From 47c97c68cfa586cb50cc097ef2f64e9acb512ec4 Mon Sep 17 00:00:00 2001 From: Carlos Holguera Date: Sun, 19 Jul 2026 18:24:11 +0200 Subject: [PATCH 1/5] update MASWE IDs for MASWE v1.0.0 rc --- tests-beta/android/MASVS-AUTH/MASTG-TEST-0326.md | 2 +- tests-beta/android/MASVS-AUTH/MASTG-TEST-0327.md | 2 +- tests-beta/android/MASVS-AUTH/MASTG-TEST-0328.md | 2 +- tests-beta/android/MASVS-AUTH/MASTG-TEST-0329.md | 2 +- tests-beta/android/MASVS-AUTH/MASTG-TEST-0330.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0222.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0223.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0245.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0272.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0274.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0337.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0339.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0372.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0374.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0375.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0382.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0392.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0398.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0399.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0400.md | 2 +- tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0204.md | 2 +- tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0205.md | 2 +- tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0208.md | 2 +- tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0212.md | 2 +- tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0221.md | 2 +- tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0232.md | 2 +- tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0307.md | 2 +- tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0308.md | 2 +- tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0309.md | 2 +- tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0310.md | 2 +- tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0312.md | 2 +- tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0350.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0217.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0218.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0233.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0234.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0235.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0236.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0237.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0238.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0239.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0242.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0243.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0244.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0282.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0283.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0284.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0285.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0286.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0295.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0250.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0251.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0252.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0253.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0258.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0289.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0291.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0292.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0293.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0294.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0315.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0316.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0320.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0334.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0340.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0355.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0356.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0357.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0364.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0365.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0366.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0381.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0393.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0394.md | 2 +- tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0206.md | 2 +- tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0254.md | 2 +- tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0255.md | 2 +- tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0256.md | 2 +- tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0257.md | 2 +- tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0318.md | 2 +- tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0319.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0224.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0225.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0226.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0227.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0247.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0249.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0263.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0264.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0265.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0288.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0324.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0325.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0338.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0341.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0351.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0352.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0353.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0368.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0369.md | 2 +- tests-beta/android/MASVS-STORAGE/MASTG-TEST-0200.md | 2 +- tests-beta/android/MASVS-STORAGE/MASTG-TEST-0201.md | 2 +- tests-beta/android/MASVS-STORAGE/MASTG-TEST-0202.md | 2 +- tests-beta/android/MASVS-STORAGE/MASTG-TEST-0207.md | 2 +- tests-beta/android/MASVS-STORAGE/MASTG-TEST-0216.md | 2 +- tests-beta/android/MASVS-STORAGE/MASTG-TEST-0262.md | 2 +- tests-beta/android/MASVS-STORAGE/MASTG-TEST-0287.md | 2 +- tests-beta/android/MASVS-STORAGE/MASTG-TEST-0304.md | 2 +- tests-beta/android/MASVS-STORAGE/MASTG-TEST-0305.md | 2 +- tests-beta/android/MASVS-STORAGE/MASTG-TEST-0306.md | 2 +- tests-beta/ios/MASVS-AUTH/MASTG-TEST-0266.md | 2 +- tests-beta/ios/MASVS-AUTH/MASTG-TEST-0267.md | 2 +- tests-beta/ios/MASVS-AUTH/MASTG-TEST-0268.md | 2 +- tests-beta/ios/MASVS-AUTH/MASTG-TEST-0269.md | 2 +- tests-beta/ios/MASVS-AUTH/MASTG-TEST-0270.md | 2 +- tests-beta/ios/MASVS-AUTH/MASTG-TEST-0271.md | 2 +- tests-beta/ios/MASVS-CODE/MASTG-TEST-0228.md | 2 +- tests-beta/ios/MASVS-CODE/MASTG-TEST-0229.md | 2 +- tests-beta/ios/MASVS-CODE/MASTG-TEST-0230.md | 2 +- tests-beta/ios/MASVS-CODE/MASTG-TEST-0273.md | 2 +- tests-beta/ios/MASVS-CODE/MASTG-TEST-0275.md | 2 +- tests-beta/ios/MASVS-CODE/MASTG-TEST-0383.md | 2 +- tests-beta/ios/MASVS-CODE/MASTG-TEST-0384.md | 2 +- tests-beta/ios/MASVS-CODE/MASTG-TEST-0386.md | 2 +- tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0209.md | 2 +- tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0210.md | 2 +- tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0211.md | 2 +- tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0213.md | 2 +- tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0214.md | 2 +- tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0311.md | 2 +- tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0317.md | 2 +- tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0349.md | 2 +- tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0321.md | 2 +- tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0322.md | 2 +- tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0323.md | 2 +- tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0342.md | 2 +- tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0343.md | 2 +- tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0344.md | 2 +- tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0345.md | 2 +- tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0348.md | 2 +- tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0385.md | 2 +- tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0396.md | 2 +- tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0397.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0276.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0277.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0278.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0279.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0280.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0290.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0331.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0332.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0333.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0335.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0336.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0346.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0347.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0370.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0371.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0376.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0377.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0378.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0379.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0380.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0389.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0390.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0395.md | 2 +- tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0281.md | 2 +- tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0360.md | 2 +- tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0361.md | 2 +- tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0362.md | 2 +- tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0363.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0219.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0220.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0240.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0241.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0246.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0248.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0261.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0354.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0358.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0359.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0367.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0387.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0391.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0401.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0402.md | 2 +- tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0215.md | 2 +- tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0298.md | 2 +- tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0299.md | 2 +- tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0300.md | 2 +- tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0301.md | 2 +- tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0302.md | 2 +- tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0303.md | 2 +- tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0313.md | 2 +- tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0314.md | 2 +- tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0388.md | 2 +- 196 files changed, 196 insertions(+), 196 deletions(-) diff --git a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0326.md b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0326.md index 8ea0ad130e8..07fd026c20c 100644 --- a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0326.md +++ b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0326.md @@ -4,7 +4,7 @@ title: References to APIs Allowing Fallback to Non-Biometric Authentication id: MASTG-TEST-0326 apis: [BiometricPrompt, BiometricManager.Authenticators, setAllowedAuthenticators] type: [static, code] -weakness: MASWE-0045 +weakness: MASWE-0022 profiles: [L2] knowledge: [MASTG-KNOW-0001] best-practices: [MASTG-BEST-0031] diff --git a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0327.md b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0327.md index 7812f6d94f2..66aed4fbb79 100644 --- a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0327.md +++ b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0327.md @@ -4,7 +4,7 @@ title: References to APIs for Event-Bound Biometric Authentication id: MASTG-TEST-0327 apis: [BiometricPrompt, BiometricPrompt.CryptoObject, authenticate] type: [static, code] -weakness: MASWE-0044 +weakness: MASWE-0021 profiles: [L2] knowledge: [MASTG-KNOW-0001, MASTG-KNOW-0043, MASTG-KNOW-0047, MASTG-KNOW-0012] best-practices: [MASTG-BEST-0036] diff --git a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0328.md b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0328.md index add7b1f1987..68747b010a3 100644 --- a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0328.md +++ b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0328.md @@ -4,7 +4,7 @@ title: References to APIs Detecting Biometric Enrollment Changes id: MASTG-TEST-0328 apis: [KeyGenParameterSpec.Builder, setInvalidatedByBiometricEnrollment] type: [static, code] -weakness: MASWE-0046 +weakness: MASWE-0023 profiles: [L2] knowledge: [MASTG-KNOW-0001] best-practices: [MASTG-BEST-0037] diff --git a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0329.md b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0329.md index 6294d18b6ef..e178de86d0d 100644 --- a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0329.md +++ b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0329.md @@ -4,7 +4,7 @@ title: References to APIs Enforcing Authentication without Explicit User Action id: MASTG-TEST-0329 apis: [BiometricPrompt.PromptInfo.Builder, setConfirmationRequired] type: [static, code] -weakness: MASWE-0044 +weakness: MASWE-0021 profiles: [L2] knowledge: [MASTG-KNOW-0001] best-practices: [MASTG-BEST-0038] diff --git a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0330.md b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0330.md index 92a76122e7c..4ed7e4d6c33 100644 --- a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0330.md +++ b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0330.md @@ -4,7 +4,7 @@ title: References to APIs for Keys used in Biometric Authentication with Extende id: MASTG-TEST-0330 apis: [KeyGenParameterSpec.Builder, setUserAuthenticationParameters, setUserAuthenticationValidityDurationSeconds] type: [static, code] -weakness: MASWE-0044 +weakness: MASWE-0021 profiles: [L2] knowledge: [MASTG-KNOW-0001, MASTG-KNOW-0043, MASTG-KNOW-0047, MASTG-KNOW-0012] best-practices: [MASTG-BEST-0036] diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0222.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0222.md index e9f31604e33..3a1f1933b34 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0222.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0222.md @@ -4,7 +4,7 @@ platform: android id: MASTG-TEST-0222 deprecated_since: 21 type: [static, code] -weakness: MASWE-0116 +weakness: MASWE-0045 profiles: [L2] knowledge: [MASTG-KNOW-0006] --- diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0223.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0223.md index c229f53ec2c..13927453f1f 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0223.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0223.md @@ -3,7 +3,7 @@ title: Stack Canaries Not Enabled platform: android id: MASTG-TEST-0223 type: [static, code] -weakness: MASWE-0116 +weakness: MASWE-0045 profiles: [L2] knowledge: [MASTG-KNOW-0006] --- diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0245.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0245.md index c29097f6098..f13a8958090 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0245.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0245.md @@ -4,7 +4,7 @@ title: References to Platform Version APIs id: MASTG-TEST-0245 apis: [Build] type: [static, code] -weakness: MASWE-0077 +weakness: MASWE-0042 best-practices: [] profiles: [L2] --- diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0272.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0272.md index cede3936056..23e52ad0a43 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0272.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0272.md @@ -3,7 +3,7 @@ platform: android title: Identify Dependencies with Known Vulnerabilities in the Android Project id: MASTG-TEST-0272 type: [static, code] -weakness: MASWE-0076 +weakness: MASWE-0041 profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0274.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0274.md index f1f93696822..892e126a369 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0274.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0274.md @@ -3,7 +3,7 @@ platform: android title: Dependencies with Known Vulnerabilities in the App's SBOM id: MASTG-TEST-0274 type: [static, developer] -weakness: MASWE-0076 +weakness: MASWE-0041 profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0337.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0337.md index 9e63a757ed1..9f2049b7c69 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0337.