@zhuma4/cli 4.0.0-alpha.1

package/rules/android/mobile-cwe-489-root-detection-weak.yaml

@@ -0,0 +1,125 @@
+# CWE-489: Weak Root Detection and Anti-Tamper Patterns (Android)
+# ZhuMa V4.0 - Android Rule Library
+# Source: ZhuMa V4.1 Rule Expansion - root detection and integrity gaps
+
+rules:
+  - id: zm-android-weak-root-detection
+    severity: MEDIUM
+    message: |
+      Detected weak root detection pattern that only checks for common 'su' binary paths 
+      or Superuser.apk existence. These checks are trivially bypassed by Magisk, KernelSU, 
+      or APatch which can hide su and mount custom paths.
+      Remediation: Use multiple detection methods: check system properties (ro.debuggable, ro.secure),
+      check for magisk binaries, verify bootloader status, check for test-keys build, 
+      and use SafetyNet/Play Integrity as an additional signal.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: |
+              new File("/system/app/Superuser.apk").exists()
+          - pattern: |
+              new File("/system/bin/su").exists()
+          - pattern: |
+              new File("/sbin/su").exists()
+          - pattern: |
+              new File("/system/xbin/su").exists()
+          - pattern: |
+              new File("/data/local/xbin/su").exists()
+          - pattern: |
+              new File("/data/local/bin/su").exists()
+          - pattern: |
+              new File("/vendor/bin/su").exists()
+          - pattern: |
+              new File("/system/sd/xbin/su").exists()
+    metadata:
+      cwe: "CWE-489: Active Debug Code / Leftover Debug Code"
+      owasp-mobile: "M8: Code Tampering"
+      masvs: "MASVS-RESILIENCE-1"
+      category: android-anti-tamper
+      precision: very-high
+      confidence: very-high
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/489.html
+        - https://developer.android.com/privacy-and-security/risks/root-detection
+
+  - id: zm-android-root-check-exec-su
+    severity: MEDIUM
+    message: |
+      Detected Runtime.exec("su") or ProcessBuilder("su") for root detection.
+      Executing 'su' on a rooted device triggers a Superuser prompt, alerting the user 
+      that the app is performing root detection. Modern root solutions can also intercept this.
+      Remediation: Use passive detection methods that do not trigger shell execution or user prompts.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: Runtime.getRuntime().exec("su")
+          - pattern: Runtime.getRuntime().exec("su -c")
+          - pattern: Runtime.getRuntime().exec(new String[] {"su", "-c", "$CMD"})
+          - pattern: $RT.exec("su")
+    metadata:
+      cwe: "CWE-489: Active Debug Code / Leftover Debug Code"
+      owasp-mobile: "M8: Code Tampering"
+      masvs: "MASVS-RESILIENCE-1"
+      category: android-anti-tamper
+      precision: high
+      confidence: high
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/489.html
+
+  - id: zm-android-root-beer-library-check
+    severity: INFO
+    message: |
+      Detected RootBeer library usage for root detection.
+      RootBeer uses well-known detection methods that are specifically targeted by MagiskHide 
+      and other root-hiding frameworks. Consider supplementing with additional techniques.
+      Remediation: Combine RootBeer with native checks (TracerPid, proc maps), Play Integrity API, 
+      and obfuscated detection logic.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: RootBeer($CTX).isRooted()
+          - pattern: new RootBeer($CTX).isRooted()
+          - pattern: new com.scottyab.rootbeer.RootBeer($CTX).isRooted()
+    metadata:
+      cwe: "CWE-489: Active Debug Code / Leftover Debug Code"
+      owasp-mobile: "M8: Code Tampering"
+      masvs: "MASVS-RESILIENCE-1"
+      category: android-anti-tamper
+      precision: very-high
+      confidence: very-high
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/489.html
+
+  - id: zm-android-emulator-detection-only
+    severity: LOW
+    message: |
+      Detected emulator detection using Build.FINGERPRINT or Build.MODEL checks only.
+      These checks are easily spoofed by modifying system properties.
+      Remediation: Use hardware-backed attestation (KeyStore with TEE attestation) for stronger checks.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: $BUILD_FINGERPRINT.contains("generic")
+          - pattern: $BUILD_FINGERPRINT.contains("sdk")
+          - pattern: Build.FINGERPRINT.startsWith("generic")
+          - pattern: Build.MODEL.contains("google_sdk")
+          - pattern: Build.MODEL.contains("Emulator")
+          - pattern: Build.MODEL.contains("Android SDK")
+          - pattern: Build.MANUFACTURER.contains("Genymotion")
+    metadata:
+      cwe: "CWE-489: Active Debug Code / Leftover Debug Code"
+      owasp-mobile: "M8: Code Tampering"
+      masvs: "MASVS-RESILIENCE-2"
+      category: android-anti-tamper
+      precision: high
+      confidence: high
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/489.html

