narvy-cli 1.0.0__py3-none-any.whl

narvy/rule_engine.py

@@ -0,0 +1,57 @@
+import yaml
+import re
+import os
+from typing import List, Dict, Any
+
+from .android_rule_context import apply_gate
+from . import comment_filter
+
+def load_rules_from_dir(rules_directory: str) -> List[Dict[str, Any]]:
+    """Load rules from a directory of YAML files."""
+    all_rules = []
+    for filename in os.listdir(rules_directory):
+        if filename.endswith(('.yml', '.yaml')):
+            with open(os.path.join(rules_directory, filename), 'r') as f:
+                rules_in_file = yaml.safe_load(f)
+                if isinstance(rules_in_file, list):
+                    all_rules.extend(rules_in_file)
+    # YAML `|` block scalars keep a trailing newline; strip it off patterns.
+    for rule in all_rules:
+        pattern = rule.get('pattern')
+        if isinstance(pattern, str):
+            rule['pattern'] = pattern.strip()
+    return all_rules
+
+def run_rules_on_file(file_path: str, rules: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
+    """Run the rules against a single file, one finding per occurrence."""
+    findings = []
+    try:
+        with open(file_path, 'r', encoding='utf-8', errors='ignore') as f:
+            content = f.read()
+
+        # Comment-aware post-filter, built only when a comment opener is present.
+        comment_mask = None
+        if '//' in content or '/*' in content:
+            comment_mask = comment_filter.build_comment_mask(content)
+
+        for rule in rules:
+            for match in re.finditer(rule['pattern'], content, re.MULTILINE):
+                if comment_mask is not None and comment_mask[match.start()]:
+                    continue
+                line = content.count('\n', 0, match.start()) + 1
+                finding = {
+                    "rule_id": rule['id'],
+                    "file_path": file_path,
+                    "name": rule['name'],
+                    "severity": rule['severity'],
+                    "confidence": rule.get('confidence', 'MEDIUM'),
+                    "details": rule['details'],
+                    "line": line,
+                }
+                # Fail-open: any gate error keeps the finding.
+                finding = apply_gate(rule['id'], content, match, finding)
+                if finding is not None:
+                    findings.append(finding)
+    except Exception as e:
+        print(f"Could not analyze file {file_path}: {e}")
+    return findings

