supplier-meesho.webflow 1.0.0

package/MobSF/mobsf/StaticAnalyzer/views/android/rules/android_niap.yaml

@@ -0,0 +1,356 @@
+- id: FCS_RBG_EXT.1.1
+  type: code
+  choice_type: or
+  description: Random Bit Generation Services
+  selection: 'The application {} for its cryptographic operations.'
+  choice:
+    - - java\.security\.SecureRandomSpi
+      - implement DRBG functionality
+    - - java\.security\.SecureRandom
+      - invoke platform-provided DRBG functionality
+    - - java\.util\.Random
+      - use no DRBG functionality
+  class: Security Functional Requirements
+- id: FCS_STO_EXT.1.1
+  type: code
+  choice_type: or
+  description: Storage of Credentials
+  selection: 'The application {} to non-volatile memory.'
+  choice:
+    - - android\.security\.KeyChain
+      - >-
+        invoke the functionality provided by the platform to securely store
+        credentials
+  else: does not store any credentials
+  class: Security Functional Requirements
+- id: FCS_CKM_EXT.1.1
+  type: code
+  choice_type: or
+  description: Cryptographic Key Generation Services
+  selection: 'The application {}.'
+  choice:
+    - - java\.security\.KeyPairGenerator|KeyPairGenerator\.getInstance\(
+      - implement asymmetric key generation
+  else: generate no asymmetric cryptographic keys
+  class: Security Functional Requirements
+- id: FDP_DEC_EXT.1.1
+  type: manifest
+  choice_type: all
+  description: Access to Platform Resources
+  selection: 'The application has access to {}.'
+  choice:
+    - - 'android\.permission\.(?:INTERNET|ACCESS_NETWORK_STATE)'
+      - network connectivity
+    - - android\.permission\.CAMERA
+      - camera
+    - - android\.permission\.RECORD_AUDIO
+      - microphone
+    - - 'android\.permission\.ACCESS_(?:COARSE|FINE)_LOCATION'
+      - location
+    - - android\.permission\.NFC
+      - NFC
+    - - 'android\.hardware\.usb\.(?:host|action\.USB_DEVICE_ATTACHED)'
+      - USB
+    - - android\.permission\.BLUETOOTH
+      - bluetooth
+  else: no hardware resources
+  class: Security Functional Requirements
+- id: FDP_DEC_EXT.1.2
+  type: manifest
+  choice_type: all
+  description: Access to Platform Resources
+  selection: 'The application has access to {}.'
+  choice:
+    - - android\.permission\.READ_CONTACTS
+      - address book
+    - - 'android\.permission\.(?:READ|WRITE)_CALENDAR'
+      - calendar
+    - - android\.permission\.READ_CALL_LOG
+      - call lists
+    - - android\.permission\.READ_LOGS
+      - system logs
+  else: no sensitive information repositories
+  class: Security Functional Requirements
+- id: FDP_NET_EXT.1.1
+  type: manifest
+  choice_type: or
+  description: Network Communications
+  selection: 'The application has {}.'
+  choice:
+    - - android\.permission\.INTERNET
+      - user/application initiated network communications
+  else: no network communications
+  class: Security Functional Requirements
+- id: FDP_DAR_EXT.1.1
+  type: code
+  choice_type: or
+  description: Encryption Of Sensitive Application Data
+  selection: 'The application {} in non-volatile memory.'
+  choice:
+    - - 'androidx\.security\.crypto\.(?:EncryptedFile|EncryptedSharedPreferences)'
+      - leverage platform-provided functionality to encrypt sensitive data
+    - - javax\.crypto\.Cipher|net\.sqlcipher\.|\.encryptionKey\(
+      - implement functionality to encrypt sensitive data
+  else: does not encrypt files
+  class: Security Functional Requirements
+- id: FMT_MEC_EXT.1.1
+  type: code
+  choice_type: or
+  description: Supported Configuration Mechanism
+  selection: >-
+    The application invoke the mechanisms recommended by the platform vendor for
+    storing and setting configuration options.
