@zhuma4/cli 4.0.0-alpha.1

package/rules/android/mobile-cwe-780-rsa-no-oaep.yaml

@@ -0,0 +1,80 @@
+# CWE-780: RSA Without OAEP Padding (Android)
+# ZhuMa V4.0 - Android Rule Library
+# Source: ZhuMa V4.1 Rule Expansion - asymmetric crypto gaps
+
+rules:
+  - id: zm-android-rsa-no-oaep
+    severity: HIGH
+    message: |
+      Detected RSA cipher without OAEP padding. RSA with PKCS1Padding is vulnerable to
+      padding oracle attacks (Bleichenbacher / ROBOT attack), allowing an attacker to decrypt
+      ciphertexts by observing server error responses.
+      Remediation: Use "RSA/ECB/OAEPWithSHA-256AndMGF1Padding" or "RSA/ECB/OAEPWithSHA-512AndMGF1Padding".
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: Cipher.getInstance("RSA/ECB/PKCS1Padding")
+          - pattern: Cipher.getInstance("RSA/ECB/PKCS1Padding", "$P")
+          - pattern: Cipher.getInstance("RSA")
+          - pattern: Cipher.getInstance("RSA", "$P")
+    metadata:
+      cwe: "CWE-780: Use of RSA Algorithm without OAEP"
+      owasp-mobile: "M5: Insufficient Cryptography"
+      masvs: "MASVS-CRYPTO-1"
+      category: android-crypto
+      precision: very-high
+      confidence: very-high
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/780.html
+        - https://developer.android.com/privacy-and-security/risks/crypto-deprecation
+
+  - id: zm-android-rsa-encrypt-pkcs1
+    severity: HIGH
+    message: |
+      Detected Cipher with RSA and "PKCS1Padding" used in ENCRYPT_MODE.
+      RSA PKCS1 v1.5 encryption is vulnerable to Bleichenbacher's chosen-ciphertext attack.
+      Remediation: Use OAEP padding (OAEPWithSHA-256AndMGF1Padding) for RSA encryption.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: Cipher.getInstance("RSA/ECB/PKCS1Padding")
+          - pattern: $CIPHER.init(Cipher.ENCRYPT_MODE, $KEY)
+    metadata:
+      cwe: "CWE-780: Use of RSA Algorithm without OAEP"
+      owasp-mobile: "M5: Insufficient Cryptography"
+      masvs: "MASVS-CRYPTO-1"
+      category: android-crypto
+      precision: high
+      confidence: high
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/780.html
+
+  - id: zm-android-rsa-nowrap-mode
+    severity: LOW
+    message: |
+      Detected RSA cipher used in NoPadding mode. While sometimes intentional (e.g., for custom protocols),
+      raw RSA without padding should be carefully reviewed to ensure it is not used for direct encryption.
+      Raw RSA operations without padding are mathematically deterministic and vulnerable to attack.
+      Remediation: Verify this usage is intentional and reviewed by a crypto expert.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: Cipher.getInstance("RSA/ECB/NoPadding")
+          - pattern: Cipher.getInstance("RSA/ECB/NoPadding", "$P")
+          - pattern: Cipher.getInstance("RSA/None/NoPadding")
+          - pattern: Cipher.getInstance("RSA/None/NoPadding", "$P")
+    metadata:
+      cwe: "CWE-780: Use of RSA Algorithm without OAEP"
+      owasp-mobile: "M5: Insufficient Cryptography"
+      masvs: "MASVS-CRYPTO-1"
+      category: android-crypto
+      precision: very-high
+      confidence: very-high
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/780.html