package/rules/android/mobile-cwe-489-stetho-debug.yaml

@@ -0,0 +1,107 @@
+# CWE-489: Debug Bridge Detection - Stetho / Flipper / Debug Tools in Release (Android)
+# ZhuMa V4.0 - Android Rule Library
+# Source: ZhuMa V4.1 Rule Expansion - debug tool leakage
+
+rules:
+  - id: zm-android-stetho-debug-bridge
+    severity: MEDIUM
+    message: |
+      Detected Facebook Stetho initialization. Stetho enables Chrome DevTools inspection of the app's 
+      network traffic, databases, and SharedPreferences. If this leaks into a release build, 
+      attackers can attach DevTools and exfiltrate sensitive data.
+      Remediation: Wrap Stetho initialization in a BuildConfig.DEBUG check, or use debugImplementation 
+      dependency scope so it is stripped from release builds.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: Stetho.initializeWithDefaults($CTX)
+          - pattern: Stetho.initialize($INITIALIZER)
+          - pattern: new Stetho.DefaultInspectorModulesBuilder($CTX).build()
+          - pattern: com.facebook.stetho.Stetho.initializeWithDefaults($CTX)
+    metadata:
+      cwe: "CWE-489: Active Debug Code / Leftover Debug Code"
+      owasp-mobile: "M8: Code Tampering"
+      masvs: "MASVS-RESILIENCE-2"
+      category: android-debug
+      precision: very-high
+      confidence: very-high
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/489.html
+        - https://facebook.github.io/stetho/
+
+  - id: zm-android-flipper-debug-bridge
+    severity: MEDIUM
+    message: |
+      Detected Facebook Flipper debug bridge initialization. Flipper provides a desktop debugging 
+      interface for inspecting network traffic, databases, and app state. In release builds, 
+      this creates a data exfiltration surface.
+      Remediation: Use debugImplementation for Flipper dependencies and guard initialization with BuildConfig.DEBUG.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: SoLoader.init($CTX, false)
+          - pattern: Flipper.init($CTX, $CONFIG)
+          - pattern: com.facebook.flipper.android.Flipper.init($CTX, $CONFIG)
+          - pattern: new FlipperClient($CTX)
+          - pattern: $CLIENT.addPlugin($PLUGIN)
+    metadata:
+      cwe: "CWE-489: Active Debug Code / Leftover Debug Code"
+      owasp-mobile: "M8: Code Tampering"
+      masvs: "MASVS-RESILIENCE-2"
+      category: android-debug
+      precision: medium
+      confidence: medium
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/489.html
+
+  - id: zm-android-chuck-interceptor-debug
+    severity: MEDIUM
+    message: |
+      Detected Chuck HTTP interceptor initialization. Chuck captures all HTTP traffic and 
+      exposes it through a notification-based UI. Leaving this in release builds leaks all 
+      API requests, responses, tokens, and credentials to anyone with physical access.
+      Remediation: Use debugImplementation for Chuck and guard with BuildConfig.DEBUG.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: new ChuckInterceptor($CTX)
+          - pattern: com.readystatesoftware.chuck.ChuckInterceptor($CTX)
+    metadata:
+      cwe: "CWE-489: Active Debug Code / Leftover Debug Code"
+      owasp-mobile: "M8: Code Tampering"
+      masvs: "MASVS-RESILIENCE-2"
+      category: android-debug
+      precision: very-high
+      confidence: very-high
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/489.html
+
+  - id: zm-android-leakcanary-debug
+    severity: LOW
+    message: |
+      Detected LeakCanary memory leak detector initialization in potential release code.
+      LeakCanary adds a launcher icon and notification in debug builds, which is a 
+      signal that the app is debuggable or has debug code.
+      Remediation: Use debugImplementation for LeakCanary dependency.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: LeakCanary.install($APP)
+          - pattern: com.squareup.leakcanary.LeakCanary.install($APP)
+    metadata:
+      cwe: "CWE-489: Active Debug Code / Leftover Debug Code"
+      owasp-mobile: "M8: Code Tampering"
+      masvs: "MASVS-RESILIENCE-2"
+      category: android-debug
+      precision: very-high
+      confidence: very-high
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/489.html