narvy/rules/android/config.yml

@@ -0,0 +1,77 @@
+# Android manifest and configuration checks.
+
+- id: AND-CONF-001
+  name: "Application is Debuggable"
+  pattern: 'android:debuggable\s*=\s*"true"'
+  severity: "CRITICAL"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-489"
+    masvs: "MSTG-CODE-2"
+    description: "The application is set as debuggable, allowing attackers to attach a debugger and inspect its runtime behavior. This must be disabled in release builds."
+    recommendation: "Set android:debuggable to 'false' in the AndroidManifest.xml for all release builds."
+- id: AND-CONF-002
+  name: "Application Data Backup is Enabled"
+  pattern: 'android:allowBackup\s*=\s*"true"'
+  severity: "HIGH"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-530"
+    masvs: "MSTG-STORAGE-8"
+    description: "The application's data can be backed up via ADB. If sensitive data is stored within the app, it can be extracted by anyone with physical access to the device."
+    recommendation: "If not required, set android:allowBackup to 'false'. If it is, use auto-backup rules to exclude sensitive data."
+- id: AND-CONF-003
+  name: "Cleartext HTTP Traffic is Permitted"
+  pattern: 'android:usesCleartextTraffic\s*=\s*"true"'
+  severity: "HIGH"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-319"
+    masvs: "MSTG-NETWORK-1"
+    description: "The application is configured to permit cleartext HTTP traffic, exposing data to network sniffing."
+    recommendation: "Set android:usesCleartextTraffic to 'false' and use HTTPS for all communications. Use a Network Security Configuration file for exceptions."
+
+- id: AND-CONF-004
+  name: "Component is Exported without Permission"
+  pattern: |
+    (?s)<(?:activity|service|receiver|provider)\b(?=(?:(?!<)[\s\S])*?android:exported\s*=\s*"true")(?:(?!(?:(?!<)[\s\S])*?android:permission\s*=)|(?=(?:(?!<)[\s\S])*?android:permission\s*=\s*"android\.permission\.(?:FOREGROUND_SERVICE|INTERNET|ACCESS_NETWORK_STATE|ACCESS_WIFI_STATE|BLUETOOTH|BLUETOOTH_ADMIN|CHANGE_NETWORK_STATE|CHANGE_WIFI_STATE|VIBRATE|WAKE_LOCK|GET_ACCOUNTS|NFC|RECEIVE_BOOT_COMPLETED|SET_ALARM|SET_WALLPAPER|SET_WALLPAPER_HINTS|TRANSMIT_IR|BROADCAST_STICKY|KILL_BACKGROUND_PROCESSES|MODIFY_AUDIO_SETTINGS|READ_SYNC_SETTINGS|READ_SYNC_STATS|WRITE_SYNC_SETTINGS|REORDER_TASKS|CHANGE_WIFI_MULTICAST_STATE|DISABLE_KEYGUARD|EXPAND_STATUS_BAR|FLASHLIGHT|PERSISTENT_ACTIVITY)"))[\s\S]*?(?:/>|>)
+  severity: "HIGH"
+  confidence: "MEDIUM"
+  details:
+    cwe: "CWE-926"
+    masvs: "MSTG-PLATFORM-2"
+    description: "An application component (Activity, Service, Receiver) is exported without a real access-control permission (either none is set, or the one set is an OS-defined 'normal' permission auto-granted to any app, not an actual restriction). This can allow malicious apps to access or abuse the component's functionality."
+    recommendation: "Set android:exported to 'false' if the component is not meant to be used by other apps. If it must be exported, protect it with a 'signature' level permission, and validate all input from the Intent regardless."
+
+- id: AND-CONF-005
+  name: "World-Readable File Mode"
+  pattern: 'MODE_WORLD_READABLE'
+  severity: "HIGH"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-732"
+    masvs: "MSTG-STORAGE-2"
+    description: "A file is opened with MODE_WORLD_READABLE, making it readable by every other application on the device. This constant has been deprecated by Google specifically for being a security hazard."
+    recommendation: "Use MODE_PRIVATE and, if inter-process sharing is genuinely required, use a ContentProvider with explicit permission grants instead."
+
+- id: AND-CONF-006
+  name: "World-Writable File Mode"
+  pattern: 'MODE_WORLD_WRITEABLE'
+  severity: "CRITICAL"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-732"
+    masvs: "MSTG-STORAGE-2"
+    description: "A file is opened with MODE_WORLD_WRITEABLE, allowing any other application on the device to modify its contents. This can enable data tampering or, in some cases, code injection."
+    recommendation: "Use MODE_PRIVATE. If another app must write to this data, use a ContentProvider with explicit, signature-level permission grants."
+
+- id: AND-CONF-009
+  name: "PendingIntent Without Explicit Immutability Flag"
+  pattern: 'PendingIntent\.(getActivity|getBroadcast|getService)\s*\('
+  severity: "MEDIUM"
+  confidence: "LOW"
+  details:
+    cwe: "CWE-927"
+    masvs: "MSTG-PLATFORM-2"
+    description: "A PendingIntent is created. If it does not explicitly set FLAG_IMMUTABLE (or a deliberately-scoped FLAG_MUTABLE), a malicious app that obtains this PendingIntent may be able to fill in or modify the underlying Intent and have it executed with this app's identity."
+    recommendation: "Verify manually whether FLAG_IMMUTABLE is set at this call site (required on Android 12+ unless mutability is explicitly needed). This is a low-confidence heuristic - every PendingIntent creation is flagged for manual review, not every instance is a real bug."

narvy/rules/android/crypto.yml

@@ -0,0 +1,34 @@
+# Android cryptography checks.
+
+- id: AND-CRYPTO-007
+  name: "Deprecated SSL Protocol Accepted"
+  pattern: 'SSLContext\.getInstance\s*\(\s*"SSL"'
+  severity: "HIGH"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-327"
+    masvs: "MSTG-NETWORK-2"
+    description: "Requesting the generic \"SSL\" protocol (as opposed to a specific TLS version) can silently negotiate down to SSLv3 or earlier on some providers, both of which are broken (POODLE)."
+    recommendation: "Explicitly request \"TLSv1.2\" or \"TLSv1.3\"."
+
+- id: AND-CRYPTO-009
+  name: "Hardcoded Cryptographic IV"
+  pattern: 'new\s+IvParameterSpec\s*\(\s*"[^"]+"\.getBytes'
+  severity: "HIGH"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-329"
+    masvs: "MSTG-CRYPTO-3"
+    description: "A hardcoded, static initialization vector (IV) is used for encryption. Reusing a static IV defeats the security properties of most cipher modes (e.g., enables pattern analysis in CBC, catastrophic key/plaintext recovery in GCM/CTR on reuse)."
+    recommendation: "Generate a fresh, random IV for every encryption operation using SecureRandom, and store/transmit it alongside the ciphertext (it does not need to be secret)."
+
+- id: AND-CRYPTO-010
+  name: "Hardcoded Symmetric Encryption Key"
+  pattern: 'new\s+SecretKeySpec\s*\(\s*"[^"]+"\.getBytes'
+  severity: "CRITICAL"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-321"
+    masvs: "MSTG-CRYPTO-1"
+    description: "A symmetric encryption key is built from a hardcoded string literal. Anyone who decompiles the app recovers the exact key used to encrypt/decrypt all protected data."
+    recommendation: "Never embed encryption keys in source code. Derive keys via the Android Keystore system, or retrieve them from a secure backend at runtime."