+  choice:
+    - - android\.content\.SharedPreferences|crypto\.EncryptedSharedPreferences
+      - null
+  class: Security Functional Requirements
+- id: FTP_DIT_EXT.1.1
+  type: code
+  choice_type: or
+  description: Protection of Data in Transit
+  selection: 'The application does {} between itself and another trusted IT product.'
+  choice:
+    - - >-
+        (?:https|ssh|scp|sftp)://|\.getInstance\(\"TLS\"\)|CkSsh\(|com\.jcraft\.jsch\.JSch
+      - encrypt some transmitted data with HTTPS/TLS/SSH
+  else: not encrypt any data in traffic or does not transmit any data
+  class: Security Functional Requirements
+- id: 'FCS_RBG_EXT.2.1,FCS_RBG_EXT.2.2'
+  type: code
+  choice_type: or
+  description: Random Bit Generation from Application
+  selection: >-
+    The application perform all deterministic random bit generation (DRBG)
+    services in accordance with NIST Special Publication 800-90A using
+    Hash_DRBG. The deterministic RBG is seeded by an entropy source that
+    accumulates entropy from a platform-based DRBG and a software-based noise
+    source, with a minimum of 256 bits of entropy at least equal to the greatest
+    security strength (according to NIST SP 800-57) of the keys and hashes that
+    it will generate.
+  choice:
+    - - java\.security\.SecureRandom
+      - null
+  class: Selection-Based Security Functional Requirements
+- id: FCS_CKM.1.1(1)
+  type: code
+  choice_type: and
+  description: Cryptographic Asymmetric Key Generation
+  selection: 'The application generate asymmetric cryptographic keys {}.'
+  choice:
+    - - - 'java\.security\.KeyPairGenerator|\.getInstance\(.*(?:RSA|rsa)'
+        - 512|768|1024
+      - >-
+        not in accordance with FCS_CKM.1.1(1) using key generation algorithm RSA
+        schemes and cryptographic key sizes of 1024-bit or lower
+    - - - 'java\.security\.KeyPairGenerator|\.getInstance\(.*(?:RSA|rsa)'
+        - 2048|3072|4096
+      - >-
+        in accordance with a specified cryptographic key generation algorithm
+        RSA schemes using cryptographic key sizes of 2048-bit or greater
+  class: Selection-Based Security Functional Requirements
+- id: 'FCS_CKM.1.1(3),FCS_CKM.1.2(3)'
+  type: code
+  choice_type: or
+  description: Password Conditioning
+  selection: >-
+    A password/passphrase shall perform [Password-based Key Derivation
+    Functions] {}.
+  choice:
+    - - \.getInstance\(\"PBKDF2|PBEKeySpec\(.*?\)
+      - in accordance with a specified cryptographic algorithm.
+  class: Selection-Based Security Functional Requirements
+- id: FCS_COP.1.1(1)
+  type: code
+  choice_type: or
+  description: Cryptographic Operation - Encryption/Decryption
+  selection: 'The application perform encryption/decryption {}.'
+  choice:
+    - - '\.getInstance\(.*(?:AES/ECB/|/aes/ecb/|AES/CTR/|aes/ctr/)'
+      - 'not in accordance with FCS_COP.1.1(1), AES-ECB mode is being used'
+    - - '\.getInstance\(.*(?:AES/CBC/|aes/cbc|AES/GCM/|aes/gcm/)'
+      - >-
+        in accordance with a specified cryptographic algorithm AES-CBC (as
+        defined in NIST SP 800-38A) mode or AES-GCM (as defined in NIST SP
+        800-38D) and cryptographic key sizes 256-bit/128-bit
+  class: Selection-Based Security Functional Requirements
+- id: FCS_COP.1.1(2)
+  type: code
+  choice_type: or
+  description: Cryptographic Operation - Hashing
+  selection: 'The application perform cryptographic hashing services {}.'