package/rules/android/mobile-cwe-502-insecure-deserialization.yaml

@@ -0,0 +1,76 @@
+# CWE-502: 不安全反序列化 / 序列化注入 (Android)
+# 逐码 ZhuMa V4.0 — Android 规则库
+# 来源: V3 审计引擎 VULN-SE-001 / VULN-SE-002
+
+rules:
+  - id: zm-android-serializable-readobject-intent-extra
+    severity: CRITICAL
+    message: |
+      检测到可序列化对象通过 Intent 传递 + readObject() 自定义实现。
+      这构成反序列化注入攻击面 (CVE-2020-0069 类似)。
+      如果接收方组件为导出组件（exported=true），攻击者可通过构造恶意序列化对象
+      触发 readObject() 中的代码执行 — 在 Android Binder 反序列化过程中即可触发。
+      修复: 禁用 Java 原生 Serializable，改用 Parcelable；
+      或对 readObject() 做严格的类型安全校验和 whitelist。
+    languages:
+      - java
+    patterns:
+      - pattern: |
+          class $CLASS implements Serializable {
+            ...
+            private void readObject(ObjectInputStream $S) {
+              ...
+            }
+            ...
+          }
+      - pattern-inside: |
+          ...
+          $INTENT.putExtra($KEY, $OBJECT);
+          ...
+    metadata:
+      cwe: "CWE-502: Deserialization of Untrusted Data"
+      owasp-mobile: "M8: Code Tampering"
+      masvs: "MASVS-CODE-4"
+      category: android-serialization
+      precision: medium
+      confidence: medium
+      likelihood: medium
+      impact: critical
+      source: "V3 Audit Engine - VULN-SE-001"
+      references:
+        - https://cwe.mitre.org/data/definitions/502.html
+        - https://nvd.nist.gov/vuln/detail/CVE-2020-0069
+
+  - id: zm-android-parcelable-no-instanceof-check
+    severity: HIGH
+    message: |
+      检测到 getParcelableExtra() / getParcelable() 的结果未做 instanceof 检查
+      就直接强制类型转换。攻击者可通过 Intent 注入传递类型不匹配的 Parcelable，
+      导致意外的类型转换或内存布局利用。
+      修复: 提取 Parcelable 后始终先做 instanceof 检查再强制转换。
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: |
+              ($TYPE) $INTENT.getParcelableExtra($KEY)
+          - pattern: |
+              ($TYPE) getIntent().getParcelableExtra($KEY)
+          - pattern: |
+              ($TYPE) $BUNDLE.getParcelable($KEY)
+      - pattern-not: |
+          if ($OBJ instanceof $TYPE) {
+            ...
+            ($TYPE) $INTENT.getParcelableExtra($KEY);
+            ...
+          }
+    metadata:
+      cwe: "CWE-502: Deserialization of Untrusted Data"
+      owasp-mobile: "M8: Code Tampering"
+      masvs: "MASVS-CODE-4"
+      category: android-serialization
+      precision: medium
+      confidence: low
+      source: "V3 Audit Engine - VULN-SE-002"
+      references:
+        - https://developer.android.com/reference/android/os/Bundle#getParcelable(java.lang.String,%20java.lang.Class%3CT%3E)

