nativekeel 0.1.15 → 0.1.16

package/README.md

@@ -6,7 +6,7 @@ Health check for React Native and Expo apps. One command, no install, no account
 npx nativekeel
 ```
 
-**What's new in 0.1.15:** run it at a monorepo root and it lists the app folders to scan. **0.1.14:** secrets in Expo config (`extra`, `EXPO_PUBLIC_`, `eas.json`) and imports of APIs removed from React Native core. Recent releases added a *Start here* list in every report, hacking risks mapped to OWASP MASVS, crash and performance checks. Every check is tuned on 280+ open-source React Native and Expo apps to keep false alarms out. [All releases →](https://nativekeel.com/changelog)
+**What's new in 0.1.16:** deep-link checks: unverified Android App Links, and the template `myapp://` scheme that other apps can claim (MASVS-PLATFORM). **0.1.15:** run it at a monorepo root and it lists the app folders to scan. **0.1.14:** secrets in Expo config (`extra`, `EXPO_PUBLIC_`, `eas.json`) and imports of APIs removed from React Native core. Recent releases added a *Start here* list in every report, hacking risks mapped to OWASP MASVS, crash and performance checks. Every check is tuned on 450+ open-source React Native and Expo apps to keep false alarms out. [All releases →](https://nativekeel.com/changelog)
 
 ```
 Summary  4 critical · 5 high · 4 medium · 6 low
@@ -38,7 +38,7 @@ Start here
 - **Network:** TLS certificate checks turned off in native code, cleartext HTTP, `NSAllowsArbitraryLoads`, plain-HTTP API calls, user-installed CAs in release.
 - **Backend rules:** Firebase Realtime Database, Firestore and Storage rules open to anyone or in test mode.
 - **Cryptography:** hardcoded encryption keys, MD5/SHA-1 on passwords, ECB mode, `Math.random` for nonces and salts.
-- **Platform:** WebViews that read local files or load HTTP into HTTPS, Android components any app can start.
+- **Platform:** WebViews that read local files or load HTTP into HTTPS, Android components any app can start, unverified deep links and the template `myapp://` URL scheme.
 - **Dependencies and reverse engineering:** known vulnerabilities in the exact versions you ship (GitHub Advisory Database), source maps in the app, Hermes or R8 off.
 
 These are static checks: they catch the common, detectable mistakes, not everything a penetration test of the running app and backend would.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nativekeel",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "description": "Health check for React Native and Expo apps: upgrade blockers, store deadlines, crash risks, vulnerable dependencies and leaked secrets, with a step-by-step upgrade plan.",
   "type": "module",
   "bin": {

package/src/analyze.js

@@ -6,7 +6,7 @@ import { scanSecrets } from './secrets.js';
 import { nativeChecks } from './native.js';
 import { stabilityChecks } from './stability.js';
 import { performanceChecks } from './performance.js';
-import { vulnerableDependencies, passwordLeaks, webViewRisks, androidBackup, exportedComponents, plainHttpCalls, cloudRules, insecureTls, weakCrypto, tokenStorage, reverseEngineering, expoConfigSecrets, masvsOf, MASVS_GROUPS } from './security.js';
+import { vulnerableDependencies, passwordLeaks, webViewRisks, androidBackup, exportedComponents, plainHttpCalls, cloudRules, insecureTls, weakCrypto, tokenStorage, reverseEngineering, expoConfigSecrets, deepLinks, masvsOf, MASVS_GROUPS } from './security.js';
 import { lockedVersions } from './lockfile.js';
 import { findUnused, filesImportingWith } from './usage.js';
 import { matchKnownIssues, compareVersions } from './known-issues.js';
@@ -408,7 +408,7 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
   for (const f of performanceChecks(project)) add(f);
 