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0337.md @@ -3,7 +3,7 @@ title: References to Object Deserialization of Untrusted Data platform: android id: MASTG-TEST-0337 type: [static, code] -weakness: MASWE-0088 +weakness: MASWE-0048 profiles: [L1, L2] knowledge: [MASTG-KNOW-0021] --- diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0339.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0339.md index a6dc24c5977..f5cf4a63aa7 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0339.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0339.md @@ -3,7 +3,7 @@ title: SQL Injection in Content Providers platform: android id: MASTG-TEST-0339 type: [static, code] -weakness: MASWE-0086 +weakness: MASWE-0048 best-practices: [MASTG-BEST-0039] profiles: [L1, L2] knowledge: [MASTG-KNOW-0117] diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0372.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0372.md index 65d211b6182..f7288c8a66f 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0372.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0372.md @@ -3,7 +3,7 @@ title: Implicit Intents Used for Internal App Communication platform: android id: MASTG-TEST-0372 type: [static, code, manual] -weakness: MASWE-0066 +weakness: MASWE-0035 best-practices: [MASTG-BEST-0056] knowledge: [MASTG-KNOW-0025] profiles: [L1, L2] diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0374.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0374.md index 2eb2039380b..2bce69c4ceb 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0374.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0374.md @@ -3,7 +3,7 @@ title: References to Implicit Intents Carrying Sensitive Extras platform: android id: MASTG-TEST-0374 type: [static, code, manual] -weakness: MASWE-0066 +weakness: MASWE-0035 best-practices: [MASTG-BEST-0056] knowledge: [MASTG-KNOW-0025] profiles: [L1, L2] diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0375.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0375.md index 3c90ef602a0..4b87ffa604a 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0375.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0375.md @@ -3,7 +3,7 @@ title: Missing Validation of Data Returned from Implicit Intents platform: android id: MASTG-TEST-0375 type: [dynamic, hooks, manual] -weakness: MASWE-0083 +weakness: MASWE-0048 best-practices: [MASTG-BEST-0057] knowledge: [MASTG-KNOW-0025, MASTG-KNOW-0138] profiles: [L1, L2] diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0382.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0382.md index a20649b9d2b..6e6e4b54cd2 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0382.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0382.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of Enforced Updating APIs id: MASTG-TEST-0382 type: [dynamic, network, hooks, manual] -weakness: MASWE-0075 +weakness: MASWE-0040 profiles: [L2] knowledge: [MASTG-KNOW-0023] --- diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0392.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0392.md index 27129bd79ca..154ee5c618a 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0392.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0392.md @@ -3,7 +3,7 @@ platform: android title: References to Enforced Updating APIs id: MASTG-TEST-0392 type: [static, code, manual] -weakness: MASWE-0075 +weakness: MASWE-0040 profiles: [L2] knowledge: [MASTG-KNOW-0023] --- diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0398.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0398.md index 6dca166a41a..8a4a46a0027 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0398.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0398.md @@ -4,7 +4,7 @@ title: References to WebViewClient URL Loading Handlers id: MASTG-TEST-0398 apis: [WebView, WebViewClient, shouldOverrideUrlLoading, shouldInterceptRequest, setWebViewClient] type: [static, code, manual] -weakness: MASWE-0071 +weakness: MASWE-0038 best-practices: [] profiles: [L1, L2] knowledge: [MASTG-KNOW-0018] diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0399.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0399.md index 20540462cd3..645ac000dcf 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0399.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0399.md @@ -4,7 +4,7 @@ title: SafeBrowsing Disabled id: MASTG-TEST-0399 apis: [WebView, WebSettings, EnableSafeBrowsing, setSafeBrowsingEnabled] type: [static, config, code] -weakness: MASWE-0071 +weakness: MASWE-0038 best-practices: [] knowledge: [MASTG-KNOW-0018] available_since: 27 diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0400.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0400.md index 784e8fbc821..13f70229e9d 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0400.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0400.md @@ -4,7 +4,7 @@ title: Runtime Use of WebViewClient URL Loading Handlers id: MASTG-TEST-0400 apis: [WebView, WebViewClient, shouldOverrideUrlLoading, shouldInterceptRequest, Uri, getHost, getScheme, getPath] type: [dynamic, hooks, manual] -weakness: MASWE-0071 +weakness: MASWE-0038 best-practices: [] profiles: [L1, L2] knowledge: [MASTG-KNOW-0018] diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0204.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0204.md index b46bbf87ff8..3064682f172 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0204.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0204.md @@ -7,7 +7,7 @@ best-practices: [MASTG-BEST-0001] prerequisites: - identify-sensitive-data - identify-security-relevant-contexts -weakness: MASWE-0027 +weakness: MASWE-0016 profiles: [L1, L2] knowledge: [MASTG-KNOW-0013] --- diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0205.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0205.md index 31441e0f5aa..5b26f543dde 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0205.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0205.md @@ -7,7 +7,7 @@ best-practices: [MASTG-BEST-0001] prerequisites: - identify-sensitive-data - identify-security-relevant-contexts -weakness: MASWE-0027 +weakness: MASWE-0016 profiles: [L1, L2] knowledge: [MASTG-KNOW-0013] --- diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0208.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0208.md index 2c57c40b747..28f55692660 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0208.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0208.md @@ -3,7 +3,7 @@ platform: android title: Insufficient Key Sizes id: MASTG-TEST-0208 type: [static, code] -weakness: MASWE-0009 +weakness: MASWE-0007 profiles: [L1, L2] knowledge: [MASTG-KNOW-0012] --- diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0212.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0212.md index b7e012cf5bb..bd5cb1033d3 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0212.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0212.md @@ -3,7 +3,7 @@ title: Use of Hardcoded Cryptographic Keys in Code platform: android id: MASTG-TEST-0212 type: [static, code] -weakness: MASWE-0014 +weakness: MASWE-0005 profiles: [L1, L2] knowledge: [MASTG-KNOW-0012] --- diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0221.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0221.md index 21139bd89d8..d0d0185beb4 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0221.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0221.md @@ -3,7 +3,7 @@ title: Broken Symmetric Encryption Algorithms platform: android id: MASTG-TEST-0221 type: [static, code, manual] -weakness: MASWE-0020 +weakness: MASWE-0011 best-practices: [MASTG-BEST-0009] profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0232.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0232.md index 941bc4749e0..b834865dff2 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0232.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0232.md @@ -3,7 +3,7 @@ title: Broken Symmetric Encryption Modes platform: android id: MASTG-TEST-0232 type: [static, code, manual] -weakness: MASWE-0020 +weakness: MASWE-0011 best-practices: [MASTG-BEST-0005] profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0307.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0307.md index 5fccfa8e423..d79f76d27eb 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0307.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0307.md @@ -3,7 +3,7 @@ platform: android title: References to Asymmetric Key Pairs Used For Multiple Purposes id: MASTG-TEST-0307 type: [static, code] -weakness: MASWE-0012 +weakness: MASWE-0011 profiles: [L2] knowledge: [MASTG-KNOW-0012] --- diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0308.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0308.md index e1bd7c84b96..c3ec71eab06 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0308.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0308.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of Asymmetric Key Pairs Used For Multiple Purposes id: MASTG-TEST-0308 type: [dynamic, hooks] -weakness: MASWE-0012 +weakness: MASWE-0011 profiles: [L2] knowledge: [MASTG-KNOW-0012] --- diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0309.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0309.md index 080d4cd13c1..6e1c16c3976 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0309.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0309.md @@ -3,7 +3,7 @@ platform: android title: References to Reused Initialization Vectors in Symmetric Encryption id: MASTG-TEST-0309 type: [static, code] -weakness: MASWE-0022 +weakness: MASWE-0011 status: placeholder profiles: [L2] note: Reusing a symmetric key is acceptable when IVs or nonces follow the rules defined for the mode. NIST SP 800 38A states that CBC requires a fresh or unpredictable IV for every encryption. NIST SP 800 38D states that counter based modes require a nonce that never repeats under the same key. Repeating a key and IV or nonce pair defeats confidentiality and can also undermine integrity. diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0310.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0310.md index a81ec237f27..a549f20e8e0 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0310.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0310.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of Reused Initialization Vectors in Symmetric Encryption id: MASTG-TEST-0310 type: [dynamic, hooks] -weakness: MASWE-0022 +weakness: MASWE-0011 status: placeholder profiles: [L2] note: Reusing a symmetric key is acceptable when IVs or nonces follow the rules defined for the mode. NIST SP 800 38A states that CBC requires a fresh or unpredictable IV for every encryption. NIST SP 800 38D states that counter based modes require a nonce that never repeats under the same key. Repeating a key and IV or nonce pair defeats confidentiality and can also undermine integrity. diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0312.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0312.md index 4509c97aa82..df6cdbb8d8b 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0312.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0312.md @@ -3,7 +3,7 @@ title: References to Explicit Security Provider in Cryptographic APIs platform: android id: MASTG-TEST-0312 type: [static, code] -weakness: MASWE-0020 +weakness: MASWE-0011 best-practices: [MASTG-BEST-0020] profiles: [L1, L2] knowledge: [MASTG-KNOW-0011] diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0350.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0350.md index 002a6dc1bda..c20d6410971 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0350.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0350.md @@ -3,7 +3,7 @@ title: Runtime Use of Broken Symmetric Encryption Modes platform: android id: MASTG-TEST-0350 type: [dynamic, hooks, manual] -weakness: MASWE-0020 +weakness: MASWE-0011 best-practices: [MASTG-BEST-0005] profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0217.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0217.md index bb10d789427..59f811a1f0a 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0217.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0217.md @@ -3,7 +3,7 @@ title: Insecure TLS Protocols Explicitly Allowed in Code platform: android id: MASTG-TEST-0217 type: [static, code] -weakness: MASWE-0050 +weakness: MASWE-0025 profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0218.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0218.md index aafa8f6cc11..0c146ed1690 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0218.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0218.md @@ -3,7 +3,7 @@ title: Insecure TLS Protocols in Network Traffic platform: android id: MASTG-TEST-0218 type: [dynamic, network] -weakness: MASWE-0050 +weakness: MASWE-0025 profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0233.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0233.md index dfa2aa94f5d..01e88c01d8a 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0233.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0233.md @@ -3,7 +3,7 @@ title: Hardcoded HTTP URLs platform: android id: MASTG-TEST-0233 type: [static, code] -weakness: MASWE-0050 +weakness: MASWE-0025 related-tests: [MASTG-TEST-0235, MASTG-TEST-0236, MASTG-TEST-0238] profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0234.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0234.md index f95a73d6de8..adc184ec4bd 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0234.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0234.md @@ -3,7 +3,7 @@ title: Missing Implementation of Server Hostname Verification with SSLSockets platform: android id: MASTG-TEST-0234 type: [static, code] -weakness: MASWE-0052 +weakness: MASWE-0026 profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0235.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0235.md index 0fe10dfacac..9cdfcbaa6af 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0235.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0235.md @@ -3,7 +3,7 @@ title: Android App Configurations Allowing Cleartext Traffic platform: android id: MASTG-TEST-0235 type: [static, code] -weakness: MASWE-0050 +weakness: MASWE-0025 profiles: [L1, L2] knowledge: [MASTG-KNOW-0014] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0236.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0236.md index 4003ded3287..ce77a557972 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0236.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0236.md @@ -3,7 +3,7 @@ title: Cleartext Traffic Observed on the Network platform: network id: MASTG-TEST-0236 type: [dynamic, network] -weakness: MASWE-0050 +weakness: MASWE-0025 profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0237.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0237.md index 70eb2fd825a..8c6df7e2720 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0237.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0237.md @@ -3,7 +3,7 @@ title: Cross-Platform Framework Configurations Allowing Cleartext Traffic platform: android id: MASTG-TEST-0237 type: [static, code] -weakness: MASWE-0050 +weakness: MASWE-0025 status: placeholder note: Cross-platform frameworks (e.g. Flutter, React native, ...), typically have their own implementations for HTTP libraries, where cleartext traffic can be allowed. profiles: [L1, L2] diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0238.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0238.md index b3933168441..2f163bf8c0c 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0238.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0238.md @@ -3,7 +3,7 @@ title: Runtime Use of Network APIs Transmitting Cleartext Traffic platform: android id: MASTG-TEST-0238 type: [dynamic, hooks] -weakness: MASWE-0050 +weakness: MASWE-0025 status: placeholder note: Using Frida, you can trace all traffic of the app, mitigating the limitation of the dynamic analysis that you do not know which app, or which location is responsible for the traffic. Using Frida (and `.backtrace()`), you can be sure this is from the analyzed app, and know the exact location. A new limitation is then that all relevant networking APIs need to be instrumented. profiles: [L1, L2] diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0239.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0239.md index 90a470194ae..045620024fa 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0239.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0239.md @@ -3,7 +3,7 @@ title: Using low-level APIs (e.g. Socket) to set up a custom HTTP connection platform: android id: MASTG-TEST-0239 type: [static, code] -weakness: MASWE-0050 +weakness: MASWE-0025 status: placeholder note: This test could also be for MASWE-0049 but we'd need to support multiple weaknesses. profiles: [L1, L2] diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0242.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0242.md index 50950c6a4ca..25a3dcfac9c 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0242.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0242.md @@ -3,7 +3,7 @@ title: Missing Certificate Pinning in Network Security Configuration platform: android id: MASTG-TEST-0242 type: [static, code] -weakness: MASWE-0047 +weakness: MASWE-0027 profiles: [L2] knowledge: [MASTG-KNOW-0014, MASTG-KNOW-0015] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0243.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0243.md index 85db7f45a6e..3b724f78a3a 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0243.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0243.md @@ -3,7 +3,7 @@ title: Expired Certificate Pins in the Network Security Configuration platform: android id: MASTG-TEST-0243 type: [static, code] -weakness: MASWE-0047 +weakness: MASWE-0027 profiles: [L2] knowledge: [MASTG-KNOW-0014, MASTG-KNOW-0015] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0244.