package/rules/android/mobile-cwe-79-webview-setdata.yaml

@@ -0,0 +1,78 @@
+# CWE-79 and CWE-749: WebView loadData / loadDataWithBaseURL Security (Android)
+# ZhuMa V4.0 - Android Rule Library
+# Source: ZhuMa V4.1 Rule Expansion - WebView data loading attacks
+
+rules:
+  - id: zm-android-loaddata-null-baseurl
+    severity: MEDIUM
+    message: |
+      Detected loadDataWithBaseURL() with null baseURL and untrusted content.
+      When baseURL is null, the WebView cannot resolve relative URLs and Same-Origin Policy is weakened.
+      This can be exploited to access file:// resources or bypass CORS restrictions.
+      Remediation: Always provide a valid, trusted baseURL (e.g., "https://trusted.example.com").
+      Use loadData() for simple HTML without external resources.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: $WV.loadDataWithBaseURL(null, $DATA, $MIME, $ENC, null)
+          - pattern: $WV.loadDataWithBaseURL(null, $DATA, $MIME, $ENC, $HIST)
+    metadata:
+      cwe: "CWE-79: Improper Neutralization of Input During Web Page Generation"
+      owasp-mobile: "M1: Improper Platform Usage"
+      masvs: "MASVS-PLATFORM-2"
+      category: android-webview
+      precision: high
+      confidence: high
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/79.html
+        - https://developer.android.com/reference/android/webkit/WebView
+
+  - id: zm-android-loaddata-file-baseurl
+    severity: HIGH
+    message: |
+      Detected loadDataWithBaseURL() using "file://" as the base URL.
+      A file:// base URL allows loaded content to access local files on the device 
+      via XMLHttpRequest or iframe, leading to local file disclosure.
+      Remediation: Use an https:// base URL from a trusted domain. Never use file:// as base URL.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: $WV.loadDataWithBaseURL("file://", $DATA, $MIME, $ENC, $HIST)
+          - pattern: $WV.loadDataWithBaseURL("file:///", $DATA, $MIME, $ENC, $HIST)
+          - pattern: $WV.loadDataWithBaseURL("file:///android_asset/", $DATA, $MIME, $ENC, $HIST)
+    metadata:
+      cwe: "CWE-749: Exposed Dangerous Method or Function"
+      owasp-mobile: "M1: Improper Platform Usage"
+      masvs: "MASVS-PLATFORM-2"
+      category: android-webview
+      precision: very-high
+      confidence: very-high
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/749.html
+
+  - id: zm-android-loadurl-file-scheme
+    severity: HIGH
+    message: |
+      Detected WebView.loadUrl() with "file://" scheme, which can load local files into WebView.
+      If combined with untrusted content or JavaScript enabled, this can expose local app data.
+      Remediation: Disable file access with setAllowFileAccess(false) and use https:// URLs only.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: $WV.loadUrl("file://" + $PATH)
+          - pattern: $WV.loadUrl("file:///" + $PATH)
+    metadata:
+      cwe: "CWE-749: Exposed Dangerous Method or Function"
+      owasp-mobile: "M1: Improper Platform Usage"
+      masvs: "MASVS-PLATFORM-2"
+      category: android-webview
+      precision: high
+      confidence: high
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/749.html