package/rules/android/mobile-cwe-552-world-readable-files.yaml

@@ -0,0 +1,63 @@
+# CWE-552: 文件全局可读 (Android)
+# 逐码 ZhuMa V4.0 — Android 规则库
+# 来源: V3 审计引擎 VULN-FD-002
+
+rules:
+  - id: zm-android-world-readable-writable
+    severity: HIGH
+    message: |
+      检测到使用已废弃的 MODE_WORLD_READABLE 或 MODE_WORLD_WRITEABLE 文件模式。
+      这使得任何 APP 都可以读取/写入该文件，导致敏感数据泄露或配置篡改。
+      Android 7.0+ 已完全禁止此模式（将抛出 SecurityException）。
+      修复: 使用 Context.MODE_PRIVATE；跨进程共享数据使用 ContentProvider。
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: |
+              $CTX.openFileOutput($NAME, Context.MODE_WORLD_READABLE)
+          - pattern: |
+              $CTX.openFileOutput($NAME, Context.MODE_WORLD_WRITEABLE)
+          - pattern: |
+              getSharedPreferences($NAME, Context.MODE_WORLD_READABLE)
+          - pattern: |
+              getSharedPreferences($NAME, Context.MODE_WORLD_WRITEABLE)
+    metadata:
+      cwe: "CWE-552: Files or Directories Accessible to External Parties"
+      owasp-mobile: "M8: Security Decisions Via Untrusted Inputs"
+      masvs: "MASVS-STORAGE-2"
+      category: android-storage
+      precision: very-high
+      confidence: very-high
+      likelihood: medium
+      impact: high
+      source: "V3 Audit Engine - VULN-FD-002"
+      references:
+        - https://developer.android.com/reference/android/content/Context#MODE_WORLD_READABLE
+        - https://developer.android.com/privacy-and-security/risks/world-readable
+
+  - id: zm-android-world-readable-sharedpref
+    severity: HIGH
+    message: |
+      检测到已废弃的 MODE_MULTI_PROCESS SharedPreferences 模式。
+      多进程同时写入 SP 可能导致 XML 损坏、安全配置回退到不安全默认值。
+      修复: 跨进程数据共享使用 ContentProvider 或 DataStore。
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: |
+              $CTX.getSharedPreferences($NAME, Context.MODE_MULTI_PROCESS)
+          - pattern: |
+              getSharedPreferences($NAME, Context.MODE_MULTI_PROCESS)
+    metadata:
+      cwe: "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition"
+      owasp-mobile: "M8: Security Decisions Via Untrusted Inputs"
+      masvs: "MASVS-STORAGE-2"
+      category: android-storage
+      precision: very-high
+      confidence: very-high
+      source: "V3 Audit Engine - VULN-TOCTOU-002"
+      references:
+        - https://developer.android.com/reference/android/content/Context#MODE_MULTI_PROCESS
+        - https://developer.android.com/topic/libraries/architecture/datastore