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0244.md index bd76a802000..bd66406ab98 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0244.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0244.md @@ -3,7 +3,7 @@ title: Missing Certificate Pinning in Network Traffic platform: network id: MASTG-TEST-0244 type: [dynamic, network] -weakness: MASWE-0047 +weakness: MASWE-0027 profiles: [L2] knowledge: [MASTG-KNOW-0015] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0282.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0282.md index 8d8bd772dc0..ae1a481d9ba 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0282.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0282.md @@ -3,7 +3,7 @@ title: Unsafe Custom Trust Evaluation platform: android id: MASTG-TEST-0282 type: [static, code, manual] -weakness: MASWE-0052 +weakness: MASWE-0026 best-practices: [MASTG-BEST-0021] profiles: [L1, L2] knowledge: [MASTG-KNOW-0010] diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0283.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0283.md index 3bd72a57a1f..47ac9665e54 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0283.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0283.md @@ -3,7 +3,7 @@ title: Incorrect Implementation of Server Hostname Verification platform: android id: MASTG-TEST-0283 type: [static, code, manual] -weakness: MASWE-0052 +weakness: MASWE-0026 profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0284.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0284.md index a9affe6e23c..b92a6219fa6 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0284.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0284.md @@ -3,7 +3,7 @@ title: Incorrect SSL Error Handling in WebViews platform: android id: MASTG-TEST-0284 type: [static, code, manual] -weakness: MASWE-0052 +weakness: MASWE-0026 best-practices: [MASTG-BEST-0021] profiles: [L1, L2] knowledge: [MASTG-KNOW-0010] diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0285.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0285.md index 2f7c9f46cce..cc1ad3de8f3 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0285.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0285.md @@ -4,7 +4,7 @@ platform: android id: MASTG-TEST-0285 type: [static, code] deprecated_since: 24 -weakness: MASWE-0052 +weakness: MASWE-0026 profiles: [L1, L2] knowledge: [MASTG-KNOW-0014] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0286.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0286.md index 9a053b885e6..7545c0b359f 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0286.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0286.md @@ -3,7 +3,7 @@ title: Network Security Configuration Allowing Trust in User-Provided CAs platform: android id: MASTG-TEST-0286 type: [static, code] -weakness: MASWE-0052 +weakness: MASWE-0026 profiles: [L1, L2] knowledge: [MASTG-KNOW-0014] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0295.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0295.md index b1613175f90..1ebc5b25900 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0295.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0295.md @@ -3,7 +3,7 @@ title: GMS Security Provider Not Updated platform: android id: MASTG-TEST-0295 type: [static, code] -weakness: MASWE-0052 +weakness: MASWE-0026 profiles: [L2] best-practices: [MASTG-BEST-0020] knowledge: [MASTG-KNOW-0011, MASTG-KNOW-0010] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0250.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0250.md index c8cde57a228..882cd69a5f7 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0250.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0250.md @@ -5,7 +5,7 @@ alias: references-to-content-provider-access-in-webviews id: MASTG-TEST-0250 apis: [WebView, WebSettings, getSettings, ContentProvider, setAllowContentAccess, setAllowUniversalAccessFromFileURLs, setJavaScriptEnabled] type: [static, code] -weakness: MASWE-0069 +weakness: MASWE-0037 best-practices: [MASTG-BEST-0011, MASTG-BEST-0012, MASTG-BEST-0013, MASTG-BEST-0049] profiles: [L1, L2] knowledge: [MASTG-KNOW-0018] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0251.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0251.md index 5343a070cb8..af38f718ca9 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0251.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0251.md @@ -5,7 +5,7 @@ alias: references-to-content-provider-access-in-webviews id: MASTG-TEST-0251 apis: [WebView, WebSettings, getSettings, ContentProvider, setAllowContentAccess, setAllowUniversalAccessFromFileURLs, setJavaScriptEnabled] type: [dynamic, hooks, manual] -weakness: MASWE-0069 +weakness: MASWE-0037 best-practices: [MASTG-BEST-0011, MASTG-BEST-0012, MASTG-BEST-0013, MASTG-BEST-0049] profiles: [L1, L2] knowledge: [MASTG-KNOW-0018] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0252.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0252.md index d00abd02478..4aef642b2cc 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0252.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0252.md @@ -5,7 +5,7 @@ alias: references-to-local-file-access-in-webviews id: MASTG-TEST-0252 apis: [WebView, WebSettings, getSettings, setAllowFileAccess, setAllowFileAccessFromFileURLs, setAllowUniversalAccessFromFileURLs] type: [static, code] -weakness: MASWE-0069 +weakness: MASWE-0037 best-practices: [MASTG-BEST-0010, MASTG-BEST-0011, MASTG-BEST-0012] profiles: [L1, L2] knowledge: [MASTG-KNOW-0018] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0253.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0253.md index 511026dd1df..75ecededd13 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0253.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0253.md @@ -5,7 +5,7 @@ alias: references-to-local-file-access-in-webviews id: MASTG-TEST-0253 apis: [WebView, WebSettings, getSettings, setAllowFileAccess, setAllowFileAccessFromFileURLs, setAllowUniversalAccessFromFileURLs] type: [dynamic, hooks, manual] -weakness: MASWE-0069 +weakness: MASWE-0037 best-practices: [MASTG-BEST-0010, MASTG-BEST-0011, MASTG-BEST-0012] profiles: [L1, L2] knowledge: [MASTG-KNOW-0018] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0258.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0258.md index ad7f15b1f8d..25c9f2f18b4 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0258.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0258.md @@ -3,7 +3,7 @@ platform: android title: References to Keyboard Caching Attributes in UI Elements id: MASTG-TEST-0258 type: [static, code] -weakness: MASWE-0053 +weakness: MASWE-0028 best-practices: [MASTG-BEST-0019] profiles: [L2] knowledge: [MASTG-KNOW-0055] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0289.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0289.md index e6bb4aeb77e..d0fea7d1ffd 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0289.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0289.md @@ -5,7 +5,7 @@ id: MASTG-TEST-0289 type: [dynamic, filesystem, manual] profiles: [L2] best-practices: [MASTG-BEST-0014] -weakness: MASWE-0055 +weakness: MASWE-0030 prerequisites: - identify-sensitive-screens knowledge: [MASTG-KNOW-0053] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0291.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0291.md index 4b31108a66a..a08647ad0ff 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0291.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0291.md @@ -5,7 +5,7 @@ id: MASTG-TEST-0291 type: [static, code] profiles: [L2] best-practices: [MASTG-BEST-0014] -weakness: MASWE-0055 +weakness: MASWE-0030 knowledge: [MASTG-KNOW-0053] --- diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0292.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0292.md index 123efb47c39..f27b573c3e4 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0292.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0292.md @@ -5,7 +5,7 @@ id: MASTG-TEST-0292 type: [static, code] profiles: [L2] best-practices: [MASTG-BEST-0014, MASTG-BEST-0015] -weakness: MASWE-0055 +weakness: MASWE-0030 knowledge: [MASTG-KNOW-0053] status: placeholder note: This test verifies whether an app prevents sensitive data from being captured in the Recents screen when backgrounded. diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0293.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0293.md index f6ed6a579eb..5eba5312bfc 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0293.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0293.md @@ -5,7 +5,7 @@ id: MASTG-TEST-0293 type: [static, code] profiles: [L2] best-practices: [MASTG-BEST-0014, MASTG-BEST-0017] -weakness: MASWE-0055 +weakness: MASWE-0030 knowledge: [MASTG-KNOW-0053] status: placeholder note: This test verifies whether an app prevents sensitive data from being captured in screenshots and screen recordings of `SurfaceView` components. diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0294.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0294.md index d02ff83c04a..d038474daba 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0294.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0294.md @@ -5,7 +5,7 @@ id: MASTG-TEST-0294 type: [static, code] profiles: [L2] best-practices: [MASTG-BEST-0014, MASTG-BEST-0018] -weakness: MASWE-0055 +weakness: MASWE-0030 knowledge: [MASTG-KNOW-0053] status: placeholder note: This test verifies whether an app prevents sensitive data from being captured in screenshots and screen recordings of Jetpack Compose dialogs. diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0315.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0315.md index a3d08767af3..6bd215d83d9 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0315.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0315.md @@ -4,7 +4,7 @@ title: Sensitive Data Exposed via Notifications id: MASTG-TEST-0315 apis: [NotificationManager] type: [static, code] -weakness: MASWE-0054 +weakness: MASWE-0029 prerequisites: - identify-sensitive-data profiles: [L2] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0316.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0316.md index 6d86f53fa02..b637386c61f 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0316.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0316.md @@ -3,7 +3,7 @@ platform: android title: App Exposing User Authentication Data in Text Input Fields id: MASTG-TEST-0316 type: [static, code, manual] -weakness: MASWE-0053 +weakness: MASWE-0028 profiles: [L2] --- diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0320.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0320.md index 7766a246817..e7b2dd86604 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0320.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0320.md @@ -3,7 +3,7 @@ platform: android title: WebViews Not Cleaning Up Sensitive Data id: MASTG-TEST-0320 type: [dynamic, hooks] -weakness: MASWE-0118 +weakness: MASWE-0003 profiles: [L1, L2] best-practices: [MASTG-BEST-0028] knowledge: [MASTG-KNOW-0018] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0334.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0334.md index 08f916deb9a..261bb8512dd 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0334.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0334.md @@ -3,7 +3,7 @@ platform: android title: Native Code Exposed Through WebViews id: MASTG-TEST-0334 type: [static, code, manual] -weakness: MASWE-0069 +weakness: MASWE-0037 best-practices: [MASTG-BEST-0011, MASTG-BEST-0012, MASTG-BEST-0013, MASTG-BEST-0035] profiles: [L1, L2] knowledge: [MASTG-KNOW-0018] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0340.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0340.md index 188b32eded3..e9d9510439f 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0340.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0340.md @@ -4,7 +4,7 @@ title: References to Overlay Attack Protections id: MASTG-TEST-0340 apis: [onFilterTouchEventForSecurity, setFilterTouchesWhenObscured, FLAG_WINDOW_IS_OBSCURED, FLAG_WINDOW_IS_PARTIALLY_OBSCURED] type: [static, code] -weakness: MASWE-0053 +weakness: MASWE-0028 best-practices: [MASTG-BEST-0040] profiles: [L2] knowledge: [MASTG-KNOW-0022] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0355.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0355.md index 6d623791e69..520c49fe668 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0355.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0355.md @@ -3,7 +3,7 @@ platform: android title: References to Unauthorized Database Access through Content Providers id: MASTG-TEST-0355 type: [static, config, manual] -weakness: MASWE-0064 +weakness: MASWE-0020 profiles: [L1, L2] best-practices: [MASTG-BEST-0049] knowledge: [MASTG-KNOW-0020, MASTG-KNOW-0117] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0356.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0356.md index a43db855f8a..df839a408cb 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0356.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0356.md @@ -3,7 +3,7 @@ platform: android title: Runtime Verification of Unauthorized Database Access through Content Providers id: MASTG-TEST-0356 type: [dynamic, filesystem, manual] -weakness: MASWE-0064 +weakness: MASWE-0020 profiles: [L1, L2] best-practices: [MASTG-BEST-0049] knowledge: [MASTG-KNOW-0020, MASTG-KNOW-0117] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0357.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0357.md index 71e2b4d166d..328d77e0d23 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0357.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0357.md @@ -2,7 +2,7 @@ title: References to Oversharing of File-Based Content Providers platform: android id: MASTG-TEST-0357 -weakness: MASWE-0064 +weakness: MASWE-0020 type: [static, config, code, manual] best-practices: [MASTG-BEST-0049] profiles: [L1, L2] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0364.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0364.md index 147baef4e62..83888e3ec24 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0364.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0364.md @@ -3,7 +3,7 @@ platform: android title: Exported And Unprotected Activities That Expose Sensitive Functionality id: MASTG-TEST-0364 type: [static, config, code, manual] -weakness: MASWE-0119 +weakness: MASWE-0020 best-practices: [MASTG-BEST-0052] profiles: [L1, L2] knowledge: [MASTG-KNOW-0132, MASTG-KNOW-0017, MASTG-KNOW-0020] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0365.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0365.md index 5b945c9cbbf..8629a3f7344 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0365.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0365.md @@ -3,7 +3,7 @@ platform: android title: Exported And Unprotected Services That Expose Sensitive Functionality id: MASTG-TEST-0365 type: [static, config, code, manual] -weakness: MASWE-0062 +weakness: MASWE-0020 best-practices: [MASTG-BEST-0052] profiles: [L1, L2] knowledge: [MASTG-KNOW-0133, MASTG-KNOW-0017, MASTG-KNOW-0020] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0366.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0366.md index 3af5177e6f1..62b03938d28 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0366.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0366.md @@ -3,7 +3,7 @@ platform: android title: Exported And Unprotected Broadcast Receivers That Expose Sensitive Functionality id: MASTG-TEST-0366 type: [static, config, code, manual] -weakness: MASWE-0063 +weakness: MASWE-0020 best-practices: [MASTG-BEST-0052] profiles: [L1, L2] knowledge: [MASTG-KNOW-0134, MASTG-KNOW-0017, MASTG-KNOW-0020] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0381.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0381.md index b798d37de84..71df8f12d05 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0381.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0381.md @@ -3,7 +3,7 @@ title: References to Insecure PendingIntent Creation platform: android id: MASTG-TEST-0381 type: [static] -weakness: MASWE-0066 +weakness: MASWE-0035 best-practices: [MASTG-BEST-0063] profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0393.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0393.md index 18b78aa97f4..6178e5da4cf 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0393.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0393.md @@ -3,7 +3,7 @@ title: Use of Unverified App Links platform: android id: MASTG-TEST-0393 type: [static, config] -weakness: MASWE-0058 +weakness: MASWE-0032 profiles: [L1, L2] knowledge: [MASTG-KNOW-0019] best-practices: [MASTG-BEST-0070] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0394.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0394.md index e44ae7d6296..421ed6a08c7 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0394.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0394.md @@ -4,7 +4,7 @@ platform: android id: MASTG-TEST-0394 type: [static, code, manual] profiles: [L1, L2] -weakness: MASWE-0058 +weakness: MASWE-0032 knowledge: [MASTG-KNOW-0019] best-practices: [MASTG-BEST-0071] apis: [getData, getQueryParameter] diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0206.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0206.md index b9c57c4a646..8bf7226ad99 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0206.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0206.md @@ -3,7 +3,7 @@ platform: android title: Undeclared PII in Network Traffic Capture id: MASTG-TEST-0206 type: [dynamic, network] -weakness: MASWE-0108 +weakness: MASWE-0068 prerequisites: - identify-sensitive-data - privacy-policy diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0254.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0254.md index 04fc4f71f44..fa665c245e7 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0254.