package/rules/android/mobile-cwe-79-webview-xss.yaml

@@ -0,0 +1,65 @@
+# CWE-79: WebView 动态 URL + JS 启用 — XSS/URL 注入 (Android)
+# 逐码 ZhuMa V4.0 — Android 规则库
+# 来源: V3 审计引擎 VULN-WV-004
+
+rules:
+  - id: zm-android-webview-dynamic-url-js-enabled
+    severity: HIGH
+    message: |
+      检测到 WebView 使用来自 Intent/网络的数据构造 URL 且 JavaScript 已启用。
+      攻击者可通过 Deeplink 传入恶意 URL（如 javascript: 协议或恶意站点），
+      结合已启用的 JS 执行实现 XSS、Token 窃取甚至升级为 RCE。
+      修复:
+      1. 实施 URL 白名单（仅允许可信域名）
+      2. 仅允许 HTTPS 协议
+      3. 实施 Content Security Policy
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: |
+              $WV.loadUrl($INTENT.getStringExtra($KEY))
+          - pattern: |
+              $WV.loadUrl($URI.toString())
+          - pattern: |
+              $WV.loadUrl($BUNDLE.getString($KEY))
+    metadata:
+      cwe: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+      owasp-mobile: "M7: Client Code Quality"
+      masvs: "MASVS-PLATFORM-2"
+      category: android-webview
+      precision: medium
+      confidence: medium
+      likelihood: medium
+      impact: high
+      source: "V3 Audit Engine - VULN-WV-004"
+      references:
+        - https://developer.android.com/privacy-and-security/risks/webview-cross-site-scripting
+
+  - id: zm-android-webview-shouldoverrideurlloading-bypass
+    severity: HIGH
+    message: |
+      检测到 shouldOverrideUrlLoading() 返回 false，未阻断可疑 URL 加载。
+      攻击者可通过 URL 重定向链绕过 HTTP-only 白名单:
+      https://safe.com → 302 → intent:// → Intent Scheme攻击 → 启动任意组件
+      https://safe.com → 302 → javascript: → XSS → Token 窃取
+      修复: 对所有非 HTTPS/non-whitelist URL 返回 true 阻断加载。
+    languages:
+      - java
+    patterns:
+      - pattern: |
+          public boolean shouldOverrideUrlLoading(WebView $WV, String $URL) {
+            ...
+            return false;
+            ...
+          }
+    metadata:
+      cwe: "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"
+      owasp-mobile: "M7: Client Code Quality"
+      masvs: "MASVS-PLATFORM-2"
+      category: android-webview
+      precision: high
+      confidence: high
+      source: "V3 Audit Engine - VULN-WV-009"
+      references:
+        - https://developer.android.com/reference/android/webkit/WebViewClient#shouldOverrideUrlLoading(android.webkit.WebView,%20java.lang.String)

package/rules/android/mobile-cwe-798-hardcoded-credentials.yaml

@@ -0,0 +1,108 @@
+# CWE-798: 硬编码凭据 (Android)
+# 逐码 ZhuMa V4.0 — Android 规则库
+# 来源: V3 审计引擎 all_in_one.js JS scan + audit_rules_v2.py scan_crypto_expanded
+
+rules:
+  - id: zm-android-hardcoded-api-key
+    severity: CRITICAL
+    message: |
+      检测到疑似硬编码 API Key / Token / Secret。
+      硬编码在客户端 APK 中的凭证可通过逆向直接提取，导致 API 认证体系完全失效。
+      修复:
+      1. 密钥从服务端动态下发 (不可写死在客户端)
+      2. 使用 Android Keystore System 存储
+      3. 对请求做签名 + HMAC 而非靠客户端持有密钥
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: |
+              $TYPE $VAR = "$API_KEY";
+          - pattern: |
