      owasp-mobile: "M5: Insufficient Cryptography"
+      masvs: "MASVS-CRYPTO-1"
+      category: android-crypto
+      precision: very-high
+      confidence: very-high
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/327.html
+        - https://sweet32.info/
+
+  - id: zm-android-blowfish-cipher
+    severity: MEDIUM
+    message: |
+      Detected Blowfish cipher usage. Blowfish has a 64-bit block size, making it vulnerable to
+      Sweet32-style birthday attacks (same class as 3DES) after ~4GB of encrypted data.
+      Remediation: Replace Blowfish with AES/GCM/NoPadding or another 128-bit block cipher.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: Cipher.getInstance("Blowfish")
+          - pattern: Cipher.getInstance("Blowfish/$MODE/$PAD")
+          - pattern: Cipher.getInstance("Blowfish", "$P")
+          - pattern: Cipher.getInstance("Blowfish/$MODE/$PAD", "$P")
+    metadata:
+      cwe: "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
+      owasp-mobile: "M5: Insufficient Cryptography"
+      masvs: "MASVS-CRYPTO-1"
+      category: android-crypto
+      precision: very-high
+      confidence: very-high
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/327.html
+
+  - id: zm-android-des-single-cipher
+    severity: CRITICAL
+    message: |
+      Detected single DES cipher usage. DES uses a 56-bit key which is trivially brute-forceable
+      and has been broken for decades. Single DES must never be used.
+      Remediation: Replace DES with AES/GCM/NoPadding (minimum 128-bit key).
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: Cipher.getInstance("DES")
+          - pattern: Cipher.getInstance("DES/$MODE/$PAD")
+          - pattern: Cipher.getInstance("DES", "$P")
+    metadata:
+      cwe: "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
+      owasp-mobile: "M5: Insufficient Cryptography"
+      masvs: "MASVS-CRYPTO-1"
+      category: android-crypto
+      precision: very-high
+      confidence: very-high
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/327.html

package/rules/android/mobile-cwe-329-cbc-padding-oracle.yaml

@@ -0,0 +1,76 @@
+# CWE-329: CBC Mode Without Integrity Check (Android)
+# ZhuMa V4.0 - Android Rule Library
+# Source: ZhuMa V4.1 Rule Expansion - padding oracle attack surface
+
+rules:
+  - id: zm-android-cbc-without-mac
+    severity: HIGH
+    message: |
+      Detected AES/CBC cipher mode without HMAC or authenticated encryption.
+      CBC mode alone is vulnerable to padding oracle attacks when used without integrity protection.
+      An attacker can modify ciphertexts and observe decryption error behavior to recover plaintext.
+      Remediation: Use AES/GCM which provides built-in authentication, or apply Encrypt-then-MAC with HMAC-SHA256.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: Cipher.getInstance("AES/CBC/$PADDING")
+          - pattern: Cipher.getInstance("AES/CBC/$PADDING", "$PROVIDER")
+    metadata:
+      cwe: "CWE-329: Generation of Predictable IV with CBC Mode"
+      owasp-mobile: "M5: Insufficient Cryptography"
+      masvs: "MASVS-CRYPTO-1"
+      category: android-crypto
+      precision: very-high
+      confidence: very-high
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/329.html
+        - https://developer.android.com/privacy-and-security/risks/crypto-deprecation
+
+  - id: zm-android-cbc-pkcs5-padding-oracle
+    severity: HIGH
+    message: |
+      Detected AES/CBC/PKCS5Padding (or PKCS7Padding) without MAC verification.
+      PKCS5/PKCS7 padding in CBC mode creates a padding oracle if the server returns different
+      error messages for valid vs invalid padding.
+      Remediation: Use AES/GCM/NoPadding instead of CBC with PKCS padding.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: Cipher.getInstance("AES/CBC/PKCS5Padding")
+          - pattern: Cipher.getInstance("AES/CBC/PKCS5Padding", "$PROVIDER")
+    metadata:
+      cwe: "CWE-329: Generation of Predictable IV with CBC Mode"
+      owasp-mobile: "M5: Insufficient Cryptography"
+      masvs: "MASVS-CRYPTO-1"
+      category: android-crypto
+      precision: very-high
+      confidence: very-high
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/329.html
+
+  - id: zm-android-custom-cipher-decrypt-no-integrity
+    severity: MEDIUM
+    message: |
+      Detected Cipher.doFinal() in decrypt mode without any subsequent MAC/hash verification.
+      Data decrypted without integrity verification is vulnerable to bit-flipping and padding oracle attacks.
+      Remediation: Use authenticated encryption (AES/GCM) or verify an HMAC before decrypting.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: $DECRYPT.init(Cipher.DECRYPT_MODE, $KEY, $IV)
+          - pattern: $DECRYPT.doFinal($DATA)
+    metadata:
+      cwe: "CWE-329: Generation of Predictable IV with CBC Mode"
+      owasp-mobile: "M5: Insufficient Cryptography"
+      masvs: "MASVS-CRYPTO-1"
+      category: android-crypto
+      precision: low
+      confidence: low
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/329.html

package/rules/android/mobile-cwe-470-reflection-injection.yaml

@@ -0,0 +1,39 @@
+# CWE-470: 反射调用使用不可信类名 (Android)
+# 逐码 ZhuMa V4.0 — Android 规则库
+# 来源: V3 审计引擎 VULN-CE-003
+
+rules:
+  - id: zm-android-reflection-untrusted-classname
+    severity: HIGH
+    message: |
+      检测到 Class.forName() 使用可能来自用户输入的类名。
+      攻击者可通过 JS Bridge / Deeplink / Intent Extra 传入恶意类名，
+      利用反射实例化任意类，可能导致代码执行或安全绕过。
+      修复: 使用白名单映射限制允许的类名；绝不从外部输入直接获取类名。
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: |
+              Class.forName($INPUT)
+          - pattern: |
+              Class.forName($INPUT, $INIT, $LOADER)
+      - pattern-either:
+          - pattern-regex: 'getString'
+          - pattern-regex: 'getIntent'
+          - pattern-regex: 'getParam'
+          - pattern-regex: 'getQuery'
+          - pattern-regex: 'getData'
+          - pattern-regex: 'getExtras'
+    metadata:
+      cwe: "CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')"
+      owasp-mobile: "M8: Code Tampering"
+      masvs: "MASVS-CODE-4"
+      category: android-code-execution
+      precision: medium
+      confidence: medium
+      likelihood: medium
+      impact: high
+      source: "V3 Audit Engine - VULN-CE-003"
+      references:
+        - https://cwe.mitre.org/data/definitions/470.html