应用安全检测报告

[android:usesCleartextTraffic=true]
应用允许明文网络流量（如 HTTP、FTP 协议、DownloadManager、MediaPlayer 等）。API 级别 27 及以下默认启用，28 及以上默认禁用。明文流量缺乏机密性、完整性和真实性保护，攻击者可窃听或篡改传输数据。建议关闭明文流量，仅使用加密协议。

[android:exported=true]
检测到  Broadcast Receiver 已导出，未受任何权限保护，任意应用均可访问。

Permission: com.google.android.c2dm.permission.SEND [android:exported=true]
检测到  Broadcast Receiver 已导出并受未在本应用定义的权限保护。请在权限定义处核查其保护级别。若为 normal 或 dangerous，恶意应用可申请并与组件交互；若为 signature，仅同证书签名应用可访问。

Permission: android.permission.DUMP [android:exported=true]
检测到  Broadcast Receiver 已导出并受未在本应用定义的权限保护。请在权限定义处核查其保护级别。若为 normal 或 dangerous，恶意应用可申请并与组件交互；若为 signature，仅同证书签名应用可访问。

应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#external-storage

Files:
com/dmcbig/mediapicker/utils/FileUtils.java, line(s) 23,24,26,51,111
com/itfenbao/snplugin/camera/SnCameraModule.java, line(s) 29
com/itfenbao/snplugin/pinfo/PInfoModule.java, line(s) 210,276
com/nostra13/dcloudimageloader/utils/StorageUtils.java, line(s) 22,41,41,46
uts/sdk/modules/DCloudUniNetwork/SimpleDownloadCallback.java, line(s) 86
uts/sdk/modules/DCloudUniNetwork/UploadController.java, line(s) 322
uts/sdk/modules/jgDeviceData/IndexKt.java, line(s) 90,98,106,161

文件可能包含硬编码的敏感信息，如用户名、密码、密钥等
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#checking-memory-for-sensitive-data-mstg-storage-10

Files:
com/appsflyer/uniplugin/AppsFlyerConstants.java, line(s) 9,41
com/hjq/permissions/StartActivityManager.java, line(s) 9
com/itfenbao/snplugin/firebase/cm/SnUniFirebaseMessagingService.java, line(s) 31,32,33
uts/sdk/modules/DCloudUniNetwork/NetworkUtil.java, line(s) 35
uts/sdk/modules/DCloudUniNetwork/RequestNetworkListener.java, line(s) 75

IP地址泄露


Files:
uts/sdk/modules/DCloudUniGetDeviceInfo/EmulatorCheckUtil.java, line(s) 239

应用程序使用不安全的随机数生成器
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-random-number-generators

Files:
com/appsflyer/internal/AFb1bSDK.java, line(s) 20
com/hjq/permissions/PermissionFragment.java, line(s) 15

应用程序创建临时文件。敏感信息永远不应该被写进临时文件


Files:
com/dmcbig/mediapicker/TakePhotoActivity.java, line(s) 25
com/dmcbig/mediapicker/utils/FileUtils.java, line(s) 34

MD5是已知存在哈希冲突的弱哈希
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
com/nostra13/dcloudimageloader/cache/disc/naming/Md5FileNameGenerator.java, line(s) 19

此应用程序有多个2隐私跟踪程序。跟踪器可以跟踪设备或用户，是终端用户的隐私问题。

从应用程序中识别出以下机密确保这些不是机密或私人信息
DCLOUD的 "AD_ID" : "126599290804"
DCLOUD的 "CHANNEL" : "google"
DCLOUD的 "DCLOUD_STREAMAPP_CHANNEL" : "cash.efectivo.okredito.prestamos.tala.credito.oxxo|__UNI__C42DF0D|126599290804|google"
DCLOUD的 "ApplicationId" : "cash.efectivo.okredito.prestamos.tala.credito.oxxo"
DCLOUD的 "APPID" : "__UNI__C42DF0D"
"dcloud_permissions_reauthorization" : "reauthorize"
"google_api_key" : "AIzaSyCES_6MhLRkgvoRHgVefGClxZqpW0Rx7LQ"
"google_app_id" : "1:360021882808:android:77711ac594752ef839814d"
"google_crash_reporting_api_key" : "AIzaSyCES_6MhLRkgvoRHgVefGClxZqpW0Rx7LQ"
E3F9E1E0CF99D0E56A055BA65E241B3399F7CEA524326B0CDD6EC1327ED0FDC1
0f215ac7f7476209dfa9576697d5f25f8
FBA3AF4E7757D9016E953FB3EE4671CA2BD9AF725F9A53D52ED4A38EAAA08901
3BAF59A2E5331C30675FAB35FF5FFF0D116142D3D4664F1C3CB804068B40614F
FFE391E0EA186D0734ED601E4E70E3224B7309D48E2075BAC46D8C667EAE7212