narvy/rules/android/secrets.yml

@@ -0,0 +1,161 @@
+# Android hardcoded-credential checks.
+
+- id: AND-S-001
+  name: "Hardcoded API Key"
+  pattern: |
+    (?i)(api[_-]?key|api[_-]?secret)["\s]*[:=][\s"']*[A-Za-z0-9+/=_-]{16,}
+  severity: "CRITICAL"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-798"
+    masvs: "MSTG-STORAGE-1"
+    description: "A hardcoded API key or secret token was found. This allows attackers who can decompile the app to gain unauthorized access to services."
+    recommendation: "Do not hardcode credentials. Retrieve them from a secure backend at runtime, or store them encrypted using the Android Keystore system."
+
+- id: AND-S-002
+  name: "Hardcoded Password"
+  pattern: |
+    (?i)(password|passwd|pwd)\s*[:=]\s*"(?!(?:[^"\n]*(?:password|passwd|pwd)[^"\n]*)")[^"\n]{6,}"\s*;
+  severity: "CRITICAL"
+  confidence: "MEDIUM"
+  details:
+    cwe: "CWE-259"
+    masvs: "MSTG-STORAGE-1"
+    description: "A hardcoded password may have been found in the source code. Storing credentials directly in the code is highly insecure."
+    recommendation: "Remove credentials from the code. Store them securely using the Android Keystore system."
+
+- id: AND-S-003
+  name: "Hardcoded Private Key"
+  # Require base64 key material after the header, so a bare "-----BEGIN PRIVATE KEY-----" marker constant is not flagged.
+  pattern: '-----BEGIN( RSA| EC| OPENSSH| DSA)? PRIVATE KEY-----[\r\n\s]+[A-Za-z0-9+/]{40,}'
+  severity: "CRITICAL"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-321"
+    masvs: "MSTG-CRYPTO-1"
+    description: "A private key block (e.g., RSA) was found embedded in the code. This completely compromises the security provided by the key."
+    recommendation: "Private keys should never be stored in the application package. Use the Android Keystore for cryptographic operations or retrieve keys from a secure server at runtime."
+
+- id: AND-S-004
+  name: "Hardcoded AWS Access Key ID"
+  pattern: 'AKIA[0-9A-Z]{16}'
+  severity: "CRITICAL"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-798"
+    masvs: "MSTG-STORAGE-1"
+    description: "An AWS Access Key ID was found hardcoded in the app. If paired with its secret key (also often nearby), this grants direct access to whatever AWS resources the key's IAM policy allows."
+    recommendation: "Revoke this key in the AWS IAM console immediately, then remove it from the code. Mobile apps should never hold long-lived AWS credentials - use temporary credentials via Cognito Identity Pools or a backend-issued token instead."
+
+- id: AND-S-005
+  name: "Hardcoded Google API Key"
+  pattern: 'AIza[0-9A-Za-z\-_]{35}'
+  severity: "HIGH"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-798"
+    masvs: "MSTG-STORAGE-1"
+    description: "A Google API key was found hardcoded in the app. Depending on the API restrictions configured on this key (or lack thereof), this can allow abuse of billed Google Cloud/Maps/Firebase services under the app owner's account."
+    recommendation: "Restrict the key to specific APIs and to the app's own signing certificate fingerprint / package name in the Google Cloud Console. Prefer server-side calls for any API that does not require a client-side key."
+
+- id: AND-S-006
+  name: "Hardcoded Slack Token"
+  pattern: 'xox[baprs]-[0-9A-Za-z-]{10,48}'
+  severity: "CRITICAL"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-798"
+    masvs: "MSTG-STORAGE-1"
+    description: "A Slack API/bot/user token was found hardcoded in the app. This grants whatever access the token's scopes allow within the associated Slack workspace."
+    recommendation: "Revoke the token in Slack's app management console and remove it from the app. Slack tokens must never ship inside a client application."
+
+- id: AND-S-007
+  name: "Hardcoded Stripe Live Secret Key"
+  pattern: 'sk_live_[0-9a-zA-Z]{24,}'
+  severity: "CRITICAL"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-798"
+    masvs: "MSTG-STORAGE-1"
+    description: "A Stripe LIVE secret key was found hardcoded in the app. This key can create charges, issue refunds, and read all payment data on the connected Stripe account - this is a direct financial exposure, not just a data leak."
+    recommendation: "Roll this key immediately in the Stripe dashboard. Secret keys must never be shipped client-side; only publishable keys (pk_live_/pk_test_) belong in a mobile app, and all charge/refund logic must run server-side."