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0254.md @@ -3,7 +3,7 @@ title: Dangerous App Permissions platform: android id: MASTG-TEST-0254 type: [static, code] -weakness: MASWE-0117 +weakness: MASWE-0072 profiles: [P] knowledge: [MASTG-KNOW-0017] --- diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0255.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0255.md index 515ad48d5c3..756e207559e 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0255.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0255.md @@ -2,7 +2,7 @@ platform: android title: Permission Requests Not Minimized id: MASTG-TEST-0255 -weakness: MASWE-0117 +weakness: MASWE-0072 status: placeholder note: This test checks if the app requests permissions that have privacy-preserving alternatives. profiles: [P] diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0256.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0256.md index b5356a2593d..2253902eb38 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0256.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0256.md @@ -2,7 +2,7 @@ platform: android title: Missing Permission Rationale id: MASTG-TEST-0256 -weakness: MASWE-0117 +weakness: MASWE-0072 status: placeholder note: This test checks if the app does not provide a rationale for requesting permissions. See https://developer.android.com/training/permissions/requesting#explain and https://developer.android.com/training/permissions/explaining-access#privacy-dashboard-show-rationale profiles: [P] diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0257.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0257.md index 299b317632f..f17d234e291 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0257.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0257.md @@ -2,7 +2,7 @@ platform: android title: Not Resetting Unused Permissions id: MASTG-TEST-0257 -weakness: MASWE-0117 +weakness: MASWE-0072 status: placeholder note: This test checks if the app does not remove unnecessary access to granted permissions. See https://developer.android.com/training/permissions/requesting#remove-access profiles: [P] diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0318.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0318.md index 0e2a2b2d3c8..6841e62c0c3 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0318.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0318.md @@ -3,7 +3,7 @@ platform: android title: References to SDK APIs Known to Handle Sensitive User Data id: MASTG-TEST-0318 type: [static, code] -weakness: MASWE-0112 +weakness: MASWE-0068 profiles: [P] --- diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0319.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0319.md index 763f3ca5534..c7e076a9f15 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0319.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0319.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of SDK APIs Known to Handle Sensitive User Data id: MASTG-TEST-0319 type: [dynamic, hooks] -weakness: MASWE-0112 +weakness: MASWE-0068 prerequisites: - identify-sensitive-data profiles: [P] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0224.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0224.md index 70bad7e7074..c8bde627621 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0224.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0224.md @@ -4,7 +4,7 @@ platform: android id: MASTG-TEST-0224 type: [static, code] available_since: 24 -weakness: MASWE-0104 +weakness: MASWE-0062 best-practices: [MASTG-BEST-0006] profiles: [R] knowledge: [MASTG-KNOW-0003] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0225.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0225.md index 34d58b39ba2..b8ca2c9ea2f 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0225.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0225.md @@ -3,7 +3,7 @@ title: Usage of Insecure APK Signature Key Size platform: android id: MASTG-TEST-0225 type: [static, code] -weakness: MASWE-0104 +weakness: MASWE-0062 profiles: [R] knowledge: [MASTG-KNOW-0003] --- diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0226.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0226.md index a31004598aa..a1ff39b54bc 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0226.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0226.md @@ -3,7 +3,7 @@ title: Debuggable Flag Enabled in the AndroidManifest platform: android id: MASTG-TEST-0226 type: [static, code] -weakness: MASWE-0067 +weakness: MASWE-0050 best-practices: [MASTG-BEST-0007] profiles: [R] knowledge: [MASTG-KNOW-0007] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0227.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0227.md index beb2fb2307e..12ec7654dfb 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0227.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0227.md @@ -3,7 +3,7 @@ title: Debugging Enabled for WebViews platform: android id: MASTG-TEST-0227 type: [static, code] -weakness: MASWE-0067 +weakness: MASWE-0050 best-practices: [MASTG-BEST-0008] profiles: [R] knowledge: [MASTG-KNOW-0028] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0247.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0247.md index f5b91a76b81..675bbdb2a88 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0247.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0247.md @@ -4,7 +4,7 @@ title: References to APIs for Detecting Secure Screen Lock id: MASTG-TEST-0247 apis: [KeyguardManager, BiometricManager#canAuthenticate] type: [static, code] -weakness: MASWE-0008 +weakness: MASWE-0049 best-practices: [] profiles: [L2] knowledge: [MASTG-KNOW-0001] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0249.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0249.md index 892483286dc..d23667ba810 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0249.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0249.md @@ -4,7 +4,7 @@ title: Runtime Use of Secure Screen Lock Detection APIs id: MASTG-TEST-0249 apis: [KeyguardManager, BiometricManager#canAuthenticate] type: [dynamic, hooks] -weakness: MASWE-0008 +weakness: MASWE-0049 best-practices: [] profiles: [L2] knowledge: [MASTG-KNOW-0001] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0263.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0263.md index 8a632079bb4..73e02c91e27 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0263.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0263.md @@ -4,7 +4,7 @@ title: Logging of StrictMode Violations id: MASTG-TEST-0263 apis: [StrictMode] type: [dynamic, logs] -weakness: MASWE-0094 +weakness: MASWE-0054 profiles: [R] --- diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0264.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0264.md index 36dd2f4307e..0911e1c82bb 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0264.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0264.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of StrictMode APIs id: MASTG-TEST-0264 type: [dynamic, hooks] -weakness: MASWE-0094 +weakness: MASWE-0054 best-practices: [] profiles: [R] --- diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0265.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0265.md index 514f6f326da..2119670c329 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0265.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0265.md @@ -3,7 +3,7 @@ platform: android title: References to StrictMode APIs id: MASTG-TEST-0265 type: [static, code] -weakness: MASWE-0094 +weakness: MASWE-0054 best-practices: [] profiles: [R] --- diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0288.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0288.md index 4fc81d4f9cb..0da4b80d944 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0288.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0288.md @@ -4,7 +4,7 @@ title: Debugging Symbols in Native Binaries alias: debugging-symbols-in-native-binaries id: MASTG-TEST-0288 type: [static, code] -weakness: MASWE-0093 +weakness: MASWE-0054 best-practices: [] profiles: [R] --- diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0324.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0324.md index 0e8880b885d..605e4fc26cf 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0324.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0324.md @@ -3,7 +3,7 @@ platform: android title: References to Root Detection Mechanisms id: MASTG-TEST-0324 type: [static, code] -weakness: MASWE-0097 +weakness: MASWE-0056 best-practices: [MASTG-BEST-0029, MASTG-BEST-0030] profiles: [R] knowledge: [MASTG-KNOW-0027] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0325.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0325.md index 92216ec41ee..a9bf3ab5765 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0325.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0325.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of Root Detection Techniques id: MASTG-TEST-0325 type: [dynamic, hooks] -weakness: MASWE-0097 +weakness: MASWE-0056 best-practices: [MASTG-BEST-0029, MASTG-BEST-0030] profiles: [R] knowledge: [MASTG-KNOW-0027] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0338.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0338.md index 1b5c43e9b7e..40c0bfba2d8 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0338.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0338.md @@ -4,7 +4,7 @@ platform: android id: MASTG-TEST-0338 apis: [javax.crypto.Mac, java.security.Signature, java.security.MessageDigest] type: [static, code, manual] -weakness: MASWE-0105 +weakness: MASWE-0063 false_negative_prone: true profiles: [R] knowledge: [MASTG-KNOW-0036] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0341.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0341.md index 9ce630f8e40..9103c826177 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0341.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0341.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of Hook Detection Techniques id: MASTG-TEST-0341 type: [dynamic, hooks] -weakness: MASWE-0107 +weakness: MASWE-0064 best-practices: [MASTG-BEST-0041] profiles: [R] knowledge: [MASTG-KNOW-0030, MASTG-KNOW-0032, MASTG-KNOW-0118] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0351.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0351.md index 7f254135a3d..ecc19b8ca7f 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0351.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0351.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of Emulator Detection Techniques id: MASTG-TEST-0351 type: [dynamic, hooks] -weakness: MASWE-0099 +weakness: MASWE-0058 best-practices: [MASTG-BEST-0046] profiles: [R] knowledge: [MASTG-KNOW-0031] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0352.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0352.md index e9d9f7f62ea..cc448523713 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0352.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0352.md @@ -3,7 +3,7 @@ platform: android title: References to Debugging Detection APIs id: MASTG-TEST-0352 type: [static, code, manual] -weakness: MASWE-0101 +weakness: MASWE-0060 best-practices: [MASTG-BEST-0007, MASTG-BEST-0029, MASTG-BEST-0047] profiles: [R] knowledge: [MASTG-KNOW-0007, MASTG-KNOW-0028] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0353.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0353.md index 2419dcab71e..f5bf69cd97c 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0353.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0353.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of Debugging Detection APIs id: MASTG-TEST-0353 type: [dynamic, hooks, manual] -weakness: MASWE-0101 +weakness: MASWE-0060 best-practices: [MASTG-BEST-0007, MASTG-BEST-0029, MASTG-BEST-0047] profiles: [R] knowledge: [MASTG-KNOW-0007, MASTG-KNOW-0028] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0368.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0368.md index 7a5482962e6..724e94894ee 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0368.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0368.md @@ -3,7 +3,7 @@ platform: android title: Insufficient Obfuscation of Security-Relevant Java/Kotlin Code id: MASTG-TEST-0368 type: [static, code, manual] -weakness: MASWE-0089 +weakness: MASWE-0051 best-practices: [MASTG-BEST-0029] profiles: [R] knowledge: [MASTG-KNOW-0033] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0369.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0369.md index 711d8a7d495..5fc7b27ab11 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0369.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0369.md @@ -3,7 +3,7 @@ platform: android title: Insufficient Obfuscation of Security-Relevant Native Code id: MASTG-TEST-0369 type: [static, package, manual] -weakness: MASWE-0089 +weakness: MASWE-0051 best-practices: [MASTG-BEST-0029] profiles: [R] knowledge: [MASTG-KNOW-0033] diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0200.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0200.md index e3bf8ad5eed..3a782d04142 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0200.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0200.md @@ -3,7 +3,7 @@ platform: android title: Files Written to External Storage id: MASTG-TEST-0200 type: [dynamic, filesystem, manual] -weakness: MASWE-0007 +weakness: MASWE-0004 profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0201.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0201.md index ddf2ed8b1d4..8c6c2a1f532 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0201.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0201.md @@ -4,7 +4,7 @@ title: Runtime Use of APIs to Access External Storage id: MASTG-TEST-0201 apis: [Environment#getExternalStorageDirectory, Environment#getExternalStorageDirectory, Environment#getExternalFilesDir, Environment#getExternalCacheDir, FileOutputStream] type: [dynamic, hooks, manual] -weakness: MASWE-0007 +weakness: MASWE-0004 profiles: [L1, L2] knowledge: [MASTG-KNOW-0042] --- diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0202.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0202.md index 2367341145e..28a275984ba 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0202.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0202.md @@ -4,7 +4,7 @@ title: References to APIs and Permissions for Accessing External Storage id: MASTG-TEST-0202 apis: [Environment#getExternalStoragePublicDirectory, Environment#getExternalStorageDirectory, Environment#getExternalFilesDir, Environment#getExternalCacheDir, MediaStore, WRITE_EXTERNAL_STORAGE, MANAGE_EXTERNAL_STORAGE] type: [static, code, manual] -weakness: MASWE-0007 +weakness: MASWE-0004 profiles: [L1, L2] knowledge: [MASTG-KNOW-0042] --- diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0207.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0207.md index 44f826b893a..face731f209 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0207.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0207.md @@ -5,7 +5,7 @@ id: MASTG-TEST-0207 type: [dynamic, filesystem] prerequisites: - identify-sensitive-data -weakness: MASWE-0006 +weakness: MASWE-0003 profiles: [L2] best-practices: [MASTG-BEST-0050] knowledge: [MASTG-KNOW-0041] diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0216.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0216.md index 9ec37b1764b..4d8a5c13015 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0216.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0216.md @@ -3,7 +3,7 @@ platform: android title: Sensitive Data Not Excluded From Backup id: MASTG-TEST-0216 type: [dynamic, filesystem] -weakness: MASWE-0004 +weakness: MASWE-0002 best-practices: [MASTG-BEST-0004] profiles: [L1, L2, P] knowledge: [MASTG-KNOW-0050] diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0262.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0262.md index 50d8a4213f9..7fe2e182ab1 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0262.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0262.md @@ -3,7 +3,7 @@ platform: android title: References to Backup Configurations Not Excluding Sensitive Data id: MASTG-TEST-0262 type: [static, code] -weakness: MASWE-0004 +weakness: MASWE-0002 best-practices: [MASTG-BEST-0004] profiles: [L1, L2, P] knowledge: [MASTG-KNOW-0050] diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0287.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0287.md index a3078e55c20..9a32f23ae09 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0287.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0287.md @@ -3,7 +3,7 @@ title: Runtime Storage of Unencrypted Data via the SharedPreferences API platform: android id: MASTG-TEST-0287 type: [dynamic, hooks, manual] -weakness: MASWE-0006 +weakness: MASWE-0003 best-practices: [MASTG-BEST-0050] profiles: [L1, L2] prerequisites: diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0304.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0304.md index d813cc82371..85e13ea5c0e 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0304.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0304.md @@ -3,7 +3,7 @@ title: References to Sensitive Data Unencrypted via Android Room Database platform: android id: MASTG-TEST-0304 type: [static, code] -weakness: MASWE-0006 +weakness: MASWE-0003 best-practices: [] profiles: [L1, L2] knowledge: [MASTG-KNOW-0037] diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0305.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0305.md index 27216f0ee10..4fdc72a97ae 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0305.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0305.md @@ -3,7 +3,7 @@ title: Sensitive Data Stored Unencrypted via DataStore platform: android id: MASTG-TEST-0305 type: [static, dynamic] -weakness: MASWE-0006 +weakness: MASWE-0003 best-practices: [] profiles: [L1, L2] status: placeholder diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0306.