Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add Risk and Test - Sensitive Data Hardcoded in the App Package [data-hardcoded-app-package] #2565

Open
wants to merge 10 commits into
base: master
Choose a base branch
from
Open

Add Risk and Test - Sensitive Data Hardcoded in the App Package [data-hardcoded-app-package] #2565

wants to merge 10 commits into from

Conversation

juanmanuelmartinez-dekra
Copy link
Collaborator

@juanmanuelmartinez-dekra juanmanuelmartinez-dekra commented Feb 20, 2024 •
edited by cpholguera

Thank you for submitting a Pull Request to the OWASP MASTG. Please make sure that:

  • Your contribution is written in the 2nd person (e.g. you)
  • Your contribution is written in an active present form for as much as possible.
  • You have made sure that the reference section is up to date (e.g. please add sources you have used, make sure that the references to MITRE/MASVS/etc. are up to date)
  • Your contribution has proper formatted markdown and/or code
  • Any references to website have been formatted as [TEXT](URL “NAME”)
  • You verified/tested the effectiveness of your contribution (e.g.: is the code really an effective remediation? Please verify it works!)

This PR closes #2543.

@cpholguera
Copy link
Collaborator

cpholguera commented Feb 21, 2024 •
edited

Thanks for opening the PR @juanmanuelmartinez-dekra. Please remember to link PRs to Issues using "Closes #xxxx". In this case, simply add "Closes #2543" to the description. (I've added it for you)

@cpholguera
Copy link
Collaborator

@ZabGo I've answered to your comments and also added new suggestions, would you mind reviewing please?

@ZabGo
Copy link

ZabGo commented Apr 2, 2024 •
edited

@ZabGo I've answered to your comments and also added new suggestions, would you mind reviewing please?

@cpholguera so sorry completely missed you comment here. I apologise if it's blocked you @juanmanuelmartinez-dekra. I'll review that asap!

@cpholguera
Copy link
Collaborator

No problem. Thank you, @ZabGo!

@cpholguera cpholguera changed the title Create risk.md for data-hardcoded-app-package Add Risk and Test - Sensitive Data Hardcoded in the App Package [data-hardcoded-app-package] Apr 2, 2024
@juanmanuelmartinez-dekra @cpholguera
Update risks/MASVS-STORAGE/1-prevent-hardcoded/data-hardcoded-app-pac…
801635b 
…kage/risk.md

Co-authored-by: Carlos Holguera <perezholguera@gmail.com>
@juanmanuelmartinez-dekra @cpholguera
Update risks/MASVS-STORAGE/1-prevent-hardcoded/data-hardcoded-app-pac…
1ceb8f6 
…kage/risk.md

Co-authored-by: Carlos Holguera <perezholguera@gmail.com>
@juanmanuelmartinez-dekra @cpholguera
Update risks/MASVS-STORAGE/1-prevent-hardcoded/data-hardcoded-app-pac…
450c58d 
…kage/risk.md

Co-authored-by: Carlos Holguera <perezholguera@gmail.com>
@juanmanuelmartinez-dekra @cpholguera
Update risks/MASVS-STORAGE/1-prevent-hardcoded/data-hardcoded-app-pac…
5118317 
…kage/risk.md

Co-authored-by: Carlos Holguera <perezholguera@gmail.com>
@juanmanuelmartinez-dekra @cpholguera
Update risks/MASVS-STORAGE/1-prevent-hardcoded/data-hardcoded-app-pac…
dee63c8 
…kage/risk.md

Co-authored-by: Carlos Holguera <perezholguera@gmail.com>
@juanmanuelmartinez-dekra @cpholguera
Update risks/MASVS-STORAGE/1-prevent-hardcoded/data-hardcoded-app-pac…
1e18f86 
…kage/risk.md

Co-authored-by: Carlos Holguera <perezholguera@gmail.com>
@juanmanuelmartinez-dekra @ZabGo
Update risks/MASVS-STORAGE/1-prevent-hardcoded/data-hardcoded-app-pac…
433f903 
…kage/risk.md

Co-authored-by: Xavier Godard <42573001+ZabGo@users.noreply.github.com>
@cpholguera cpholguera self-requested a review April 27, 2024 09:53
cpholguera
cpholguera reviewed Apr 27, 2024
View reviewed changes
Copy link
Collaborator

@cpholguera cpholguera left a comment •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@juanmanuelmartinez-dekra the risk file is ready to go. Would you mind continuing now with the rest so we can cover for the original issue? That'd include:

  • adding at least one test folder with a test.md file
    • if you want to do Android, that'd be risks/MASVS-STORAGE/1-prevent-hardcoded/data-hardcoded-app-package/android-data-hardcoded-app-package/test.md
  • add at least one demo (and the corresponding files such as snippers and run.sh)
    • risks/MASVS-STORAGE/1-prevent-hardcoded/data-hardcoded-app-package/android-data-hardcoded-app-package/demo-1/demo.md

In our guidelines you can find links to 3 existing risks that include tests and demos as well as the "how to write" sections.

You can also see Jan's PR here: https://github.com/OWASP/owasp-mastg/pull/2594/files

If you have any questions please let me know! Thanks so much!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@cpholguera cpholguera cpholguera requested changes

@ZabGo ZabGo ZabGo left review comments

Requested changes must be addressed to merge this pull request.

Assignees

@juanmanuelmartinez-dekra juanmanuelmartinez-dekra

Labels
changes-requested
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

New Risk - Sensitive Data Hardcoded in the App Package [data-hardcoded-app-package]
3 participants
@juanmanuelmartinez-dekra @cpholguera @ZabGo