+              private static final String $VAR = "$API_KEY";
+          - pattern: |
+              public static final String $VAR = "$API_KEY";
+      - metavariable-regex:
+          metavariable: $VAR
+          regex: '(?i)(api[_]?key|app[_]?key|client[_]?secret|app[_]?secret|access[_]?key|secret[_]?key|auth[_]?token)'
+      - metavariable-regex:
+          metavariable: $API_KEY
+          regex: '.{8,100}'
+    metadata:
+      cwe: "CWE-798: Use of Hard-coded Credentials"
+      owasp-mobile: "M8: Code Tampering"
+      masvs: "MASVS-AUTH-1"
+      category: android-credentials
+      precision: medium
+      confidence: medium
+      likelihood: high
+      impact: critical
+      source: "V3 Audit Engine - all_in_one.js credPatterns"
+      references:
+        - https://cwe.mitre.org/data/definitions/798.html
+        - https://developer.android.com/privacy-and-security/risks/hardcoded-credentials
+
+  - id: zm-android-hardcoded-jwt-secret
+    severity: CRITICAL
+    message: |
+      检测到疑似硬编码 JWT Secret / Signing Key。
+      JWT 签名密钥硬编码在客户端意味着任何逆向 APP 的用户都可伪造任意 JWT Token，
+      绕过认证、冒充任意用户。
+      修复: JWT 签名密钥必须由服务端持有，客户端应通过 OAuth 2.0 流程获取 Access Token。
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: |
+              Jwts.parser().setSigningKey("$KEY".getBytes())
+          - pattern: |
+              Jwts.builder().signWith(SignatureAlgorithm.HS256, "$KEY")
+          - pattern: |
+              Jwts.builder().signWith(SignatureAlgorithm.HS256, "$KEY".getBytes())
+      - metavariable-regex:
+          metavariable: $KEY
+          regex: '.{8,}'
+    metadata:
+      cwe: "CWE-798: Use of Hard-coded Credentials"
+      owasp-mobile: "M8: Code Tampering"
+      masvs: "MASVS-AUTH-1"
+      category: android-credentials
+      precision: very-high
+      confidence: very-high
+      source: "V3 Audit Engine - crypto scan"
+      references:
+        - https://cwe.mitre.org/data/definitions/798.html
+        - https://jwt.io/introduction
+
+  - id: zm-android-hardcoded-password
+    severity: CRITICAL
+    message: |
+      检测到疑似硬编码密码字段。
+      密码硬编码在 APP 源码中可直接通过静态分析提取。
+      修复: 密码应通过用户输入获取或使用安全凭证存储机制。
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: |
+              String $VAR = "$PWD";
+          - pattern: |
+              private static final String $VAR = "$PWD";
+          - pattern: |
+              public static final String $VAR = "$PWD";
+      - metavariable-regex:
+          metavariable: $VAR
+          regex: '(?i)(password|passwd|pwd|passcode|pin_code)'
+      - metavariable-regex:
+          metavariable: $PWD
+          regex: '.{6,}'
+    metadata:
+      cwe: "CWE-798: Use of Hard-coded Credentials"
+      owasp-mobile: "M8: Code Tampering"
+      masvs: "MASVS-AUTH-1"
+      category: android-credentials
+      precision: low
+      confidence: low
+      source: "V3 Audit Engine - baseline scan"
+      references:
+        - https://cwe.mitre.org/data/definitions/798.html