package/rules/android/mobile-cwe-749-webview-java-objects.yaml

@@ -0,0 +1,78 @@
+# CWE-749: WebView addJavascriptInterface Without Annotation (Android)
+# ZhuMa V4.0 - Android Rule Library
+# Source: ZhuMa V4.1 Rule Expansion - JSBridge hardening
+
+rules:
+  - id: zm-android-addjavascriptinterface-no-annotation
+    severity: HIGH
+    message: |
+      Detected addJavascriptInterface() exposing an object whose methods lack @JavascriptInterface annotation.
+      On API < 17 (Android 4.2), all public methods are exposed. On API >= 17, only annotated methods 
+      are exposed. However, the exposed object may inadvertently inherit dangerous methods 
+      (e.g., getClass() leading to Runtime.exec() via reflection) if not carefully restricted.
+      Remediation: Ensure all exposed methods have @JavascriptInterface annotation. 
+      Restrict the interface to minimal required methods. Consider message-passing patterns instead.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: $WV.addJavascriptInterface($OBJ, "$NAME")
+    metadata:
+      cwe: "CWE-749: Exposed Dangerous Method or Function"
+      owasp-mobile: "M1: Improper Platform Usage"
+      masvs: "MASVS-PLATFORM-2"
+      category: android-webview
+      precision: medium
+      confidence: medium
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/749.html
+        - https://developer.android.com/privacy-and-security/risks/webview-addjavascriptinterface
+
+  - id: zm-android-javascriptinterface-exposed-getclass
+    severity: CRITICAL
+    message: |
+      Detected a class used with addJavascriptInterface() that has a method returning Class or Method objects.
+      JavaScript can traverse getClass() to access Runtime.getRuntime().exec(), achieving RCE in the app context.
+      This is the classic WebView RCE attack (CVE-2012-6636 and variants).
+      Remediation: Never expose objects with reflection-capable methods. Filter exposed methods carefully.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: addJavascriptInterface($OBJ, "$NAME")
+    metadata:
+      cwe: "CWE-749: Exposed Dangerous Method or Function"
+      owasp-mobile: "M1: Improper Platform Usage"
+      masvs: "MASVS-PLATFORM-2"
+      category: android-webview
+      precision: low
+      confidence: low
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/749.html
+        - https://labs.f-secure.com/archive/webview-addjavascriptinterface-remote-code-execution/
+
+  - id: zm-android-javascriptinterface-annotation-check
+    severity: MEDIUM
+    message: |
+      Detected a class potentially exposed via addJavascriptInterface.
+      Review that all public methods accessible from JavaScript have @android.webkit.JavascriptInterface annotation
+      and do not expose dangerous functionality (file I/O, reflection, command execution).
+    languages:
+      - generic
+    patterns:
+      - pattern-either:
+          - pattern: |
+              $CLASS implements JavascriptInterface
+          - pattern: $CLASS extends JavascriptInterface
+    metadata:
+      cwe: "CWE-749: Exposed Dangerous Method or Function"
+      owasp-mobile: "M1: Improper Platform Usage"
+      masvs: "MASVS-PLATFORM-2"
+      category: android-webview
+      precision: low
+      confidence: low
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/749.html