+
+- id: AND-S-008
+  name: "Hardcoded JWT"
+  pattern: 'eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}'
+  severity: "MEDIUM"
+  confidence: "MEDIUM"
+  details:
+    cwe: "CWE-798"
+    masvs: "MSTG-STORAGE-1"
+    description: "A hardcoded JSON Web Token was found. If this is a real, live, long-lived token (as opposed to a test fixture), it grants whatever access its claims allow to anyone who decompiles the app."
+    recommendation: "Confirm whether this is test/fixture data. If it is a real token, revoke it and issue tokens dynamically per-session from the backend instead of embedding one statically."
+
+- id: AND-S-009
+  name: "Credentials Embedded in URL"
+  pattern: 'https?://[^/\s:]+:[^/\s@"]+@'
+  severity: "HIGH"
+  confidence: "MEDIUM"
+  details:
+    cwe: "CWE-798"
+    masvs: "MSTG-STORAGE-1"
+    description: "A URL containing embedded username:password credentials (Basic Auth in the URL itself) was found. These credentials are visible in source, logs, and often browser/proxy history."
+    recommendation: "Remove credentials from the URL. Use an Authorization header set at request time from a securely stored credential, or better, an OAuth token flow."
+
+- id: AND-S-010
+  name: "Hardcoded Encryption/Secret Key Variable"
+  pattern: |
+    (?i)(?<!#)\w*(key|secret)\w*\s*=\s*"(?!(?:SELECT|INSERT|UPDATE|DELETE)\s)(?!https?://)(?!@\w+/)(?!\w+\[[^\]]*\]")(?!(?:private|public)\s+key"\s*;)(?![a-z0-9_.:\-]+")(?![^"\n]*\\)[^"\n]{8,}"\s*;
+  severity: "CRITICAL"
+  confidence: "MEDIUM"
+  details:
+    cwe: "CWE-321"
+    masvs: "MSTG-CRYPTO-1"
+    description: "A variable named like an encryption or secret key is assigned a hardcoded literal value. If this is genuinely used as a cryptographic key, it is fully recoverable by decompilation."
+    recommendation: "Never hardcode cryptographic key material. Derive it via the Android Keystore, or retrieve it from a secure backend at runtime."
+
+- id: AND-S-011
+  name: "Hardcoded Bearer Token"
+  pattern: |
+    (?i)bearer\s+[A-Za-z0-9\-._~+/]{20,}=*
+  severity: "HIGH"
+  confidence: "MEDIUM"
+  details:
+    cwe: "CWE-798"
+    masvs: "MSTG-STORAGE-1"
+    description: "A hardcoded Bearer authorization token was found. If live, it grants API access to whatever it authorizes, to anyone who decompiles the app."
+    recommendation: "Do not hardcode bearer tokens. Obtain them dynamically via an authenticated login flow and store them using EncryptedSharedPreferences or the Android Keystore."
+
+- id: AND-S-012
+  name: "Database Connection String with Embedded Credentials"
+  pattern: |
+    (?i)jdbc:[a-z]+://[^:/\s]+:[^@/\s]+@
+  severity: "CRITICAL"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-798"
+    masvs: "MSTG-STORAGE-1"
+    description: "A JDBC connection string with an embedded username:password was found. A mobile app should not be connecting directly to a database at all - this pattern typically indicates a database exposed to the internet with credentials shipping in every install."
+    recommendation: "Remove direct database access from the mobile app entirely. Route all data access through an authenticated backend API."
+
+- id: AND-S-013
+  name: "Hardcoded Twilio API Key"
+  pattern: 'SK[0-9a-fA-F]{32}'
+  severity: "HIGH"
+  confidence: "MEDIUM"
+  details:
+    cwe: "CWE-798"
+    masvs: "MSTG-STORAGE-1"
+    description: "A Twilio API Key SID was found hardcoded in the app. Paired with its secret, this allows sending SMS/calls and reading account data billed to the app owner."
+    recommendation: "Revoke the key in the Twilio console and move SMS/call operations to a backend service the app authenticates against."
+
+- id: AND-S-014
+  name: "Hardcoded GitHub Personal Access Token"
+  pattern: 'ghp_[A-Za-z0-9]{36}'
+  severity: "CRITICAL"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-798"
+    masvs: "MSTG-STORAGE-1"
+    description: "A GitHub Personal Access Token was found hardcoded in the app. This is almost always leftover developer/CI credentials rather than something the app legitimately needs at runtime, and grants access to whatever repos/scopes the token holder has."
+    recommendation: "Revoke the token in GitHub Settings > Developer settings immediately and remove it from the source. Rotate any secrets the token could have exposed."