package/rules/android/mobile-cwe-89-sql-injection.yaml

@@ -0,0 +1,100 @@
+# CWE-89: SQL 注入 (Android SQLite)
+# 逐码 ZhuMa V4.0 — Android 规则库
+# 来源: V3 审计引擎 VULN-CP-002
+
+rules:
+  - id: zm-android-sqlite-rawquery
+    severity: HIGH
+    message: |
+      检测到 SQLiteDatabase.rawQuery() 使用字符串拼接或 String.format 构造 SQL 查询。
+      如果 where/selection 参数来自用户输入（Intent Extra、ContentProvider query 参数、网络数据），
+      存在 SQL 注入风险，可导致数据泄露或绕过认证。
+      Android 中 SQL 注入常发生在 ContentProvider.query() 实现中的 rawQuery 调用。
+      修复: 使用 query() + selectionArgs 参数化查询；绝对禁止字符串拼接 SQL。
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: |
+              $DB.rawQuery($SQL + $PARAM, ...)
+          - pattern: |
+              $DB.rawQuery(String.format($SQL, $PARAM), ...)
+          - pattern: |
+              $DB.execSQL($SQL + $PARAM)
+    metadata:
+      cwe: "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
+      owasp-mobile: "M1: Improper Platform Usage"
+      masvs: "MASVS-STORAGE-2"
+      category: android-storage
+      precision: medium
+      confidence: medium
+      likelihood: medium
+      impact: high
+      source: "V3 Audit Engine - VULN-CP-002"
+      references:
+        - https://developer.android.com/privacy-and-security/risks/sql-injection
+        - https://developer.android.com/training/data-storage/sqlite
+
+  - id: zm-android-content-provider-rawquery
+    severity: HIGH
+    message: |
+      检测到 ContentProvider 实现中使用 rawQuery() 且无 selectionArgs 参数。
+      ContentProvider 的 query() 方法接收来自任意 APP 的参数，
+      如果直接拼接到 rawQuery() 中则存在严重的 SQL 注入风险。
+      修复: 在 ContentProvider.query() 实现中使用 SQLiteDatabase.query() + selectionArgs。
+    languages:
+      - java
+    patterns:
+      - pattern: |
+          public Cursor query(Uri $URI, ...) {
+            ...
+            $DB.rawQuery($SQL, null);
+            ...
+          }
+    metadata:
+      cwe: "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
+      owasp-mobile: "M1: Improper Platform Usage"
+      masvs: "MASVS-STORAGE-2"
+      category: android-storage
+      precision: high
+      confidence: high
+      source: "V3 Audit Engine - VULN-CP-002"
+      references:
+        - https://developer.android.com/privacy-and-security/risks/sql-injection
+
+  - id: zm-android-content-provider-openfile-path-traversal
+    severity: CRITICAL
+    message: |
+      检测到 ContentProvider.openFile() 实现中使用 getPath() 获取路径但未调用 getCanonicalPath()。
+      攻击者可通过构造 content:// URI 注入路径遍历序列（如 ../../../../ ），
+      读取 APP 私有目录下的任意文件（databases、shared_prefs 等）。
+      著名案例: CVE-2021-0307 (Android SystemUI 路径遍历)
+      修复: 在 openFile() 中先调用 getCanonicalPath()，再校验路径是否在允许的目录前缀内。
+    languages:
+      - java
+    patterns:
+      - pattern: |
+          public ParcelFileDescriptor openFile(Uri $URI, String $MODE) {
+            ...
+            $PATH.getPath();
+            ...
+          }
+      - pattern-not: |
+          public ParcelFileDescriptor openFile(Uri $URI, String $MODE) {
+            ...
+            $PATH.getCanonicalPath();
+            ...
+          }
+    metadata:
+      cwe: "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
+      owasp-mobile: "M8: Code Tampering"
+      masvs: "MASVS-STORAGE-1"
+      category: android-storage
+      precision: medium
+      confidence: medium
+      likelihood: high
+      impact: critical
+      source: "V3 Audit Engine - VULN-CP-001"
+      references:
+        - https://cwe.mitre.org/data/definitions/22.html
+        - https://nvd.nist.gov/vuln/detail/CVE-2021-0307