+  choice:
+    - - 'DigestUtils\.md5\(|\.getInstance\(.*(?:md4|md5|rc2|rc4|RC4|RC2|MD4|MD5)'
+      - >-
+        not in accordance with FCS_COP.1.1(2) and uses the cryptographic
+        algorithm RC2/RC4/MD4/MD5
+    - - >-
+        \.getInstance\(.*(?:\.SHA1|\.SHA256|\.SHA384|\.SHA512|SHA-1|SHA-256|SHA-384|SHA-512|sha-1|sha-256|sha-384|sha-512)
+      - >-
+        in accordance with a specified cryptographic algorithm
+        SHA-1/SHA-256/SHA-384/SHA-512 and message digest sizes 160/256/384/512
+        bits
+  class: Selection-Based Security Functional Requirements
+- id: FCS_COP.1.1(3)
+  type: code
+  choice_type: and
+  description: Cryptographic Operation - Signing
+  selection: >-
+    The application perform cryptographic signature services (generation and
+    verification) in accordance with a specified cryptographic algorithm {}.
+  choice:
+    - - - >-
+          \.VerifyStringENC|\.signStringENC|\.signHashENC|\.initVerify\(|\.verify\(|\.initSign\(|\.sign\(
+        - 'CkRsa\(|\.getInstance\(.*(?:RSA|rsa)'
+      - RSA schemes using cryptographic key sizes of 2048-bit or greater
+    - - - >-
+          \.VerifyStringENC|\.signStringENC|\.signHashENC|\.initVerify\(|\.verify\(|\.initSign\(|\.sign\(
+        - 'CkEcc\(|\.getInstance\(.*(?:ECDSA|ecdsa)'
+      - 'ECDSA schemes using "NIST curves" P-256, P-384'
+  class: Selection-Based Security Functional Requirements
+- id: FCS_COP.1.1(4)
+  type: code
+  choice_type: all
+  description: Cryptographic Operation - Keyed-Hash Message Authentication
+  selection: >-
+    The application perform keyed-hash message authentication with cryptographic
+    algorithm {} .
+  choice:
+    - - \.getInstance\(*.HmacSHA256|put_HashAlgorithm\(\"SHA-256
+      - HMAC-SHA-256
+    - - \.getInstance\(*.HmacSHA1|put_HashAlgorithm\(\"SHA-1
+      - HMAC-SHA1
+    - - \.getInstance\(*.HmacSHA512|put_HashAlgorithm\(\"SHA-512
+      - HMAC-SHA-512
+    - - \.getInstance\(*.HmacSHA384|put_HashAlgorithm\(\"SHA-384
+      - HMAC-SHA-384
+    - - \.getInstance\(*.HmacMD5|put_HashAlgorithm\(\"MD5
+      - HMAC-MD5
+  class: Selection-Based Security Functional Requirements
+- id: FCS_HTTPS_EXT.1.1
+  type: code
+  choice_type: or
+  description: HTTPS Protocol
+  selection: The application implement the HTTPS protocol that complies with RFC 2818.
+  choice:
+    - - Scheme \(\"https
+      - null
+    - - HttpsURLConnection
+      - null
+  class: Selection-Based Security Functional Requirements
+- id: FCS_HTTPS_EXT.1.2
+  type: code
+  choice_type: or
+  description: HTTPS Protocol
+  selection: The application implement HTTPS using TLS.
+  choice:
+    - - \.getInstance\(.*TLS|HttpsURLConnection| Scheme \(\"https
+      - null
+    - - \.tlsVersions\(TlsVersion
+      - null
+  class: Selection-Based Security Functional Requirements
+- id: FCS_HTTPS_EXT.1.3
+  type: code
+  choice_type: or
+  description: HTTPS Protocol
+  selection: >-
+    The application notify the user and {} if the peer certificate is deemed
+    invalid.