narvy/rules/android/storage.yml

@@ -0,0 +1,24 @@
+# Android local-storage checks.
+
+- id: AND-STORAGE-002
+  name: "Write to Unscoped External Storage"
+  pattern: 'Environment\.getExternalStorageDirectory\s*\(\s*\)'
+  severity: "MEDIUM"
+  confidence: "LOW"
+  details:
+    cwe: "CWE-922"
+    masvs: "MSTG-STORAGE-2"
+    description: "The app writes to the shared external storage root. Files placed here are world-readable pre-Android 10 (and reachable via scoped storage exemptions afterward), and survive app uninstall. This is a low-confidence heuristic - flags every use of the API, not just sensitive-data writes."
+    recommendation: "Verify manually whether sensitive data (tokens, PII, credentials) is ever written here. If so, use app-internal storage (getFilesDir()) or scoped storage, encrypted at rest if it must be shared."
+
+- id: AND-STORAGE-003
+  name: "Sensitive Data Possibly Copied to Clipboard"
+  pattern: |
+    (?i)ClipData\.newPlainText\s*\(\s*"[^"]*(password|token|secret|api_key)
+  severity: "MEDIUM"
+  confidence: "MEDIUM"
+  details:
+    cwe: "CWE-200"
+    masvs: "MSTG-PLATFORM-4"
+    description: "A value that looks like a password, token, or secret is copied to the system clipboard. Other apps (and, on some OEM skins, cloud clipboard sync) can read clipboard contents, making this a plaintext exfiltration path."
+    recommendation: "Avoid copying secrets to the clipboard. If unavoidable, mark the ClipDescription as sensitive (EXTRA_IS_SENSITIVE, API 33+) and clear the clipboard shortly after."

narvy/rules/android/webview.yml

@@ -0,0 +1,23 @@
+# Android WebView configuration checks.
+
+- id: AND-WEBVIEW-002
+  name: "File Access Enabled in WebView"
+  pattern: 'setAllowFileAccess\s*\(\s*true\s*\)'
+  severity: "HIGH"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-73"
+    masvs: "MSTG-PLATFORM-5"
+    description: "Allowing file access from a WebView can lead to local file theft if a malicious web page is loaded."
+    recommendation: "Disable file access by default using `setAllowFileAccess(false)` unless explicitly required."
+
+- id: AND-WEBVIEW-005
+  name: "Content Access Enabled in WebView"
+  pattern: 'setAllowContentAccess\s*\(\s*true\s*\)'
+  severity: "MEDIUM"
+  confidence: "MEDIUM"
+  details:
+    cwe: "CWE-668"
+    masvs: "MSTG-PLATFORM-5"
+    description: "content:// URL access is enabled in the WebView. If the WebView can be made to load an attacker-influenced content:// URL, this can expose data from other apps' ContentProviders."
+    recommendation: "Disable with setAllowContentAccess(false) unless the app specifically needs to load content:// URLs from trusted sources."