package/rules/android/mobile-cwe-749-webview-jsbridge.yaml

@@ -0,0 +1,57 @@
+# CWE-749: WebView JS Bridge 暴露危险方法 (Android)
+# 逐码 ZhuMa V4.0 — Android 规则库
+# 来源: V3 审计引擎 VULN-WV-002 / VULN-WV-003
+
+rules:
+  - id: zm-android-webview-jsbridge-with-addjavascriptinterface
+    severity: CRITICAL
+    message: |
+      检测到 WebView 使用 addJavascriptInterface() 暴露 Java 对象给 JavaScript。
+      如果暴露的对象包含危险方法（如 Runtime.exec、反射调用、文件操作），
+      攻击者可通过构造恶意 HTML 或 XSS 实现远程代码执行 (RCE)。
+      本规则检测到 JS Bridge 已启用 + 暴露类中包含危险方法签名。
+      修复: 移除 addJavascriptInterface() 中对敏感 API 的直接暴露；
+      使用 postMessage / evaluateJavascript 消息通道替代。
+    languages:
+      - java
+    patterns:
+      - pattern: |
+          $WV.addJavascriptInterface($OBJ, $NAME);
+    metavariable-regex:
+      metavariable: $DANGEROUS
+      regex: '(?i)(Runtime\.exec|ProcessBuilder|Class\.forName|Method\.invoke|openOrCreateDatabase|getSharedPreferences|startActivity|sendTextMessage)'
+    metadata:
+      cwe: "CWE-749: Exposed Dangerous Method or Function"
+      owasp-mobile: "M7: Client Code Quality"
+      masvs: "MASVS-PLATFORM-2"
+      category: android-webview
+      precision: medium
+      confidence: medium
+      likelihood: critical
+      impact: critical
+      source: "V3 Audit Engine - VULN-WV-002"
+      references:
+        - https://developer.android.com/privacy-and-security/risks/webview-javascript-interface
+        - https://labs.mwrinfosecurity.com/blog/2014/02/12/webview-addjavascriptinterface-remote-code-execution/
+
+  - id: zm-android-webview-jsbridge-enabled
+    severity: WARNING
+    message: |
+      检测到 addJavascriptInterface() 调用。
+      需人工审计暴露给 JavaScript 的 Java 对象中是否包含危险方法（文件操作、命令执行、反射等）。
+      如果 JS Bridge 非业务必需，建议完全移除。
+    languages:
+      - java
+    patterns:
+      - pattern: |
+          $WV.addJavascriptInterface($OBJ, $NAME)
+    metadata:
+      cwe: "CWE-749: Exposed Dangerous Method or Function"
+      owasp-mobile: "M7: Client Code Quality"
+      masvs: "MASVS-PLATFORM-2"
+      category: android-webview
+      precision: very-high
+      confidence: low
+      source: "V3 Audit Engine - VULN-WV-003"
+      references:
+        - https://developer.android.com/privacy-and-security/risks/webview-javascript-interface

package/rules/android/mobile-cwe-749-webview-loadurl-injection.yaml

@@ -0,0 +1,80 @@
+# CWE-749 and CWE-79: WebView Advanced Injection Attacks (Android)
+# ZhuMa V4.0 - Android Rule Library
+# Source: ZhuMa V4.1 Rule Expansion - WebView injection surface
+
+rules:
+  - id: zm-android-webview-loadurl-untrusted-input
+    severity: HIGH
+    message: |
+      Detected WebView.loadUrl() with a URL built from untrusted input (Intent extras, URI query params, 
+      EditText content). This enables URL injection: an attacker can load javascript: URLs to execute 
+      arbitrary code in the WebView context, or redirect to phishing pages.
+      Remediation: Validate URLs against a whitelist of allowed domains. Never pass user-controlled 
+      strings directly to loadUrl(). Use a strict allowlist for schemes (https only) and hosts.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: |
+              $WV.loadUrl($INPUT)
+    metadata:
+      cwe: "CWE-749: Exposed Dangerous Method or Function"
+      owasp-mobile: "M1: Improper Platform Usage"
+      masvs: "MASVS-PLATFORM-2"
+      category: android-webview
+      precision: low
+      confidence: low
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/749.html
+        - https://developer.android.com/privacy-and-security/risks/webview-url-loading
+
+  - id: zm-android-webview-loadurl-getstringextra
+    severity: HIGH
+    message: |
+      Detected WebView.loadUrl() with untrusted input from Intent.getStringExtra().
+      This is a common deeplink-to-WebView injection path: an attacker sends an Intent with a malicious 
+      URL, which the app loads directly into a WebView without validation.
+      Remediation: Validate the URL scheme (must be https://), host (against whitelist), and path.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: |
+              $WV.loadUrl(getIntent().getStringExtra("$KEY"))
+    metadata:
+      cwe: "CWE-749: Exposed Dangerous Method or Function"
+      owasp-mobile: "M1: Improper Platform Usage"
+      masvs: "MASVS-PLATFORM-2"
+      category: android-webview
+      precision: high
+      confidence: high
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/749.html
+
+  - id: zm-android-webview-loadurl-javascript-scheme
+    severity: CRITICAL
+    message: |
+      Detected WebView.loadUrl() with a "javascript:" scheme URL with dynamic content.
+      Javascript URLs can execute arbitrary code in the WebView context, including accessing 
+      cookies, localStorage, and JavaScript interfaces. Combined with untrusted input, this enables XSS.
+      Remediation: Never use "javascript:" URLs in loadUrl(). Use evaluateJavascript() for controlled JS execution.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: |
+              $WV.loadUrl("javascript:" + $SCRIPT)
+          - pattern: |
+              $WV.loadUrl(String.format("javascript:%s", $SCRIPT))
+    metadata:
+      cwe: "CWE-79: Improper Neutralization of Input During Web Page Generation"
+      owasp-mobile: "M1: Improper Platform Usage"
+      masvs: "MASVS-PLATFORM-2"
+      category: android-webview
+      precision: very-high
+      confidence: very-high
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/79.html