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0306.md index fe554fd1a44..a18f57ae150 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0306.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0306.md @@ -3,7 +3,7 @@ title: References to Sensitive Data Stored Unencrypted via Android Room DB platform: android id: MASTG-TEST-0306 type: [static, code] -weakness: MASWE-0006 +weakness: MASWE-0003 best-practices: [] profiles: [L1, L2] status: placeholder diff --git a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0266.md b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0266.md index 823249cf7eb..f3cbfee8ba2 100644 --- a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0266.md +++ b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0266.md @@ -4,7 +4,7 @@ title: References to APIs for Event-Bound Biometric Authentication id: MASTG-TEST-0266 apis: [LAContext.evaluatePolicy] type: [static, code] -weakness: MASWE-0044 +weakness: MASWE-0021 profiles: [L2] knowledge: [MASTG-KNOW-0056, MASTG-KNOW-0057] --- diff --git a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0267.md b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0267.md index 8a0bdc4d158..e7df753d8a4 100644 --- a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0267.md +++ b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0267.md @@ -4,7 +4,7 @@ title: Runtime Use Of Event-Bound Biometric Authentication id: MASTG-TEST-0267 apis: [LAContext.evaluatePolicy] type: [dynamic, hooks] -weakness: MASWE-0044 +weakness: MASWE-0021 best-practices: [] profiles: [L2] knowledge: [MASTG-KNOW-0056] diff --git a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0268.md b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0268.md index 658c2d9b4a0..7f392f0a3fe 100644 --- a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0268.md +++ b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0268.md @@ -4,7 +4,7 @@ title: References to APIs Allowing Fallback to Non-Biometric Authentication id: MASTG-TEST-0268 apis: [kSecAccessControlUserPresence, kSecAccessControlDevicePasscode, SecAccessControlCreateWithFlags] type: [static, code] -weakness: MASWE-0045 +weakness: MASWE-0022 profiles: [L2] knowledge: [MASTG-KNOW-0056] --- diff --git a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0269.md b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0269.md index f27f38621e0..8c718d9e399 100644 --- a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0269.md +++ b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0269.md @@ -4,7 +4,7 @@ title: Runtime Use Of APIs Allowing Fallback to Non-Biometric Authentication id: MASTG-TEST-0269 apis: [kSecAccessControlUserPresence, kSecAccessControlDevicePasscode, SecAccessControlCreateWithFlags] type: [dynamic, hooks] -weakness: MASWE-0045 +weakness: MASWE-0022 profiles: [L2] knowledge: [MASTG-KNOW-0056] --- diff --git a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0270.md b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0270.md index 6c4f04deb1c..bda09c84f6f 100644 --- a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0270.md +++ b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0270.md @@ -4,7 +4,7 @@ title: References to APIs Detecting Biometric Enrollment Changes id: MASTG-TEST-0270 apis: [kSecAccessControlBiometryCurrentSet,SecAccessControlCreateWithFlags] type: [static, code] -weakness: MASWE-0046 +weakness: MASWE-0023 profiles: [L2] knowledge: [MASTG-KNOW-0056] --- diff --git a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0271.md b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0271.md index c0044fbca85..a8197caabd7 100644 --- a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0271.md +++ b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0271.md @@ -4,7 +4,7 @@ title: Runtime Use Of APIs Detecting Biometric Enrollment Changes id: MASTG-TEST-0271 apis: [kSecAccessControlBiometryCurrentSet,SecAccessControlCreateWithFlags] type: [dynamic, hooks] -weakness: MASWE-0046 +weakness: MASWE-0023 profiles: [L2] knowledge: [MASTG-KNOW-0056] --- diff --git a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0228.md b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0228.md index 21837108e4c..b09b75c6979 100644 --- a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0228.md +++ b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0228.md @@ -3,7 +3,7 @@ title: Position Independent Code (PIC) not Enabled platform: ios id: MASTG-TEST-0228 type: [static, code] -weakness: MASWE-0116 +weakness: MASWE-0045 profiles: [L2] knowledge: [MASTG-KNOW-0061] --- diff --git a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0229.md b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0229.md index 89fa4d10495..31456b4edc2 100644 --- a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0229.md +++ b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0229.md @@ -3,7 +3,7 @@ title: Stack Canaries Not enabled platform: ios id: MASTG-TEST-0229 type: [static, code] -weakness: MASWE-0116 +weakness: MASWE-0045 profiles: [L2] knowledge: [MASTG-KNOW-0061] --- diff --git a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0230.md b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0230.md index dd19d25c7cf..ef89c3439d2 100644 --- a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0230.md +++ b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0230.md @@ -3,7 +3,7 @@ title: Automatic Reference Counting (ARC) not enabled platform: ios id: MASTG-TEST-0230 type: [static, code] -weakness: MASWE-0116 +weakness: MASWE-0045 profiles: [L2] knowledge: [MASTG-KNOW-0061] --- diff --git a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0273.md b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0273.md index f2b350755c3..a2d90b55b68 100644 --- a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0273.md +++ b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0273.md @@ -3,7 +3,7 @@ platform: ios title: Identify Dependencies with Known Vulnerabilities by Scanning Dependency Managers Artifacts id: MASTG-TEST-0273 type: [static, code] -weakness: MASWE-0076 +weakness: MASWE-0041 profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0275.md b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0275.md index 177b48b134a..9ea7c87734b 100644 --- a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0275.md +++ b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0275.md @@ -3,7 +3,7 @@ platform: ios title: Dependencies with Known Vulnerabilities in the App's SBOM id: MASTG-TEST-0275 type: [static, developer] -weakness: MASWE-0076 +weakness: MASWE-0041 profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0383.md b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0383.md index aed71c73a77..b4b0ecbbb39 100644 --- a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0383.md +++ b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0383.md @@ -3,7 +3,7 @@ platform: ios title: References to Enforced Updating APIs id: MASTG-TEST-0383 type: [static, code, manual] -weakness: MASWE-0075 +weakness: MASWE-0040 profiles: [L2] knowledge: [MASTG-KNOW-0074] --- diff --git a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0384.md b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0384.md index 34a06d04b6e..0905b9abe1f 100644 --- a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0384.md +++ b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0384.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Use of Enforced Updating APIs id: MASTG-TEST-0384 type: [dynamic, network, hooks, manual] -weakness: MASWE-0075 +weakness: MASWE-0040 profiles: [L2] knowledge: [MASTG-KNOW-0074] --- diff --git a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0386.md b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0386.md index 6c1cc60d255..0c281177b3e 100644 --- a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0386.md +++ b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0386.md @@ -3,7 +3,7 @@ title: References to Object Deserialization of Untrusted Data platform: ios id: MASTG-TEST-0386 type: [static, code, manual] -weakness: MASWE-0088 +weakness: MASWE-0048 profiles: [L1, L2] knowledge: [MASTG-KNOW-0075] best-practices: [MASTG-BEST-0064] diff --git a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0209.md b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0209.md index 7d103732be7..1cbf4ceef4c 100644 --- a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0209.md +++ b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0209.md @@ -3,7 +3,7 @@ platform: ios title: Insufficient Key Sizes id: MASTG-TEST-0209 type: [static, code] -weakness: MASWE-0009 +weakness: MASWE-0007 profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0210.md b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0210.md index c6adf53f6f9..0435dcb400c 100644 --- a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0210.md +++ b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0210.md @@ -3,7 +3,7 @@ platform: ios title: Broken Symmetric Encryption Algorithms id: MASTG-TEST-0210 type: [static, code, manual] -weakness: MASWE-0020 +weakness: MASWE-0011 profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0211.md b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0211.md index a6908b9c12a..423ff8e1b67 100644 --- a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0211.md +++ b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0211.md @@ -3,7 +3,7 @@ platform: ios title: Broken Hashing Algorithms id: MASTG-TEST-0211 type: [static, code, manual] -weakness: MASWE-0021 +weakness: MASWE-0012 profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0213.md b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0213.md index 12f98f77291..403616c7918 100644 --- a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0213.md +++ b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0213.md @@ -3,7 +3,7 @@ title: Use of Hardcoded Cryptographic Keys in Code platform: ios id: MASTG-TEST-0213 type: [static, code, manual] -weakness: MASWE-0014 +weakness: MASWE-0005 profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0214.md b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0214.md index e081ae458a0..b287a26ac01 100644 --- a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0214.md +++ b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0214.md @@ -3,7 +3,7 @@ title: Hardcoded Cryptographic Keys in Files platform: ios id: MASTG-TEST-0214 type: [static, code, manual] -weakness: MASWE-0014 +weakness: MASWE-0005 profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0311.md b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0311.md index 6c83c86e2eb..99788d53206 100644 --- a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0311.md +++ b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0311.md @@ -3,7 +3,7 @@ platform: ios title: Insecure Random API Usage id: MASTG-TEST-0311 type: [static, code, manual] -weakness: MASWE-0027 +weakness: MASWE-0016 profiles: [L1, L2] best-practices: [MASTG-BEST-0025] knowledge: [MASTG-KNOW-0070] diff --git a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0317.md b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0317.md index 3dea3805409..cdf5684af98 100644 --- a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0317.md +++ b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0317.md @@ -3,7 +3,7 @@ title: Broken Symmetric Encryption Modes platform: ios id: MASTG-TEST-0317 type: [static, code, manual] -weakness: MASWE-0020 +weakness: MASWE-0011 best-practices: [MASTG-BEST-0005] profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0349.md b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0349.md index 7b40549e1f3..a8080b2f329 100644 --- a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0349.md +++ b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0349.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Use of Insecure Random APIs id: MASTG-TEST-0349 type: [dynamic, hooks, manual] -weakness: MASWE-0027 +weakness: MASWE-0016 profiles: [L1, L2] best-practices: [MASTG-BEST-0025] knowledge: [MASTG-KNOW-0070] diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0321.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0321.md index 673cf71f4d6..e196e5d9b5c 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0321.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0321.md @@ -3,7 +3,7 @@ platform: ios title: Hardcoded HTTP URLs id: MASTG-TEST-0321 type: [static, code] -weakness: MASWE-0050 +weakness: MASWE-0025 profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0322.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0322.md index 79feb89b4bb..de0d105e9bb 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0322.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0322.md @@ -3,7 +3,7 @@ platform: ios title: App Transport Security Configurations Allowing Cleartext Traffic id: MASTG-TEST-0322 type: [static, code, manual] -weakness: MASWE-0050 +weakness: MASWE-0025 profiles: [L1, L2] knowledge: [MASTG-KNOW-0071] --- diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0323.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0323.md index 142dca24f68..597255ffeee 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0323.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0323.md @@ -3,7 +3,7 @@ platform: ios title: Uses of Low-Level Networking APIs for Cleartext Traffic id: MASTG-TEST-0323 type: [static, code, manual] -weakness: MASWE-0050 +weakness: MASWE-0025 profiles: [L1, L2] knowledge: [MASTG-KNOW-0073] --- diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0342.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0342.md index 0d47bb2013d..24a0fe73010 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0342.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0342.md @@ -3,7 +3,7 @@ platform: ios title: References to Weak ATS TLS Policy Exceptions in Info.plist id: MASTG-TEST-0342 type: [static, code] -weakness: MASWE-0050 +weakness: MASWE-0025 profiles: [L1, L2] best-practices: [MASTG-BEST-0042] knowledge: [MASTG-KNOW-0071] diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0343.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0343.md index 9e0fd409b8d..104c0cfb23f 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0343.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0343.md @@ -3,7 +3,7 @@ platform: ios title: URLSession TLS Protocol Configuration id: MASTG-TEST-0343 type: [static, code, manual] -weakness: MASWE-0050 +weakness: MASWE-0025 profiles: [L1, L2] best-practices: [MASTG-BEST-0042] knowledge: [MASTG-KNOW-0071, MASTG-KNOW-0073] diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0344.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0344.md index d9a0262c5d9..ca0ea5987b2 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0344.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0344.md @@ -3,7 +3,7 @@ platform: ios title: Network.framework TLS Protocol Configuration id: MASTG-TEST-0344 type: [static, code, manual] -weakness: MASWE-0050 +weakness: MASWE-0025 profiles: [L1, L2] best-practices: [MASTG-BEST-0043] knowledge: [MASTG-KNOW-0073] diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0345.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0345.md index 8ea26d32522..377beee5d05 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0345.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0345.md @@ -3,7 +3,7 @@ platform: ios title: Embedded or Third-party TLS Stack Configuration id: MASTG-TEST-0345 type: [static, code, manual] -weakness: MASWE-0050 +weakness: MASWE-0025 profiles: [L1, L2] best-practices: [MASTG-BEST-0043] knowledge: [MASTG-KNOW-0073] diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0348.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0348.md index 89a01bded3f..1f0d87bd4c8 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0348.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0348.md @@ -3,7 +3,7 @@ title: Insecure TLS Protocols in Network Traffic platform: ios id: MASTG-TEST-0348 type: [dynamic, network] -weakness: MASWE-0050 +weakness: MASWE-0025 profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0385.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0385.md index 9f338188980..5e3fef4fbb7 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0385.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0385.md @@ -3,7 +3,7 @@ platform: ios title: Missing Certificate Pinning in ATS id: MASTG-TEST-0385 type: [static] -weakness: MASWE-0047 +weakness: MASWE-0027 profiles: [L2] prerequisites: - identify-first-party-domains diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0396.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0396.md index 89b1fa72a08..6625b1ac59b 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0396.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0396.md @@ -3,7 +3,7 @@ title: References to URLSessionDelegate Bypassing Certificate Validation platform: ios id: MASTG-TEST-0396 type: [static, code, manual] -weakness: MASWE-0052 +weakness: MASWE-0026 best-practices: [MASTG-BEST-0073] profiles: [L1, L2] knowledge: [MASTG-KNOW-0072] diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0397.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0397.md index 1f866ca96e8..2eaf6e643fd 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0397.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0397.md @@ -3,7 +3,7 @@ title: References to WKNavigationDelegate Bypassing Certificate Validation platform: ios id: MASTG-TEST-0397 type: [static, code, manual] -weakness: MASWE-0052 +weakness: MASWE-0026 best-practices: [MASTG-BEST-0073] profiles: [L1, L2] knowledge: [MASTG-KNOW-0072] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0276.