narvy/rules/android.yml

@@ -0,0 +1,219 @@
+# Android source rules, authored by Narvy.
+# WebView, crypto, storage, logging, SQL injection, secrets.
+
+rules:
+  - id: android-ecb-mode
+    languages: [java, kotlin]
+    severity: ERROR
+    message: >-
+      ECB mode is used for encryption. ECB is insecure because identical
+      plaintext blocks encrypt to identical ciphertext blocks, revealing
+      patterns. Use GCM or CBC with proper padding instead.
+    metadata:
+      cwe: CWE-327
+      masvs: MSTG-CRYPTO-4
+      category: crypto
+    patterns:
+      - pattern: $CIPHER.getInstance($ALGO)
+      - metavariable-regex:
+          metavariable: $ALGO
+          regex: '.*ECB.*'
+
+  - id: android-weak-cipher
+    languages: [java, kotlin]
+    severity: ERROR
+    message: "DES/RC4 are broken ciphers. Use AES-256-GCM instead."
+    metadata:
+      cwe: CWE-327
+      masvs: MSTG-CRYPTO-4
+      category: crypto
+    patterns:
+      - pattern: $CIPHER.getInstance($ALGO)
+      - metavariable-regex:
+          metavariable: $ALGO
+          regex: '^"(DES|DESede|RC4).*'
+
+  - id: android-weak-hash
+    languages: [java, kotlin]
+    severity: WARNING
+    message: "MD5/SHA-1 are broken for security-sensitive hashing. Use SHA-256+."
+    metadata:
+      cwe: CWE-328
+      masvs: MSTG-CRYPTO-4
+      category: crypto
+    patterns:
+      - pattern: java.security.MessageDigest.getInstance($ALGO)
+      - metavariable-regex:
+          metavariable: $ALGO
+          regex: '^"(MD5|SHA-?1)"$'
+
+  - id: android-weak-prng
+    languages: [java, kotlin]
+    severity: WARNING
+    message: "java.util.Random / Math.random() is not cryptographically secure. Use SecureRandom for security-sensitive values (tokens, keys, nonces, salts, session ids)."
+    metadata:
+      cwe: CWE-338
+      masvs: MSTG-CRYPTO-6
+      category: crypto
+    patterns:
+      - pattern-either:
+          - pattern: new java.util.Random(...)
+          - pattern: new Random(...)
+          - pattern: Math.random()
+
+  - id: android-hardcoded-keystore-password
+    languages: [java, kotlin]
+    severity: ERROR
+    message: "Hardcoded KeyStore/keystore password - fully recoverable by decompilation."
+    metadata:
+      cwe: CWE-798
+      masvs: MSTG-STORAGE-1
+      category: secrets
+    patterns:
+      - pattern-either:
+          - pattern: $KS.load($IN, "$PASS".toCharArray())
+          - pattern: $KS.getKey($ALIAS, "$PASS".toCharArray())
+
+  - id: android-webview-js-enabled
+    languages: [java, kotlin]
+    severity: WARNING
+    message: "JavaScript enabled in WebView - can enable XSS if untrusted content is loaded."
+    metadata:
+      cwe: CWE-749
+      masvs: MSTG-PLATFORM-5
+      category: webview
+    patterns:
+      - pattern: $SETTINGS.setJavaScriptEnabled(true)
+
+  - id: android-webview-universal-file-access
+    languages: [java, kotlin]
+    severity: ERROR
+    message: "setAllowUniversalAccessFromFileURLs(true) allows JS in a file:// context to reach any origin - classic path to universal XSS / local file exfiltration."
+    metadata:
+      cwe: CWE-940
+      masvs: MSTG-PLATFORM-5
+      category: webview
+    patterns:
+      - pattern: $SETTINGS.setAllowUniversalAccessFromFileURLs(true)
+
+  - id: android-webview-addjavascriptinterface
+    languages: [java, kotlin]
+    severity: WARNING
+    message: "addJavascriptInterface() exposes a native object to JS in the WebView. Ensure the WebView only loads trusted content and methods are @JavascriptInterface-annotated."
+    metadata:
+      cwe: CWE-749
+      masvs: MSTG-PLATFORM-7
+      category: webview
+    patterns:
+      - pattern: $WV.addJavascriptInterface($OBJ, $NAME)
+
+  # SQLi via string-concat into a SQL sink, split by sink (rawQuery -> HIGH, execSQL -> MEDIUM); pure-literal concats suppressed.
+  - id: android-sql-injection-rawquery
+    languages: [java, kotlin]
+    severity: WARNING
+    message: "SQL built via string concatenation reaches rawQuery(). If any operand is user-controlled this is SQL injection; use parameterized queries (? placeholders + selectionArgs)."
+    metadata:
+      cwe: CWE-89
+      masvs: MSTG-PLATFORM-2
+      category: injection
