应用安全检测报告

[android:usesCleartextTraffic=true]
应用允许明文网络流量（如 HTTP、FTP 协议、DownloadManager、MediaPlayer 等）。API 级别 27 及以下默认启用，28 及以上默认禁用。明文流量缺乏机密性、完整性和真实性保护，攻击者可窃听或篡改传输数据。建议关闭明文流量，仅使用加密协议。

Permission: com.google.android.c2dm.permission.SEND [android:exported=true]
检测到  Broadcast Receiver 已导出并受未在本应用定义的权限保护。请在权限定义处核查其保护级别。若为 normal 或 dangerous，恶意应用可申请并与组件交互；若为 signature，仅同证书签名应用可访问。

应用程序使用不安全的随机数生成器
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-random-number-generators

Files:
com/hjq/base/BaseActivity.java, line(s) 26
com/hjq/permissions/PermissionFragment.java, line(s) 13
com/otaliastudios/cameraview/filters/DocumentaryFilter.java, line(s) 6
com/otaliastudios/cameraview/filters/GrainFilter.java, line(s) 7
com/otaliastudios/cameraview/filters/LomoishFilter.java, line(s) 6
com/otaliastudios/cameraview/video/encoding/AudioNoise.java, line(s) 6

应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#external-storage

Files:
com/danikula/videocache/StorageUtils.java, line(s) 18,35
com/hbzhou/open/flowcamera/CameraInterface.java, line(s) 510
com/hbzhou/open/flowcamera/util/FileUtil.java, line(s) 13,52
com/righthandbaseball/righthand/manager/CacheDataManager.java, line(s) 22,33
com/righthandbaseball/righthand/ui/activity/CameraActivity.java, line(s) 192,194
com/righthandbaseball/righthand/ui/activity/ImageCropActivity.java, line(s) 265
com/righthandbaseball/righthand/ui/activity/PdfActivity.java, line(s) 154
com/righthandbaseball/righthand/ui/activity/VideoPublishingActivity.java, line(s) 1145
com/righthandbaseball/righthand/utils/UriUtils.java, line(s) 27,96
com/yalantis/ucrop/util/FileUtils.java, line(s) 153
top/zibin/luban/LubanUtils.java, line(s) 27,29

可能存在跨域漏洞。在 WebView 中启用从 URL 访问文件可能会泄漏文件系统中的敏感信息
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#static-analysis-6

Files:
com/righthandbaseball/righthand/ui/activity/PdfActivity.java, line(s) 112,118
com/righthandbaseball/righthand/widget/BrowserView.java, line(s) 123,125

文件可能包含硬编码的敏感信息，如用户名、密码、密钥等
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#checking-memory-for-sensitive-data-mstg-storage-10

Files:
com/hjq/permissions/StartActivityManager.java, line(s) 9
com/jeremyliao/liveeventbus/ipc/consts/IpcConst.java, line(s) 5
com/righthandbaseball/righthand/http/api/UpdateUserInfoApi.java, line(s) 281
com/righthandbaseball/righthand/http/bean/MineBean.java, line(s) 759
com/righthandbaseball/righthand/http/bean/ScoutsReportBean.java, line(s) 289
com/righthandbaseball/righthand/ui/activity/RegisterBaseInfoActivity.java, line(s) 51
com/righthandbaseball/righthand/ui/activity/RegisterBaseInfoTwoActivity.java, line(s) 50
com/righthandbaseball/righthand/ui/activity/ScoutRegisterBaseInfoActivity.java, line(s) 52

MD5是已知存在哈希冲突的弱哈希
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
com/danikula/videocache/ProxyCacheUtils.java, line(s) 67
com/hjq/http/model/FileWrapper.java, line(s) 47

应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04h-Testing-Code-Quality.md#injection-flaws-mstg-arch-2-and-mstg-platform-2

Files:
com/danikula/videocache/sourcestorage/DatabaseSourceInfoStorage.java, line(s) 6,7,28

IP地址泄露


Files:
com/danikula/videocache/HttpProxyCacheServer.java, line(s) 31

Firebase远程配置URL （ https://firebaseremoteconfig.googleapis.com/v1/projects/149704107565/namespaces/firebase:fetch?key=AIzaSyDzlADNj0CdGU0qTyUvjlds6ja6G2dvk2s ） 已启用。请确保这些配置不包含敏感信息。响应内容如下所示：

{
    "entries": {
        "android_minimum_version": "49",
        "ios_minimum_version": "202212220000"
    },
    "state": "UPDATE",
    "templateVersion": "8"
}

此应用程序有多个2隐私跟踪程序。跟踪器可以跟踪设备或用户，是终端用户的隐私问题。

从应用程序中识别出以下机密确保这些不是机密或私人信息
"com.google.firebase.crashlytics.mapping_file_id" : "00000000000000000000000000000000"
"google_api_key" : "AIzaSyDzlADNj0CdGU0qTyUvjlds6ja6G2dvk2s"
"google_app_id" : "1:149704107565:android:06c1f8b5be7b08ff167aa4"
"google_crash_reporting_api_key" : "AIzaSyDzlADNj0CdGU0qTyUvjlds6ja6G2dvk2s"