   // Security beyond leaked keys.
-  for (const f of [...passwordLeaks(project.root), ...webViewRisks(project.root), ...androidBackup(project.root), ...exportedComponents(project.root), ...plainHttpCalls(project.root), ...cloudRules(project.root, project.deps, now), ...insecureTls(project.root), ...weakCrypto(project.root), ...tokenStorage(project.root), ...reverseEngineering(project.root, project), ...expoConfigSecrets(project.root)]) add(f);
+  for (const f of [...passwordLeaks(project.root), ...webViewRisks(project.root), ...androidBackup(project.root), ...exportedComponents(project.root), ...plainHttpCalls(project.root), ...cloudRules(project.root, project.deps, now), ...insecureTls(project.root), ...weakCrypto(project.root), ...tokenStorage(project.root), ...reverseEngineering(project.root, project), ...expoConfigSecrets(project.root), ...deepLinks(project.root, project.deps)]) add(f);
   if (!forcedOffline) {
     // Exact versions only (installed, else the lockfile): a range would be a guess.
     const locked = lockedVersions(project.root, project.deps);

package/src/native.js

@@ -200,7 +200,8 @@ export function nativeChecks(project, { rnLatest = null, now = new Date() } = {}
     patched.push({ file: f, pkg, version });
     const text = read(path.join(patchDir, f)) || '';
     const buildPaths = (text.match(/^diff --git a\/node_modules\/\S+?\/(?:android|ios)\/(?:build|\.cxx|\.gradle)\//gm) || []).length;
-    const binary = /^GIT binary patch|^Binary files /m.test(text);
+    // Finder/Explorer junk (.DS_Store, Thumbs.db) caught in a patch is harmless noise.
+    const binary = text.split(/^diff --git /m).some((part) => /^GIT binary patch|^Binary files /m.test(part) && !/^\S*?(?:\.DS_Store|Thumbs\.db)\b/.test(part));
     if (buildPaths || binary) {
       add({
         id: `patch-artifacts:${f}`,
@@ -400,7 +401,7 @@ export function nativeChecks(project, { rnLatest = null, now = new Date() } = {}
         return false;
       }
     };
-    const signing = tracked.filter((f) => /\.(jks|keystore)$/i.test(f) && !/debug/i.test(path.basename(f)) && nonEmpty(f));
+    const signing = tracked.filter((f) => /\.(jks|keystore)$/i.test(f) && !/debug|fake|dummy/i.test(path.basename(f)) && !/(?:^|\/)(?:__tests__|tests?|e2e|fixtures?)\//.test(f) && nonEmpty(f));
     for (const f of signing) {
       add({
         id: `signing-keystore:${f}`,

package/src/report-html.js

@@ -60,6 +60,7 @@ h1{font-size:26px;margin:0 0 4px}h2{font-size:19px;margin:32px 0 12px}h2 small{f
 .stat.critical b{color:var(--critical)}.stat.high b{color:var(--high)}
 .facts{background:var(--card);border:1px solid var(--line);border-radius:10px;padding:12px 16px;margin-top:12px;display:flex;flex-wrap:wrap;gap:6px 24px;font-size:14px}
 ul.list{list-style:none;padding:0;margin:0;display:grid;gap:8px}
+main{overflow-wrap:anywhere}code{overflow-wrap:anywhere;word-break:break-word}.f>div,.sg,.stats>*{min-width:0}.facts{display:flex;flex-wrap:wrap;gap:6px 16px}
 .start{background:var(--card);border:1px solid var(--line);border-left:4px solid var(--accent);border-radius:8px;padding:6px 18px 10px;margin-top:20px}.start h2{margin:10px 0 6px}.start li{margin:6px 0}
 .secgrid{display:grid;grid-template-columns:repeat(3,1fr);gap:8px}.sg{background:var(--card);border:1px solid var(--line);border-radius:8px;padding:10px 12px;display:flex;flex-direction:column}.sg b{font-size:20px}.sg.ok b{color:var(--accent)}.sg.bad b{color:var(--critical)}.sg small{color:var(--muted)}@media (max-width:560px){.secgrid{grid-template-columns:1fr 1fr}}
 details.bumps{margin-top:8px;background:var(--card);border:1px solid var(--line);border-left:4px solid var(--low);border-radius:8px;padding:10px 14px}details.bumps summary{cursor:pointer;font-weight:600}details.bumps table{width:100%;border-collapse:collapse;margin-top:10px;font-size:14px}details.bumps th,details.bumps td{text-align:left;padding:4px 8px;border-top:1px solid var(--line)}.muted{color:var(--muted);font-weight:400}