+      confidence: LOW
+    patterns:
+      - pattern: $DB.rawQuery($A + $B, ...)
+      - pattern-not:
+          patterns:
+            - pattern: $DB.rawQuery($A + $B, ...)
+            - metavariable-pattern:
+                metavariable: $A
+                patterns:
+                  - pattern-regex: (?s)^(?:\s|\+)*(?:"[^"]*"|[A-Za-z_][A-Za-z0-9_.]*\.[A-Z][A-Z0-9_]*|[A-Z][A-Z0-9_]*)(?:(?:\s|\+)+(?:"[^"]*"|[A-Za-z_][A-Za-z0-9_.]*\.[A-Z][A-Z0-9_]*|[A-Z][A-Z0-9_]*))*(?:\s|\+)*$
+            - metavariable-pattern:
+                metavariable: $B
+                patterns:
+                  - pattern-regex: (?s)^(?:\s|\+)*(?:"[^"]*"|[A-Za-z_][A-Za-z0-9_.]*\.[A-Z][A-Z0-9_]*|[A-Z][A-Z0-9_]*)(?:(?:\s|\+)+(?:"[^"]*"|[A-Za-z_][A-Za-z0-9_.]*\.[A-Z][A-Z0-9_]*|[A-Z][A-Z0-9_]*))*(?:\s|\+)*$
+
+  - id: android-sql-injection-execsql
+    languages: [java, kotlin]
+    severity: INFO
+    message: "SQL built via string concatenation passed to execSQL(). Often DDL or a Room migration with app-internal values (lower risk); but if any operand is user-controlled it is injectable. Prefer parameterized statements."
+    metadata:
+      cwe: CWE-89
+      masvs: MSTG-PLATFORM-2
+      category: injection
+      confidence: LOW
+    patterns:
+      - pattern: $DB.execSQL($A + $B)
+      - pattern-not:
+          patterns:
+            - pattern: $DB.execSQL($A + $B)
+            - metavariable-pattern:
+                metavariable: $A
+                patterns:
+                  - pattern-regex: (?s)^(?:\s|\+)*(?:"[^"]*"|[A-Za-z_][A-Za-z0-9_.]*\.[A-Z][A-Z0-9_]*|[A-Z][A-Z0-9_]*)(?:(?:\s|\+)+(?:"[^"]*"|[A-Za-z_][A-Za-z0-9_.]*\.[A-Z][A-Z0-9_]*|[A-Z][A-Z0-9_]*))*(?:\s|\+)*$
+            - metavariable-pattern:
+                metavariable: $B
+                patterns:
+                  - pattern-regex: (?s)^(?:\s|\+)*(?:"[^"]*"|[A-Za-z_][A-Za-z0-9_.]*\.[A-Z][A-Z0-9_]*|[A-Z][A-Z0-9_]*)(?:(?:\s|\+)+(?:"[^"]*"|[A-Za-z_][A-Za-z0-9_.]*\.[A-Z][A-Z0-9_]*|[A-Z][A-Z0-9_]*))*(?:\s|\+)*$
+
+  - id: android-trust-all-certs
+    languages: [java, kotlin]
+    severity: ERROR
+    message: "Custom TrustManager - verify checkServerTrusted() actually validates the chain. An empty/no-op body disables TLS certificate validation entirely (trivial MITM)."
+    metadata:
+      cwe: CWE-295
+      masvs: MSTG-NETWORK-3
+      category: network
+    patterns:
+      - pattern: |
+          new X509TrustManager() {
+            ...
+            public void checkServerTrusted(...) { }
+            ...
+          }
+
+  - id: android-trust-all-hostname-verifier
+    languages: [java, kotlin]
+    severity: ERROR
+    message: "HostnameVerifier that always returns true disables hostname validation - MITM-exploitable even with a valid cert."
+    metadata:
+      cwe: CWE-297
+      masvs: MSTG-NETWORK-3
+      category: network
+    patterns:
+      - pattern: |
+          new HostnameVerifier() {
+            ...
+            public boolean verify(...) { return true; }
+            ...
+          }
+
+  - id: android-cleartext-mixed-content
+    languages: [java, kotlin]
+    severity: WARNING
+    message: "MIXED_CONTENT_ALWAYS_ALLOW permits an HTTPS page to load HTTP sub-resources - lets a network attacker inject content despite the top-level page being HTTPS."
+    metadata:
+      cwe: CWE-296
+      masvs: MSTG-NETWORK-2
+      category: network
+    patterns:
+      - pattern: $SETTINGS.setMixedContentMode(WebSettings.MIXED_CONTENT_ALWAYS_ALLOW)
+
+  - id: android-log-sensitive-data
+    languages: [java, kotlin]
+    severity: WARNING
+    message: "Logging a value that looks like a credential/token/secret - readable via adb/crash reporters on many devices."
+    metadata:
+      cwe: CWE-532
+      masvs: MSTG-STORAGE-3
+      category: logging
+    patterns:
+      - pattern-either:
+          - pattern: android.util.Log.$LEVEL($TAG, $MSG)
+          - pattern: Log.$LEVEL($TAG, $MSG)
+      - metavariable-pattern:
+          metavariable: $MSG
+          patterns:
+            - pattern-regex: '(?i)(password|token|secret|api[_-]?key)'
+      - metavariable-pattern:
+          metavariable: $MSG
+          patterns:
+            - pattern-not-regex: '^"[^"]*"$'