package/rules/android/mobile-cwe-927-implicit-intent.yaml

@@ -0,0 +1,121 @@
+# CWE-927: 隐式 Intent / 导出组件无权限保护 (Android)
+# 逐码 ZhuMa V4.0 — Android 规则库
+# 来源: V3 审计引擎 VULN-INT-001 / VULN-INT-002 / VULN-PI-001 / VULN-PI-002
+
+rules:
+  - id: zm-android-pendingintent-no-immutable
+    severity: CRITICAL
+    message: |
+      检测到 PendingIntent 未设置 FLAG_IMMUTABLE。
+      Android 12+ (API 31) 强制要求 PendingIntent 显式声明 FLAG_IMMUTABLE 或 FLAG_MUTABLE。
+      缺失此标记的 PendingIntent 可被恶意 APP 篡改 Intent Extras，
+      实现越权操作（如劫持通知栏操作、篡改桌面小部件点击行为）。
+      修复: PendingIntent.getActivity(ctx, 0, intent, PendingIntent.FLAG_IMMUTABLE);
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: |
+              PendingIntent.getActivity($CTX, $RQ, $INTENT, 0)
+          - pattern: |
+              PendingIntent.getBroadcast($CTX, $RQ, $INTENT, 0)
+          - pattern: |
+              PendingIntent.getService($CTX, $RQ, $INTENT, 0)
+          - pattern: |
+              PendingIntent.getForegroundService($CTX, $RQ, $INTENT, 0)
+          - pattern: |
+              PendingIntent.getActivity($CTX, $RQ, $INTENT, PendingIntent.FLAG_UPDATE_CURRENT)
+    metadata:
+      cwe: "CWE-927: Use of Implicit Intent for Sensitive Communication"
+      owasp-mobile: "M2: Insecure Data Storage"
+      masvs: "MASVS-PLATFORM-3"
+      category: android-intent
+      precision: high
+      confidence: high
+      likelihood: high
+      impact: high
+      source: "V3 Audit Engine - VULN-PI-001"
+      references:
+        - https://developer.android.com/guide/components/intents-filters#PendingIntentMutability
+        - https://developer.android.com/about/versions/12/behavior-changes-12#pending-intent-mutability
+
+  - id: zm-android-implicit-pendingintent
+    severity: HIGH
+    message: |
+      检测到使用隐式 Intent 创建 PendingIntent（未指定 setComponent/setClass）。
+      隐式 PendingIntent 可被任意注册了匹配 IntentFilter 的 APP 劫持，
+      导致用户点击后被重定向到恶意 Activity/Service。
+      修复: 在 Intent 上调用 setComponent() 或 setClass() 指定目标组件。
+    languages:
+      - java
+    patterns:
+      - pattern: |
+          $PENDINGINTENT.get$TYPE($CTX, $RQ, new Intent($ACTION), ...)
+    metadata:
+      cwe: "CWE-927: Use of Implicit Intent for Sensitive Communication"
+      owasp-mobile: "M2: Insecure Data Storage"
+      masvs: "MASVS-PLATFORM-3"
+      category: android-intent
+      precision: medium
+      confidence: medium
+      source: "V3 Audit Engine - VULN-PI-002"
+      references:
+        - https://developer.android.com/privacy-and-security/risks/unsafe-intent-resolution
+
+  - id: zm-android-exported-component-no-permission
+    severity: WARNING
+    message: |
+      检测到 Android 组件 (Activity/Service/Receiver/Provider) 导出为 true 但无权限保护。
+      这需要结合 AndroidManifest.xml 分析。Semgrep 在 Java 层检测到组件类可以提醒审计人员检查 Manifest 配置。
+      如果Manifest中 export=true 且无 permission，任何APP都可启动/访问该组件。
+    languages:
+      - java
+    pattern: |
+      class $CLASS extends $COMPONENT {
+        ...
+      }
+    paths:
+      include:
+        - "**/AndroidManifest.xml"
+    metadata:
+      cwe: "CWE-927: Use of Implicit Intent for Sensitive Communication"
+      owasp-mobile: "M2: Insecure Data Storage"
+      masvs: "MASVS-PLATFORM-3"
+      category: android-intent
+      precision: low
+      confidence: low
+      note: |
+        此规则为资讯类提醒。实际判断组件导出需要解析 AndroidManifest.xml 中的
+        android:exported 和 android:permission 属性。
+        V3 引擎 (VULN-INT-001) 通过正则匹配 Manifest 实现精确检测。
+        建议配合 Android Lint 或专用 Manifest 扫描工具使用。
+      source: "V3 Audit Engine - VULN-INT-001"
+
+  - id: zm-android-non-https-deeplink
+    severity: WARNING
+    message: |
+      检测到 Java 代码中使用了自定义 URL scheme。
+      如果此 scheme 在 Manifest 中被配置为 Deep Link 且非 HTTPS，
+      可被第三方 APP 伪造 Deeplink 触发，实现 Intent 劫持。
+      这需要结合 AndroidManifest.xml 分析 —— 检查 <data android:scheme="xxx"/> 。
+      修复: 使用 HTTPS scheme + Android App Links (.well-known/assetlinks.json 验证)。
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: |
+              Uri.parse("$SCHEME://...")
+          - pattern: |
+              new Intent(Intent.ACTION_VIEW, Uri.parse("$SCHEME://..."))
+      - metavariable-regex:
+          metavariable: $SCHEME
+          regex: '(?!https?|content|file|data|blob|mailto|tel|sms|geo|market)(^[a-z][a-z0-9+.-]*$)'
+    metadata:
+      cwe: "CWE-939: Improper Authorization in Handler for Custom URL Scheme"
+      owasp-mobile: "M2: Insecure Data Storage"
+      masvs: "MASVS-PLATFORM-3"
+      category: android-intent
+      precision: low
+      confidence: low
+      note: "此规则检测 Java 源代码中使用的 scheme，Manifest 中的深层链接配置需通过 XML 解析确认。"
+      source: "V3 Audit Engine - VULN-INT-003"