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0276.md index edb321c50fa..a063ea44553 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0276.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0276.md @@ -3,7 +3,7 @@ platform: ios title: Use of the iOS General Pasteboard id: MASTG-TEST-0276 type: [static, code, manual] -weakness: MASWE-0053 +weakness: MASWE-0028 threat: [app] prerequisites: - identify-sensitive-data diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0277.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0277.md index b2942275362..4840cbd232c 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0277.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0277.md @@ -3,7 +3,7 @@ platform: ios title: Sensitive Data in the iOS General Pasteboard at Runtime id: MASTG-TEST-0277 type: [dynamic, hooks] -weakness: MASWE-0053 +weakness: MASWE-0028 threat: [app] prerequisites: - identify-sensitive-data diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0278.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0278.md index a4d718981c1..9ca2eec6e9d 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0278.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0278.md @@ -3,7 +3,7 @@ platform: ios title: Pasteboard Contents Not Cleared After Use id: MASTG-TEST-0278 type: [static, code] -weakness: MASWE-0053 +weakness: MASWE-0028 threat: [app] profiles: [L2] knowledge: [MASTG-KNOW-0083] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0279.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0279.md index 77a5e88477c..497a6241949 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0279.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0279.md @@ -3,7 +3,7 @@ platform: ios title: Pasteboard Contents Not Expiring id: MASTG-TEST-0279 type: [static, code] -weakness: MASWE-0053 +weakness: MASWE-0028 threat: [app] profiles: [L2] knowledge: [MASTG-KNOW-0083] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0280.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0280.md index 9fbfeaead11..4506a44916c 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0280.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0280.md @@ -3,7 +3,7 @@ platform: ios title: Pasteboard Contents Not Restricted to Local Device id: MASTG-TEST-0280 type: [static, code] -weakness: MASWE-0053 +weakness: MASWE-0028 threat: [app] profiles: [L2] knowledge: [MASTG-KNOW-0083] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0290.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0290.md index ed13255d265..2c2092f253b 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0290.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0290.md @@ -4,7 +4,7 @@ platform: ios id: MASTG-TEST-0290 type: [dynamic, filesystem] profiles: [L2] -weakness: MASWE-0055 +weakness: MASWE-0030 prerequisites: - identify-sensitive-screens knowledge: [MASTG-KNOW-0099] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0331.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0331.md index bcf2e5fa499..929a0658ae7 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0331.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0331.md @@ -5,7 +5,7 @@ id: MASTG-TEST-0331 type: [static, code] available_since: 2.0 deprecated_since: 12.0 -weakness: MASWE-0072 +weakness: MASWE-0038 profiles: [L1, L2] best-practices: [MASTG-BEST-0032] knowledge: [MASTG-KNOW-0076] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0332.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0332.md index 0e14c3d3247..b1e01e24b85 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0332.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0332.md @@ -3,7 +3,7 @@ platform: ios title: Attacker-Controlled URI in WebViews id: MASTG-TEST-0332 type: [static, code, manual] -weakness: MASWE-0071 +weakness: MASWE-0038 best-practices: [MASTG-BEST-0034] profiles: [L1, L2, P] knowledge: [MASTG-KNOW-0076] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0333.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0333.md index 066a1cb41c2..42668cff6ad 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0333.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0333.md @@ -3,7 +3,7 @@ platform: ios title: Overly Broad File Read Access in WebViews id: MASTG-TEST-0333 type: [static, code, manual] -weakness: MASWE-0069 +weakness: MASWE-0037 best-practices: [MASTG-BEST-0033] knowledge: [MASTG-KNOW-0076] profiles: [L1, L2] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0335.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0335.md index 745075ca3b1..3045c08d545 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0335.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0335.md @@ -3,7 +3,7 @@ platform: ios title: WebView File Origin Access Relaxed by Configuration id: MASTG-TEST-0335 type: [static, code, manual] -weakness: MASWE-0069 +weakness: MASWE-0037 best-practices: [MASTG-BEST-0033] profiles: [L1, L2] knowledge: [MASTG-KNOW-0076] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0336.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0336.md index bf760fe6f1a..229ff798397 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0336.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0336.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Setting of Relaxed WebView File Origin Policies id: MASTG-TEST-0336 type: [dynamic, hooks, manual] -weakness: MASWE-0069 +weakness: MASWE-0037 best-practices: [MASTG-BEST-0033] profiles: [L1, L2] knowledge: [MASTG-KNOW-0076] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0346.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0346.md index c0a021114a3..6865f71b0c0 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0346.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0346.md @@ -3,7 +3,7 @@ platform: ios title: References to APIs Hiding Sensitive Data in Text Input Fields id: MASTG-TEST-0346 type: [static, code, manual] -weakness: MASWE-0053 +weakness: MASWE-0028 profiles: [L2] best-practices: [MASTG-BEST-0044] knowledge: [MASTG-KNOW-0121, MASTG-KNOW-0141] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0347.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0347.md index 6f73599fbf3..3feb238763b 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0347.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0347.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Use of APIs Hiding Sensitive Data in Text Input Fields id: MASTG-TEST-0347 type: [dynamic, hooks] -weakness: MASWE-0053 +weakness: MASWE-0028 profiles: [L2] best-practices: [MASTG-BEST-0044] knowledge: [MASTG-KNOW-0121, MASTG-KNOW-0141] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0370.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0370.md index e2a47758982..31ab81b8931 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0370.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0370.md @@ -3,7 +3,7 @@ platform: ios title: Missing Input Validation in Custom URL Scheme Handlers id: MASTG-TEST-0370 type: [static, code] -weakness: MASWE-0058 +weakness: MASWE-0032 profiles: [L1, L2] best-practices: [MASTG-BEST-0045, MASTG-BEST-0054] knowledge: [MASTG-KNOW-0079] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0371.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0371.md index 5b53a11aecf..10600cdb023 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0371.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0371.md @@ -3,7 +3,7 @@ platform: ios title: Missing Source Validation in Custom URL Scheme Handlers id: MASTG-TEST-0371 type: [static, code] -weakness: MASWE-0058 +weakness: MASWE-0032 profiles: [L1, L2] best-practices: [MASTG-BEST-0045, MASTG-BEST-0055] knowledge: [MASTG-KNOW-0079] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0376.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0376.md index 877e55f2c01..e420c39292e 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0376.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0376.md @@ -3,7 +3,7 @@ platform: ios title: References to Native Bridge APIs in WebViews id: MASTG-TEST-0376 type: [static, code] -weakness: MASWE-0069 +weakness: MASWE-0037 best-practices: [MASTG-BEST-0058] profiles: [L1, L2] knowledge: [MASTG-KNOW-0076] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0377.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0377.md index 93d7a4c2a01..3316561b94d 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0377.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0377.md @@ -3,7 +3,7 @@ platform: ios title: References to `evaluateJavaScript` Used as Bridge Reply in `WKScriptMessageHandler` id: MASTG-TEST-0377 type: [static, code, manual] -weakness: MASWE-0069 +weakness: MASWE-0037 best-practices: [MASTG-BEST-0062] profiles: [L1, L2] knowledge: [MASTG-KNOW-0076, MASTG-KNOW-0139] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0378.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0378.md index dbb9dbbfea2..3ce29634c2c 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0378.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0378.md @@ -3,7 +3,7 @@ platform: ios title: References to Password Fields in WebView-Loaded HTML id: MASTG-TEST-0378 type: [static, code, manual] -weakness: MASWE-0069 +weakness: MASWE-0037 best-practices: [MASTG-BEST-0059, MASTG-BEST-0060] profiles: [L1, L2] knowledge: [MASTG-KNOW-0076, MASTG-KNOW-0139] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0379.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0379.md index 7bdfc4dc79d..43abc9cb93a 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0379.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0379.md @@ -3,7 +3,7 @@ platform: ios title: References to `evaluateJavaScript` Without Content World Isolation id: MASTG-TEST-0379 type: [static, code] -weakness: MASWE-0069 +weakness: MASWE-0037 best-practices: [MASTG-BEST-0061] profiles: [L1, L2] knowledge: [MASTG-KNOW-0076, MASTG-KNOW-0139] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0380.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0380.md index 28a8850605d..2e8f467f267 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0380.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0380.md @@ -3,7 +3,7 @@ platform: ios title: References to `evaluateJavaScript` Writing Sensitive Data into WebView DOM id: MASTG-TEST-0380 type: [static, code, manual] -weakness: MASWE-0069 +weakness: MASWE-0037 best-practices: [MASTG-BEST-0059] profiles: [L1, L2] knowledge: [MASTG-KNOW-0076, MASTG-KNOW-0139] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0389.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0389.md index 1dcc13e4e7e..785f5ef36f0 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0389.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0389.md @@ -3,7 +3,7 @@ platform: ios title: References to the App-Wide Restriction of Custom Keyboards id: MASTG-TEST-0389 type: [static, code, manual] -weakness: MASWE-0061 +weakness: MASWE-0034 prerequisites: - identify-sensitive-data best-practices: [MASTG-BEST-0069] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0390.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0390.md index 3eba211c972..df04a21c81c 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0390.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0390.md @@ -3,7 +3,7 @@ platform: ios title: Full Access Requested by a Custom Keyboard Extension id: MASTG-TEST-0390 type: [static, code, manual] -weakness: MASWE-0061 +weakness: MASWE-0034 prerequisites: - identify-sensitive-data best-practices: [MASTG-BEST-0069] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0395.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0395.md index 310b4031656..950e90f8bed 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0395.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0395.md @@ -3,7 +3,7 @@ platform: ios title: Missing Input Validation in Universal Link Handlers id: MASTG-TEST-0395 type: [static, code, manual] -weakness: MASWE-0058 +weakness: MASWE-0032 profiles: [L1, L2] best-practices: [MASTG-BEST-0072] knowledge: [MASTG-KNOW-0080] diff --git a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0281.md b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0281.md index 8105ee4c613..ba56eef245e 100644 --- a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0281.md +++ b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0281.md @@ -3,7 +3,7 @@ platform: ios title: Undeclared Known Tracking Domains id: MASTG-TEST-0281 type: [static, dynamic] -weakness: MASWE-0108 +weakness: MASWE-0073 profiles: [P] --- diff --git a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0360.md b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0360.md index 3a22151d2c1..17c19d7e43f 100644 --- a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0360.md +++ b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0360.md @@ -3,7 +3,7 @@ title: Purpose String Accuracy for Reachable Protected Resource Access platform: ios id: MASTG-TEST-0360 type: [static, config, manual] -weakness: MASWE-0117 +weakness: MASWE-0072 profiles: [P] best-practices: [MASTG-BEST-0051] knowledge: [MASTG-KNOW-0077] diff --git a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0361.md b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0361.md index 3412285141f..536319fee4c 100644 --- a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0361.md +++ b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0361.md @@ -3,7 +3,7 @@ title: Runtime Use of Protected Resource APIs Without Accurate Purpose Strings platform: ios id: MASTG-TEST-0361 type: [dynamic, hooks, manual] -weakness: MASWE-0117 +weakness: MASWE-0072 profiles: [P] best-practices: [MASTG-BEST-0051] knowledge: [MASTG-KNOW-0077] diff --git a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0362.md b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0362.md index 3be8d381f01..bb207761231 100644 --- a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0362.md +++ b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0362.md @@ -3,7 +3,7 @@ title: Entitlements for Unjustified Capability Exposure platform: ios id: MASTG-TEST-0362 type: [static, package, manual] -weakness: MASWE-0117 +weakness: MASWE-0072 profiles: [P] best-practices: [MASTG-BEST-0051] knowledge: [MASTG-KNOW-0077] diff --git a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0363.md b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0363.md index b3ca6126b7d..6186b1f10f0 100644 --- a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0363.md +++ b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0363.md @@ -3,7 +3,7 @@ title: Runtime Use of Entitlement-Backed APIs for Unjustified Capability Exposur platform: ios id: MASTG-TEST-0363 type: [dynamic, hooks, manual] -weakness: MASWE-0117 +weakness: MASWE-0072 profiles: [P] best-practices: [MASTG-BEST-0051] knowledge: [MASTG-KNOW-0077] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0219.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0219.md index 1142553e300..a3c18a170da 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0219.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0219.md @@ -3,7 +3,7 @@ platform: ios title: Testing for Debugging Symbols id: MASTG-TEST-0219 type: [static, code] -weakness: MASWE-0093 +weakness: MASWE-0054 profiles: [R] knowledge: [MASTG-KNOW-0063] --- diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0220.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0220.md index 6d94bed22c1..0190a67b430 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0220.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0220.md @@ -3,7 +3,7 @@ platform: ios title: Usage of Outdated Code Signature Format id: MASTG-TEST-0220 type: [static, code] -weakness: MASWE-0104 +weakness: MASWE-0062 profiles: [R] knowledge: [MASTG-KNOW-0058] --- diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0240.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0240.md index eb535baa24f..576c91129b0 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0240.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0240.md @@ -3,7 +3,7 @@ platform: ios title: Jailbreak Detection in Code id: MASTG-TEST-0240 type: [static, code] -weakness: MASWE-0097 +weakness: MASWE-0056 false_negative_prone: true profiles: [R] knowledge: [MASTG-KNOW-0084] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0241.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0241.md index 3a5ca4f3f18..019c4687b05 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0241.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0241.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Use of Jailbreak Detection Techniques id: MASTG-TEST-0241 type: [dynamic, hooks] -weakness: MASWE-0097 +weakness: MASWE-0056 false_negative_prone: true profiles: [R] knowledge: [MASTG-KNOW-0084] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0246.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0246.md index b059dbd53b5..d3ca376abd4 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0246.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0246.md @@ -4,7 +4,7 @@ title: Runtime Use of Secure Screen Lock Detection APIs id: MASTG-TEST-0246 apis: [LAContext.canEvaluatePolicy, kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly] type: [dynamic, hooks] -weakness: MASWE-0008 +weakness: MASWE-0049 best-practices: [] profiles: [L2] knowledge: [MASTG-KNOW-0056] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0248.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0248.md index 80a76b92751..23bafea8a3a 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0248.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0248.md @@ -4,7 +4,7 @@ title: References to APIs for Detecting Secure Screen Lock id: MASTG-TEST-0248 apis: [LAContext.canEvaluatePolicy, kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly] type: [static, code] -weakness: MASWE-0008 +weakness: MASWE-0049 best-practices: [] profiles: [L2] knowledge: [MASTG-KNOW-0056] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0261.