package/src/security.js

@@ -591,7 +591,7 @@ export function masvsOf(id) {
   if (/^(secret:|env-bundled|crypto-|expo-secret)/.test(id)) return 'CRYPTO';
   if (/^(password-leak|token-unencrypted|android-allow-backup)/.test(id)) return 'STORAGE';
   if (/^(insecure-tls|user-certificates|plain-http|ios-ats|android-cleartext)/.test(id)) return 'NETWORK';
-  if (/^(webview-|android-exported)/.test(id)) return 'PLATFORM';
+  if (/^(webview-|android-exported|deeplink-)/.test(id)) return 'PLATFORM';
   if (/^firebase-/.test(id)) return 'AUTH';
   if (/^(vuln:|signing-|android-debuggable)/.test(id)) return 'CODE';
   if (/^(sourcemap-in-app|easy-reverse-engineering)/.test(id)) return 'RESILIENCE';
@@ -711,3 +711,94 @@ export function expoConfigSecrets(root) {
   }
   return findings;
 }
+
+// Deep links (MASVS-PLATFORM). A web link (https://your.domain/...) opens the app only when the
+// domain is verified (autoVerify + assetlinks.json); without it Android 12+ opens the browser,
+// and older Android lets any app that registers the same link receive it. Custom URL schemes can
+// be registered by any app, so the template scheme "myapp" is shared with every other app that
+// kept it, and an OAuth redirect to it can land in the wrong app.
+const TEMPLATE_SCHEMES = new Set(['myapp', 'my-app', 'myscheme', 'your-app-scheme', 'yourappscheme']);
+const SENSITIVE_LINK = /auth|login|signin|sign-in|reset|verify|magic|invite|oauth|callback|token/i;
+const OAUTH_DEPS = ['expo-auth-session', '@clerk/clerk-expo', 'react-native-app-auth', '@react-native-community/oauth', 'react-native-auth0'];
+
+export function deepLinks(root, deps = {}) {
+  const findings = [];
+  const unverified = new Map(); // host -> sensitive?
+  const schemes = new Set();
+  const realHost = (h) => h && !/[*$@{]/.test(h) && h.includes('.') && !/^(?:localhost|127\.|10\.|192\.168\.)/.test(h);
+
+  // autoVerify on any one filter makes Android verify every web host in the manifest.
+  const manifest = read(path.join(root, 'android', 'app', 'src', 'main', 'AndroidManifest.xml')) || '';
+  const anyVerified = /<intent-filter\b[^>]*android:autoVerify\s*=\s*"true"/.test(manifest);
+  for (const m of manifest.matchAll(/<intent-filter\b([^>]*)>([\s\S]*?)<\/intent-filter>/g)) {
+    const body = m[2];
+    if (!/android\.intent\.category\.BROWSABLE/.test(body)) continue;
+    const found = [...body.matchAll(/android:scheme\s*=\s*"([^"]+)"/g)].map((x) => x[1]);
+    for (const s of found) if (!/^https?$/.test(s)) schemes.add(s.toLowerCase());
+    if (anyVerified || !found.some((s) => /^https?$/.test(s))) continue;
+    const paths = [...body.matchAll(/android:path(?:Prefix|Pattern)?\s*=\s*"([^"]+)"/g)].map((x) => x[1]).join(' ');
+    for (const h of body.matchAll(/android:host\s*=\s*"([^"]+)"/g)) {
+      if (realHost(h[1])) unverified.set(h[1], unverified.get(h[1]) || SENSITIVE_LINK.test(`${h[1]} ${paths}`));
+    }
+  }
+
+  let app = null;
+  try {
+    app = JSON.parse(read(path.join(root, 'app.json')) || 'null');
+  } catch {
+    // not JSON
+  }
+  const expo = (app && (app.expo || app)) || {};
+  for (const s of [].concat(expo.scheme || [])) if (typeof s === 'string') schemes.add(s.toLowerCase());
+  for (const f of ['app.config.js', 'app.config.ts']) {