package/rules/android/mobile-cwe-927-ipc-file-provider.yaml

@@ -0,0 +1,102 @@
+# CWE-927 and CWE-22: IPC FileProvider and Content Provider Path Traversal (Android)
+# ZhuMa V4.0 - Android Rule Library
+# Source: ZhuMa V4.1 Rule Expansion - IPC security hardening
+
+rules:
+  - id: zm-android-fileprovider-path-too-broad
+    severity: HIGH
+    message: |
+      Detected FileProvider path configuration with an overly broad root-path or empty path.
+      A FileProvider with path="" or path="/" exposes the entire filesystem subtree to the requesting app,
+      allowing arbitrary file access beyond what is intended.
+      Remediation: Restrict FileProvider paths to specific subdirectories using path="specific/subdir/" with exact paths.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: $STR.equals("")
+          - pattern: $STR.equals("/")
+    metadata:
+      cwe: "CWE-927: Use of Implicit Intent for Sensitive Communication"
+      owasp-mobile: "M1: Improper Platform Usage"
+      masvs: "MASVS-PLATFORM-2"
+      category: android-ipc
+      precision: low
+      confidence: low
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/927.html
+        - https://developer.android.com/reference/androidx/core/content/FileProvider
+
+  - id: zm-android-contentprovider-openfile-no-canonical
+    severity: HIGH
+    message: |
+      Detected ContentProvider.openFile() without canonical path validation.
+      Without resolving the path to its canonical form and verifying it stays within the allowed directory,
+      a path traversal attack (../../etc/hosts) can access arbitrary files on the device.
+      Remediation: Use File.getCanonicalPath() and verify the result starts with the allowed base directory.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: ParcelFileDescriptor.open($FILE, $FLAGS)
+    metadata:
+      cwe: "CWE-22: Improper Limitation of a Pathname to a Restricted Directory"
+      owasp-mobile: "M1: Improper Platform Usage"
+      masvs: "MASVS-PLATFORM-2"
+      category: android-ipc
+      precision: low
+      confidence: low
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/22.html
+        - https://developer.android.com/privacy-and-security/risks/path-traversal
+
+  - id: zm-android-contentprovider-call-no-permission
+    severity: MEDIUM
+    message: |
+      Detected ContentProvider.call() method exposed without permission check.
+      The call() method is a generic IPC channel that can execute arbitrary provider-defined methods.
+      Without permission enforcement, any app can invoke internal methods.
+      Remediation: Add permission check via checkCallingPermission() at the start of call().
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: |
+              public Bundle call(String $METHOD, String $ARG, Bundle $EXTRAS) {
+                ...
+              }
+    metadata:
+      cwe: "CWE-927: Use of Implicit Intent for Sensitive Communication"
+      owasp-mobile: "M1: Improper Platform Usage"
+      masvs: "MASVS-PLATFORM-2"
+      category: android-ipc
+      precision: low
+      confidence: low
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/927.html
+
+  - id: zm-android-fileprovider-exported-true
+    severity: MEDIUM
+    message: |
+      Detected FileProvider with android:exported="true" (or no explicit exported declaration).
+      An exported FileProvider can serve files to any app on the device, potentially exposing private data.
+      Remediation: Set android:exported="false" unless external apps legitimately need file access. 
+      If exported is required, restrict with android:grantUriPermissions and signature-level permission.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: $PROVIDER.setExported(true)
+    metadata:
+      cwe: "CWE-927: Use of Implicit Intent for Sensitive Communication"
+      owasp-mobile: "M1: Improper Platform Usage"
+      masvs: "MASVS-PLATFORM-2"
+      category: android-ipc
+      precision: low
+      confidence: low
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/927.html