+  choice:
+    - - >-
+        SSLPeerUnverifiedException\(|CertificateException|\(.*SSLException|CertPathValidatorException
+      - >-
+        not establish the connection or request application authorization to
+        establish the connection
+  class: Selection-Based Security Functional Requirements
+- id: FIA_X509_EXT.1.1
+  type: code
+  choice_type: all
+  description: X.509 Certificate Validation
+  selection: >-
+    The application invoked platform-provided functionality to validate
+    certificates in accordance with the following rules: {}.
+  choice:
+    - - X509HostnameVerifier
+      - RFC 5280 certificate validation and certificate path validation
+    - - checkClientTrusted
+      - The certificate path must terminate with a trusted CA certificate
+    - - \.getBasicConstraints\(\).*0|\.getBasicConstraints\(\) >.* -1
+      - >-
+        The application validate a certificate path by ensuring the presence of
+        the basicConstraints extension and that the CA flag is set to TRUE for
+        all CA certificates
+    - - \.isRevoked\(|\(PKIXRevocationChecker
+      - >-
+        The application validate the revocation status of the certificate using
+        the Online Certificate Status Protocol (OCSP) as specified in RFC 2560
+        or a Certificate Revocation List (CRL) as specified in RFC 5759 or an
+        OCSP TLS Status Request Extension (i.e., OCSP stapling) as specified in
+        RFC 6066
+  class: Selection-Based Security Functional Requirements
+- id: FIA_X509_EXT.1.2
+  type: code
+  choice_type: or
+  description: X.509 Certificate Validation
+  selection: >-
+    The application treat a certificate as a CA certificate only if the
+    basicConstraints extension is present and the CA flag is set to TRUE.
+  choice:
+    - - \.getBasicConstraints\(\).*0|\.getBasicConstraints\(\) >.* -1
+      - null
+  class: Selection-Based Security Functional Requirements
+- id: FIA_X509_EXT.2.1
+  type: code
+  choice_type: or
+  description: X.509 Certificate Authentication
+  selection: >-
+    The application use X.509v3 certificates as defined by RFC 5280 to support
+    authentication for HTTPS , TLS.
+  choice:
+    - - java\.security\.cert\.X509Certificate
+      - null
+  class: Selection-Based Security Functional Requirements
+- id: FIA_X509_EXT.2.2
+  type: code
+  choice_type: and
+  description: X.509 Certificate Authentication
+  selection: >-
+    When the application cannot establish a connection to determine the validity
+    of a certificate, the application allow the administrator to choose whether
+    to accept the certificate in these cases or accept the certificate ,or not
+    accept the certificate.
+  choice:
+    - - - java\.security\.cert\.X509Certificate
+        - \.checkValidity\(
+        - CertificateExpiredException|CertificateNotYetValidException
+      - null
+  class: Selection-Based Security Functional Requirements
+- id: FPT_TUD_EXT.2.1
+  type: code
+  choice_type: or
+  description: Integrity for Installation and Update
+  selection: >-
+    The application shall be distributed using the format of the
+    platform-supported package manager.
+  choice:
+    - - \.enableInstallerId\(InstallerID\.GOOGLE_PLAY
+      - null
+    - - \.getInstallerPackageName\(
+      - null
+  class: Selection-Based Security Functional Requirements
+- id: FCS_CKM.1.1(2)
+  type: code
+  choice_type: and
+  description: Cryptographic Symmetric Key Generation
+  selection: >-
+    The application shall generate symmetric cryptographic keys using a Random
+    Bit Generator as specified in FCS_RBG_EXT.1 and specified cryptographic key
+    sizes 128 bit or 256 bit.
+  choice:
+    - - - javax\.crypto\.KeyGenerator
+        - KeyProperties\.KEY_ALGORITHM_AES|\.setKeySize\(256|\.setKeySize\(128
+        - \.generateKey\(
+      - null
+    - - - SecureRandom\(
+        - \.generateSecret\(|SecretKeySpec\(.*AES
+      - null
+  class: Optional Security Functional Requirements