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0261.md index 6c3edc24bb5..b10fdec3874 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0261.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0261.md @@ -3,7 +3,7 @@ platform: ios title: Debuggable Entitlement Enabled in the entitlements.plist id: MASTG-TEST-0261 type: [static, code] -weakness: MASWE-0067 +weakness: MASWE-0050 profiles: [R] knowledge: [MASTG-KNOW-0062] --- diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0354.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0354.md index 3feb7e1ef1f..d9c0b6f5c4c 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0354.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0354.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Use of Hook Detection Techniques id: MASTG-TEST-0354 type: [dynamic, hooks] -weakness: MASWE-0107 +weakness: MASWE-0064 profiles: [R] knowledge: [MASTG-KNOW-0087] best-practices: [MASTG-BEST-0048] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0358.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0358.md index 72012de7c43..2b3aca9cd56 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0358.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0358.md @@ -3,7 +3,7 @@ platform: ios title: Implementation Details Exposure Through Logging APIs id: MASTG-TEST-0358 type: [static, code] -weakness: MASWE-0094 +weakness: MASWE-0054 best-practices: [MASTG-BEST-0022] knowledge: [MASTG-KNOW-0064, MASTG-KNOW-0101] profiles: [R] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0359.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0359.md index 2796191c979..ab8602515e1 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0359.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0359.md @@ -3,7 +3,7 @@ platform: ios title: Implementation Details Exposure in Logs id: MASTG-TEST-0359 type: [dynamic, logs] -weakness: MASWE-0094 +weakness: MASWE-0054 best-practices: [MASTG-BEST-0022] knowledge: [MASTG-KNOW-0064, MASTG-KNOW-0101] profiles: [R] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0367.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0367.md index 38d8a7c6dce..3913667ce03 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0367.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0367.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Use of Virtual Device Detection Techniques id: MASTG-TEST-0367 type: [dynamic] -weakness: MASWE-0099 +weakness: MASWE-0058 best-practices: [MASTG-BEST-0053] profiles: [R] knowledge: [MASTG-KNOW-0135] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0387.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0387.md index 0d082b289df..5a67d786464 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0387.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0387.md @@ -4,7 +4,7 @@ title: References to Storage Integrity Check APIs id: MASTG-TEST-0387 apis: [HMAC, CCHmac, CCHmacFinal, CC_SHA256, CC_SHA512, SecKeyCreateSignature] type: [static, code, manual] -weakness: MASWE-0105 +weakness: MASWE-0063 false_negative_prone: true profiles: [R] knowledge: [MASTG-KNOW-0086] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0391.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0391.md index e0d7efd072a..5c1dabc1f0e 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0391.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0391.md @@ -3,7 +3,7 @@ platform: ios title: Insufficient Obfuscation of Security-Relevant Native Code id: MASTG-TEST-0391 type: [static, package, manual] -weakness: MASWE-0089 +weakness: MASWE-0051 best-practices: [MASTG-BEST-0029] profiles: [R] knowledge: [MASTG-KNOW-0089] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0401.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0401.md index 722b99746fa..c8e14801f4c 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0401.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0401.md @@ -4,7 +4,7 @@ title: References to Debugging Detection APIs id: MASTG-TEST-0401 apis: [ptrace, PT_DENY_ATTACH, sysctl, KERN_PROC_PID, P_TRACED, getppid, task_get_exception_ports, EXC_MASK_BREAKPOINT] type: [static, code, manual] -weakness: MASWE-0101 +weakness: MASWE-0060 best-practices: [MASTG-BEST-0029, MASTG-BEST-0074] profiles: [R] knowledge: [MASTG-KNOW-0085] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0402.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0402.md index a214c3f610f..d20af155548 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0402.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0402.md @@ -4,7 +4,7 @@ title: Runtime Use of Debugging Detection APIs id: MASTG-TEST-0402 apis: [ptrace, PT_DENY_ATTACH, sysctl, KERN_PROC_PID, P_TRACED, getppid, task_get_exception_ports, EXC_MASK_BREAKPOINT] type: [dynamic, hooks, manual] -weakness: MASWE-0101 +weakness: MASWE-0060 best-practices: [MASTG-BEST-0029, MASTG-BEST-0074] profiles: [R] knowledge: [MASTG-KNOW-0085] diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0215.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0215.md index 4e0213cfd7e..730f7943a8b 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0215.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0215.md @@ -3,7 +3,7 @@ platform: ios title: Sensitive Data Not Marked For Backup Exclusion id: MASTG-TEST-0215 type: [static, code] -weakness: MASWE-0004 +weakness: MASWE-0002 best-practices: [MASTG-BEST-0023] profiles: [L1, L2, P] knowledge: [MASTG-KNOW-0102] diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0298.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0298.md index 834e09c0e8f..d6806e4cf6f 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0298.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0298.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Monitoring of Files Eligible for Backup id: MASTG-TEST-0298 type: [dynamic, hooks] -weakness: MASWE-0004 +weakness: MASWE-0002 best-practices: [MASTG-BEST-0023] profiles: [L1, L2, P] knowledge: [MASTG-KNOW-0102] diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0299.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0299.md index ad604d93119..4a53f96a50a 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0299.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0299.md @@ -6,7 +6,7 @@ type: [dynamic, filesystem] prerequisites: - identify-sensitive-data profiles: [L1] -weakness: MASWE-0006 +weakness: MASWE-0003 best-practices: [MASTG-BEST-0024] knowledge: [MASTG-KNOW-0082, MASTG-KNOW-0091, MASTG-KNOW-0108] --- diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0300.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0300.md index 71003b6e717..2fcfbd1fa95 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0300.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0300.md @@ -5,7 +5,7 @@ id: MASTG-TEST-0300 type: [static, code] profiles: [L2] best-practices: [MASTG-BEST-0024] -weakness: MASWE-0006 +weakness: MASWE-0003 knowledge: [MASTG-KNOW-0091, MASTG-KNOW-0057, MASTG-KNOW-0108] --- diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0301.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0301.md index 3f4dd31dae5..8350627adc4 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0301.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0301.md @@ -4,7 +4,7 @@ title: Runtime Use of APIs for Storing Unencrypted Data in Private Storage id: MASTG-TEST-0301 type: [dynamic, hooks] profiles: [L2] -weakness: MASWE-0006 +weakness: MASWE-0003 best-practices: [MASTG-BEST-0024] knowledge: [MASTG-KNOW-0091, MASTG-KNOW-0057, MASTG-KNOW-0108] --- diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0302.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0302.md index c604f89f995..d739bc29adc 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0302.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0302.md @@ -6,7 +6,7 @@ type: [dynamic, filesystem] prerequisites: - identify-sensitive-data profiles: [L2] -weakness: MASWE-0006 +weakness: MASWE-0003 best-practices: [MASTG-BEST-0024] knowledge: [MASTG-KNOW-0108] --- diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0303.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0303.md index 1631d12d955..fa842e5a776 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0303.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0303.md @@ -5,7 +5,7 @@ id: MASTG-TEST-0303 type: [static, code] profiles: [L1, L2] best-practices: [MASTG-BEST-0024] -weakness: MASWE-0007 +weakness: MASWE-0004 knowledge: [MASTG-KNOW-0122, MASTG-KNOW-0091, MASTG-KNOW-0057, MASTG-KNOW-0108] --- diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0313.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0313.md index e6bca86576a..f012c5f707b 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0313.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0313.md @@ -3,7 +3,7 @@ platform: ios title: References to APIs for Preventing Keyboard Caching of Text Fields id: MASTG-TEST-0313 type: [static, code, manual] -weakness: MASWE-0053 +weakness: MASWE-0028 profiles: [L2] best-practices: [MASTG-BEST-0026] knowledge: [MASTG-KNOW-0100] diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0314.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0314.md index c69145cabd1..fcaabed60a9 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0314.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0314.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Monitoring of Text Fields Eligible for Keyboard Caching id: MASTG-TEST-0314 type: [dynamic, hooks] -weakness: MASWE-0053 +weakness: MASWE-0028 profiles: [L2] prerequisites: - identify-sensitive-data diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0388.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0388.md index bafd3128480..ed644d12192 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0388.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0388.md @@ -3,7 +3,7 @@ platform: ios title: References to Sensitive Data Stored Unprotected in Shared App Group Containers id: MASTG-TEST-0388 type: [static, code, manual] -weakness: MASWE-0006 +weakness: MASWE-0003 prerequisites: - identify-sensitive-data best-practices: [MASTG-BEST-0068] From a2fa01ae132a507b509c8c5c14056eec9e3966a6 Mon Sep 17 00:00:00 2001 From: Carlos Holguera Date: Sun, 19 Jul 2026 20:26:32 +0200 Subject: [PATCH 2/5] fix ID --- best-practices/MASTG-BEST-0007.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/best-practices/MASTG-BEST-0007.md b/best-practices/MASTG-BEST-0007.md index 208eab4d6eb..8924aedee23 100644 --- a/best-practices/MASTG-BEST-0007.md +++ b/best-practices/MASTG-BEST-0007.md @@ -8,4 +8,4 @@ knowledge: [MASTG-KNOW-0007] Ensure the debuggable flag in the AndroidManifest.xml is set to `false` for all release builds. -**Note:** Disabling debugging via the `debuggable` flag is an important first step but does not fully protect the app from advanced attacks. Skilled attackers can enable debugging through various means, such as binary patching (see @MASTG-TECH-0038) to allow attachment of a debugger or the use of binary instrumentation tools like @MASTG-TOOL-0001 to achieve similar capabilities. For apps requiring a higher level of security, consider implementing anti-debugging techniques as an additional layer of defense. Refer to @MASWE-0101 for detailed guidance. +**Note:** Disabling debugging via the `debuggable` flag is an important first step but does not fully protect the app from advanced attacks. Skilled attackers can enable debugging through various means, such as binary patching (see @MASTG-TECH-0038) to allow attachment of a debugger or the use of binary instrumentation tools like @MASTG-TOOL-0001 to achieve similar capabilities. For apps requiring a higher level of security, consider implementing anti-debugging techniques as an additional layer of defense. Refer to @MASWE-0060 for detailed guidance. From b6cd9ab65e9f6854f007ce0f9b87ef1757ff3512 Mon Sep 17 00:00:00 2001 From: Carlos Holguera Date: Sun, 2 Aug 2026 10:17:52 +0200 Subject: [PATCH 3/5] fix maswe ref in test 0390 --- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0390.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0390.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0390.md index df04a21c81c..ec8e2e59905 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0390.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0390.md @@ -3,7 +3,7 @@ platform: ios title: Full Access Requested by a Custom Keyboard Extension id: MASTG-TEST-0390 type: [static, code, manual] -weakness: MASWE-0034 +weakness: MASWE-0072 prerequisites: - identify-sensitive-data best-practices: [MASTG-BEST-0069] From db30b2eac2247776f70e9b4a4d149dfaf4a908ca Mon Sep 17 00:00:00 2001 From: Carlos Holguera Date: Sun, 2 Aug 2026 10:51:36 +0200 Subject: [PATCH 4/5] re-update MASWE IDs for MASWE v1.0.0 rc after enforcing consecutive IDs --- best-practices/MASTG-BEST-0007.md | 2 +- knowledge/android/MASVS-NETWORK/MASTG-KNOW-0015.md | 2 +- knowledge/ios/MASVS-NETWORK/MASTG-KNOW-0072.md | 2 +- tests-beta/android/MASVS-AUTH/MASTG-TEST-0326.md | 2 +- tests-beta/android/MASVS-AUTH/MASTG-TEST-0327.md | 2 +- tests-beta/android/MASVS-AUTH/MASTG-TEST-0328.md | 2 +- tests-beta/android/MASVS-AUTH/MASTG-TEST-0329.md | 2 +- tests-beta/android/MASVS-AUTH/MASTG-TEST-0330.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0245.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0272.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0274.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0337.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0339.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0372.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0374.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0375.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0382.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0392.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0398.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0399.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0400.md | 2 +- tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0204.md | 2 +- tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0205.md | 2 +- tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0208.md | 2 +- tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0212.md | 2 +- tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0221.md | 2 +- tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0232.md | 2 +- tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0307.md | 2 +- tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0308.md | 2 +- tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0309.md | 2 +- tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0310.md | 2 +- tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0312.md | 2 +- tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0350.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0217.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0218.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0233.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0234.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0235.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0236.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0237.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0238.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0239.md | 4 ++-- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0242.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0243.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0244.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0282.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0283.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0284.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0285.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0286.md | 2 +- tests-beta/android/MASVS-NETWORK/MASTG-TEST-0295.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0250.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0251.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0252.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0253.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0258.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0289.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0291.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0292.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0293.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0294.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0315.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0316.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0320.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0334.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0340.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0355.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0356.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0357.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0364.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0365.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0366.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0381.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0393.md | 2 +- tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0394.md | 2 +- tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0206.md | 2 +- tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0254.md | 2 +- tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0255.md | 2 +- tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0256.md | 2 +- tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0257.md | 2 +- tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0318.md | 2 +- tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0319.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0224.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0225.