package/rules/android/mobile-cwe-78-command-injection.yaml

@@ -0,0 +1,77 @@
+# CWE-78: 命令注入 (Android)
+# 逐码 ZhuMa V4.0 — Android 规则库
+# 来源: V3 审计引擎 VULN-CE-001 / VULN-CE-002
+
+rules:
+  - id: zm-android-runtime-exec-variable-concat
+    severity: CRITICAL
+    message: |
+      检测到 Runtime.exec() 或 ProcessBuilder 使用变量拼接构造命令。
+      如果输入来自用户可控来源（Intent Extra、网络输入、Deeplink 参数），
+      攻击者可注入恶意命令实现远程代码执行 (RCE)。
+      Android 应用场景中常见于: 文件操作、视频处理、PDF 生成等 JNI/Shell 桥接代码。
+      修复: 绝不在 Android 中使用 Runtime.exec() 执行 Shell 命令；使用 Android API 替代；
+      如果必须使用 exec()，只能用 String[] 数组形式 + 硬编码参数，绝不拼接用户输入。
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: |
+              Runtime.getRuntime().exec($CMD + $PARAM)
+          - pattern: |
+              Runtime.getRuntime().exec($CMD + $PARAM + $PARAM2)
+          - pattern: |
+              new ProcessBuilder($CMD + $PARAM)
+          - pattern: |
+              $PB = new ProcessBuilder($CMD + $PARAM)
+      - pattern-either:
+          - pattern-regex: 'getString'
+          - pattern-regex: 'getIntent'
+          - pattern-regex: 'getData'
+          - pattern-regex: 'getQuery'
+          - pattern-regex: 'getParam'
+          - pattern-regex: 'getExtras'
+    metadata:
+      cwe: "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
+      owasp-mobile: "M8: Code Tampering"
+      masvs: "MASVS-CODE-4"
+      category: android-code-execution
+      precision: medium
+      confidence: medium
+      likelihood: medium
+      impact: critical
+      source: "V3 Audit Engine - VULN-CE-001"
+      references:
+        - https://cwe.mitre.org/data/definitions/78.html
+        - https://developer.android.com/privacy-and-security/risks/process-execution
+
+  - id: zm-android-runtime-exec-present
+    severity: WARNING
+    message: |
+      检测到 Runtime.exec() 调用，需确认所有参数均为硬编码常量而非用户输入。
+      如果参数中任何部分来自 Intent Extra、网络数据、Deeplink 等不可信来源，
+      则存在命令注入风险。
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: |
+              Runtime.getRuntime().exec(...)
+          - pattern: |
+              new ProcessBuilder(...)
+      - pattern-not-inside: |
+          if (BuildConfig.DEBUG) {
+            ...
+            Runtime.getRuntime().exec(...);
+            ...
+          }
+    metadata:
+      cwe: "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
+      owasp-mobile: "M8: Code Tampering"
+      masvs: "MASVS-CODE-4"
+      category: android-code-execution
+      precision: very-high
+      confidence: low
+      source: "V3 Audit Engine - VULN-CE-002"
+      references:
+        - https://cwe.mitre.org/data/definitions/78.html