+    const text = read(path.join(root, f)) || '';
+    for (const m of text.matchAll(/\bscheme\s*:\s*['"`]([\w.+-]+)['"`]/g)) schemes.add(m[1].toLowerCase());
+  }
+  const expoFilters = (expo.android && expo.android.intentFilters) || [];
+  for (const filter of expoFilters.some((f) => f && f.autoVerify) ? [] : expoFilters) {
+    if (!filter || ![].concat(filter.category || []).includes('BROWSABLE')) continue;
+    for (const d of [].concat(filter.data || [])) {
+      if (d && /^https?$/.test(d.scheme || '') && realHost(d.host)) {
+        unverified.set(d.host, unverified.get(d.host) || SENSITIVE_LINK.test(`${d.host} ${d.pathPrefix || ''} ${d.path || ''} ${d.pathPattern || ''}`));
+      }
+    }
+  }
+  let iosDirs = [];
+  try {
+    iosDirs = fs.readdirSync(path.join(root, 'ios'), { withFileTypes: true }).filter((e) => e.isDirectory() && !/^(?:Pods|build)$|Tests$|\.xc/.test(e.name));
+  } catch {
+    // no ios folder
+  }
+  for (const d of iosDirs) {
+    const plist = read(path.join(root, 'ios', d.name, 'Info.plist')) || '';
+    for (const block of plist.match(/<key>CFBundleURLSchemes<\/key>\s*<array>[\s\S]*?<\/array>/g) || []) {
+      for (const s of block.matchAll(/<string>([^<$]+)<\/string>/g)) schemes.add(s[1].toLowerCase());
+    }
+  }
+
+  if (unverified.size) {
+    const hosts = [...unverified.keys()];
+    const sensitive = hosts.filter((h) => unverified.get(h));
+    findings.push({
+      id: 'deeplink-unverified',
+      severity: sensitive.length ? 'medium' : 'low',
+      area: 'security',
+      title: `Web links to ${hosts.slice(0, 2).join(', ')}${hosts.length > 2 ? ` and ${hosts.length - 2} more` : ''} are not verified (no autoVerify)`,
+      detail: `On Android 12+ these links open in the browser instead of the app, and on older Android any installed app that registers the same links can receive them${sensitive.length ? ', including the login/reset/invite links that carry tokens' : ''}. For domains you own, add android:autoVerify="true" to the intent filter and publish /.well-known/assetlinks.json with your signing certificate. (OWASP MASVS-PLATFORM)`,
+      fix: { kind: 'security', step: `Add \`android:autoVerify="true"\` to the https intent filters for ${hosts.slice(0, 3).map((h) => `\`${h}\``).join(', ')} and serve \`https://${hosts[0]}/.well-known/assetlinks.json\`.` },
+    });
+  }
+  const template = [...schemes].filter((s) => TEMPLATE_SCHEMES.has(s));
+  if (template.length) {
+    const oauth = OAUTH_DEPS.filter((d) => deps[d]);
+    findings.push({
+      id: 'deeplink-template-scheme',
+      severity: oauth.length ? 'medium' : 'low',
+      area: 'security',
+      title: `The app still uses the template URL scheme "${template[0]}://"`,
+      detail: `Many other apps kept the same scheme, so ${template[0]}:// links can open a different app${oauth.length ? `, and the sign-in redirect of ${oauth.join(', ')} can be delivered to it` : ''}. Pick a scheme unique to your app (for example your bundle identifier). (OWASP MASVS-PLATFORM)`,
+      fix: { kind: 'security', step: `Replace the "${template[0]}" scheme with one unique to the app (app.json \`scheme\`, AndroidManifest and Info.plist), and update redirect URIs registered with your sign-in providers.` },
+    });
+  }
+  return findings;
+}