narvy/rules/ios/objc/crypto.yml

@@ -0,0 +1,56 @@
+# Objective-C cryptography checks.
+
+- id: IOS-OBJC-CRYPTO-001
+  name: "Weak Cipher Algorithm (DES/3DES/RC4)"
+  pattern: 'kCCAlgorithm(DES|3DES|RC4)\b'
+  severity: "CRITICAL"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-327"
+    masvs: "MSTG-CRYPTO-4"
+    description: "DES, 3DES, and RC4 are broken/deprecated ciphers. DES has a trivially brute-forceable 56-bit key, 3DES is deprecated by NIST, RC4 has known keystream biases."
+    recommendation: "Use kCCAlgorithmAES with a 256-bit key and GCM (or CBC with a random IV + separate MAC) instead."
+
+- id: IOS-OBJC-CRYPTO-002
+  name: "ECB Mode Encryption"
+  pattern: 'kCCOptionECBMode\b'
+  severity: "CRITICAL"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-327"
+    masvs: "MSTG-CRYPTO-4"
+    description: "ECB mode encrypts identical plaintext blocks to identical ciphertext blocks, leaking structural patterns in the plaintext (the classic 'ECB penguin' problem)."
+    recommendation: "Use GCM or CBC mode with a fresh, random IV per encryption operation instead of ECB."
+
+- id: IOS-OBJC-CRYPTO-003
+  name: "Weak Hash Algorithm (MD5/SHA1)"
+  pattern: '\bCC_(MD5|SHA1)\s*\('
+  severity: "HIGH"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-328"
+    masvs: "MSTG-CRYPTO-4"
+    description: "MD5 and SHA-1 are cryptographically broken for security-sensitive use (collision attacks). Using them for password hashing, integrity checks, or signatures is insecure."
+    recommendation: "Use CC_SHA256 or CC_SHA512 for hashing. For password storage specifically, use a dedicated KDF (PBKDF2/bcrypt/scrypt/Argon2) via CommonKeyDerivation, never a bare hash."
+
+- id: IOS-OBJC-CRYPTO-004
+  name: "Weak PRNG for Security-Sensitive Value"
+  pattern: '(?<!arc4)\brandom\s*\(\s*\)|\bsrand\s*\(|\brand\s*\(\s*\)'
+  severity: "HIGH"
+  confidence: "MEDIUM"
+  details:
+    cwe: "CWE-338"
+    masvs: "MSTG-CRYPTO-6"
+    description: "random()/rand()/srand() are not cryptographically secure pseudo-random number generators - their output is predictable, which is dangerous if used to generate tokens, keys, nonces, or IVs."
+    recommendation: "Use SecRandomCopyBytes(kSecRandomDefault, ...) for any security-sensitive random value."
+
+- id: IOS-OBJC-CRYPTO-005
+  name: "Hardcoded Key Material Passed to CommonCrypto"
+  pattern: '(?:CCCrypt|CCCryptorCreate)\s*\([^;]*@"[^"]{6,}"[^;]*\)\s*;'
+  severity: "CRITICAL"
+  confidence: "MEDIUM"
+  details:
+    cwe: "CWE-321"
+    masvs: "MSTG-CRYPTO-1"
+    description: "A CommonCrypto call (CCCrypt/CCCryptorCreate) includes a string literal directly in its argument list - most commonly the hardcoded key or IV. Anyone who reads the source recovers the exact key/IV material."
+    recommendation: "Never embed key or IV material as a literal. Derive keys via the Keychain/Secure Enclave, or retrieve them from a secure backend at runtime; generate IVs randomly per-operation with SecRandomCopyBytes."