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0226.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0227.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0247.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0249.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0263.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0264.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0265.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0288.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0324.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0325.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0338.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0341.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0351.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0352.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0353.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0368.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0369.md | 2 +- tests-beta/android/MASVS-STORAGE/MASTG-TEST-0200.md | 2 +- tests-beta/android/MASVS-STORAGE/MASTG-TEST-0201.md | 2 +- tests-beta/android/MASVS-STORAGE/MASTG-TEST-0202.md | 2 +- tests-beta/android/MASVS-STORAGE/MASTG-TEST-0203.md | 2 +- tests-beta/android/MASVS-STORAGE/MASTG-TEST-0207.md | 2 +- tests-beta/android/MASVS-STORAGE/MASTG-TEST-0216.md | 2 +- tests-beta/android/MASVS-STORAGE/MASTG-TEST-0231.md | 2 +- tests-beta/android/MASVS-STORAGE/MASTG-TEST-0262.md | 2 +- tests-beta/android/MASVS-STORAGE/MASTG-TEST-0287.md | 2 +- tests-beta/android/MASVS-STORAGE/MASTG-TEST-0304.md | 2 +- tests-beta/android/MASVS-STORAGE/MASTG-TEST-0305.md | 2 +- tests-beta/android/MASVS-STORAGE/MASTG-TEST-0306.md | 2 +- tests-beta/ios/MASVS-AUTH/MASTG-TEST-0266.md | 2 +- tests-beta/ios/MASVS-AUTH/MASTG-TEST-0267.md | 2 +- tests-beta/ios/MASVS-AUTH/MASTG-TEST-0268.md | 2 +- tests-beta/ios/MASVS-AUTH/MASTG-TEST-0269.md | 2 +- tests-beta/ios/MASVS-AUTH/MASTG-TEST-0270.md | 2 +- tests-beta/ios/MASVS-AUTH/MASTG-TEST-0271.md | 2 +- tests-beta/ios/MASVS-CODE/MASTG-TEST-0273.md | 2 +- tests-beta/ios/MASVS-CODE/MASTG-TEST-0275.md | 2 +- tests-beta/ios/MASVS-CODE/MASTG-TEST-0383.md | 2 +- tests-beta/ios/MASVS-CODE/MASTG-TEST-0384.md | 2 +- tests-beta/ios/MASVS-CODE/MASTG-TEST-0386.md | 2 +- tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0209.md | 2 +- tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0210.md | 2 +- tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0211.md | 2 +- tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0213.md | 2 +- tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0214.md | 2 +- tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0311.md | 2 +- tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0317.md | 2 +- tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0349.md | 2 +- tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0321.md | 2 +- tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0322.md | 2 +- tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0323.md | 2 +- tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0342.md | 2 +- tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0343.md | 2 +- tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0344.md | 2 +- tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0345.md | 2 +- tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0348.md | 2 +- tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0385.md | 2 +- tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0396.md | 2 +- tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0397.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0276.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0277.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0278.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0279.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0280.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0290.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0331.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0332.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0333.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0335.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0336.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0346.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0347.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0370.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0371.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0376.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0377.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0378.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0379.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0380.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0389.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0390.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0395.md | 2 +- tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0281.md | 2 +- tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0360.md | 2 +- tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0361.md | 2 +- tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0362.md | 2 +- tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0363.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0219.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0220.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0240.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0241.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0246.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0248.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0261.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0354.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0358.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0359.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0367.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0387.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0391.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0401.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0402.md | 2 +- tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0215.md | 2 +- tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0296.md | 2 +- tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0297.md | 2 +- tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0298.md | 2 +- tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0299.md | 2 +- tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0300.md | 2 +- tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0301.md | 2 +- tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0302.md | 2 +- tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0303.md | 2 +- tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0313.md | 2 +- tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0314.md | 2 +- tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0388.md | 2 +- 198 files changed, 199 insertions(+), 199 deletions(-) diff --git a/best-practices/MASTG-BEST-0007.md b/best-practices/MASTG-BEST-0007.md index 8924aedee23..8ab302965a5 100644 --- a/best-practices/MASTG-BEST-0007.md +++ b/best-practices/MASTG-BEST-0007.md @@ -8,4 +8,4 @@ knowledge: [MASTG-KNOW-0007] Ensure the debuggable flag in the AndroidManifest.xml is set to `false` for all release builds. -**Note:** Disabling debugging via the `debuggable` flag is an important first step but does not fully protect the app from advanced attacks. Skilled attackers can enable debugging through various means, such as binary patching (see @MASTG-TECH-0038) to allow attachment of a debugger or the use of binary instrumentation tools like @MASTG-TOOL-0001 to achieve similar capabilities. For apps requiring a higher level of security, consider implementing anti-debugging techniques as an additional layer of defense. Refer to @MASWE-0060 for detailed guidance. +**Note:** Disabling debugging via the `debuggable` flag is an important first step but does not fully protect the app from advanced attacks. Skilled attackers can enable debugging through various means, such as binary patching (see @MASTG-TECH-0038) to allow attachment of a debugger or the use of binary instrumentation tools like @MASTG-TOOL-0001 to achieve similar capabilities. For apps requiring a higher level of security, consider implementing anti-debugging techniques as an additional layer of defense. Refer to @MASWE-0065 for detailed guidance. diff --git a/knowledge/android/MASVS-NETWORK/MASTG-KNOW-0015.md b/knowledge/android/MASVS-NETWORK/MASTG-KNOW-0015.md index 8305af0e627..66b3d312bf9 100644 --- a/knowledge/android/MASVS-NETWORK/MASTG-KNOW-0015.md +++ b/knowledge/android/MASVS-NETWORK/MASTG-KNOW-0015.md @@ -6,7 +6,7 @@ title: Certificate Pinning [Certificate pinning](../../../Document/0x04f-Testing-Network-Communication.md#restricting-trust-identity-pinning) can be employed in Android apps to safeguard against Machine-in-the-Middle (MITM) attacks by ensuring that the app communicates exclusively with remote endpoints possessing specific identities. -While effective when implemented correctly, insecure implementations potentially enable attackers to read and modify all communication. For more general details on pinning, refer to @MASWE-0047. +While effective when implemented correctly, insecure implementations potentially enable attackers to read and modify all communication. For more general details on pinning, refer to @MASWE-0028. Several approaches to certificate pinning exist, depending on the app's API level and the libraries used. Below, we highlight the most common methods. For a deeper dive into the specific implementations, see ["Deep Dive into Certificate Pinning on Android"](https://securevale.blog/articles/deep-dive-into-certificate-pinning-on-android/). diff --git a/knowledge/ios/MASVS-NETWORK/MASTG-KNOW-0072.md b/knowledge/ios/MASVS-NETWORK/MASTG-KNOW-0072.md index c09807a2037..2bbe6c77ce6 100644 --- a/knowledge/ios/MASVS-NETWORK/MASTG-KNOW-0072.md +++ b/knowledge/ios/MASVS-NETWORK/MASTG-KNOW-0072.md @@ -27,7 +27,7 @@ References: [Certificate pinning](../../../Document/0x04f-Testing-Network-Communication.md#restricting-trust-identity-pinning) allows an iOS app to reject certificates that don't match a specific expected identity, guarding against Machine-in-the-Middle (MITM) attacks even when an attacker controls a CA that is trusted by the system. -Because pinning is layered on top of standard HTTPS, it does not weaken the underlying TLS connection. The risk lies in misconfiguration rather than in the mechanism itself. If pins are not maintained correctly, for example pinning a public key without providing a backup pin, or failing to update the pinned values before the server's certificate or key is rotated, the app will reject otherwise valid connections and break communication with the affected endpoints. This makes pinning misconfiguration an availability risk for the APIs the app depends on. For more general details on pinning, refer to @MASWE-0047. +Because pinning is layered on top of standard HTTPS, it does not weaken the underlying TLS connection. The risk lies in misconfiguration rather than in the mechanism itself. If pins are not maintained correctly, for example pinning a public key without providing a backup pin, or failing to update the pinned values before the server's certificate or key is rotated, the app will reject otherwise valid connections and break communication with the affected endpoints. This makes pinning misconfiguration an availability risk for the APIs the app depends on. For more general details on pinning, refer to @MASWE-0028. **Important Considerations:** diff --git a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0326.md b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0326.md index 07fd026c20c..38dbf37b44b 100644 --- a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0326.md +++ b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0326.md @@ -4,7 +4,7 @@ title: References to APIs Allowing Fallback to Non-Biometric Authentication id: MASTG-TEST-0326 apis: [BiometricPrompt, BiometricManager.Authenticators, setAllowedAuthenticators] type: [static, code] -weakness: MASWE-0022 +weakness: MASWE-0021 profiles: [L2] knowledge: [MASTG-KNOW-0001] best-practices: [MASTG-BEST-0031] diff --git a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0327.md b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0327.md index 66aed4fbb79..033a2df3c30 100644 --- a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0327.md +++ b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0327.md @@ -4,7 +4,7 @@ title: References to APIs for Event-Bound Biometric Authentication id: MASTG-TEST-0327 apis: [BiometricPrompt, BiometricPrompt.CryptoObject, authenticate] type: [static, code] -weakness: MASWE-0021 +weakness: MASWE-0020 profiles: [L2] knowledge: [MASTG-KNOW-0001, MASTG-KNOW-0043, MASTG-KNOW-0047, MASTG-KNOW-0012] best-practices: [MASTG-BEST-0036] diff --git a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0328.md b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0328.md index 68747b010a3..5a9ffcd0817 100644 --- a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0328.md +++ b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0328.md @@ -4,7 +4,7 @@ title: References to APIs Detecting Biometric Enrollment Changes id: MASTG-TEST-0328 apis: [KeyGenParameterSpec.Builder, setInvalidatedByBiometricEnrollment] type: [static, code] -weakness: MASWE-0023 +weakness: MASWE-0022 profiles: [L2] knowledge: [MASTG-KNOW-0001] best-practices: [MASTG-BEST-0037] diff --git a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0329.md b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0329.md index e178de86d0d..9fd45340afe 100644 --- a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0329.md +++ b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0329.md @@ -4,7 +4,7 @@ title: References to APIs Enforcing Authentication without Explicit User Action id: MASTG-TEST-0329 apis: [BiometricPrompt.PromptInfo.Builder, setConfirmationRequired] type: [static, code] -weakness: MASWE-0021 +weakness: MASWE-0020 profiles: [L2] knowledge: [MASTG-KNOW-0001] best-practices: [MASTG-BEST-0038] diff --git a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0330.md b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0330.md index 4ed7e4d6c33..75769b80169 100644 --- a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0330.md +++ b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0330.md @@ -4,7 +4,7 @@ title: References to APIs for Keys used in Biometric Authentication with Extende id: MASTG-TEST-0330 apis: [KeyGenParameterSpec.Builder, setUserAuthenticationParameters, setUserAuthenticationValidityDurationSeconds] type: [static, code] -weakness: MASWE-0021 +weakness: MASWE-0020 profiles: [L2] knowledge: [MASTG-KNOW-0001, MASTG-KNOW-0043, MASTG-KNOW-0047, MASTG-KNOW-0012] best-practices: [MASTG-BEST-0036] diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0245.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0245.md index f13a8958090..ceba0c488fe 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0245.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0245.md @@ -4,7 +4,7 @@ title: References to Platform Version APIs id: MASTG-TEST-0245 apis: [Build] type: [static, code] -weakness: MASWE-0042 +weakness: MASWE-0041 best-practices: [] profiles: [L2] --- diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0272.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0272.md index 23e52ad0a43..676d12e1e35 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0272.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0272.md @@ -3,7 +3,7 @@ platform: android title: Identify Dependencies with Known Vulnerabilities in the Android Project id: MASTG-TEST-0272 type: [static, code] -weakness: MASWE-0041 +weakness: MASWE-0044 profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0274.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0274.md index 892e126a369..0403b68d450 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0274.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0274.md @@ -3,7 +3,7 @@ platform: android title: Dependencies with Known Vulnerabilities in the App's SBOM id: MASTG-TEST-0274 type: [static, developer] -weakness: MASWE-0041 +weakness: MASWE-0044 profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0337.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0337.md index 9f2049b7c69..8969fc8630f 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0337.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0337.md @@ -3,7 +3,7 @@ title: References to Object Deserialization of Untrusted Data platform: android id: MASTG-TEST-0337 type: [static, code] -weakness: MASWE-0048 +weakness: MASWE-0051 profiles: [L1, L2] knowledge: [MASTG-KNOW-0021] --- diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0339.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0339.md index f5cf4a63aa7..d60bf4631d0 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0339.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0339.md @@ -3,7 +3,7 @@ title: SQL Injection in Content Providers platform: android id: MASTG-TEST-0339 type: [static, code] -weakness: MASWE-0048 +weakness: MASWE-0051 best-practices: [MASTG-BEST-0039] profiles: [L1, L2] knowledge: [MASTG-KNOW-0117] diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0372.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0372.md index f7288c8a66f..139a5efe494 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0372.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0372.md @@ -3,7 +3,7 @@ title: Implicit Intents Used for Internal App Communication platform: android id: MASTG-TEST-0372 type: [static, code, manual] -weakness: MASWE-0035 +weakness: MASWE-0032 best-practices: [MASTG-BEST-0056] knowledge: [MASTG-KNOW-0025] profiles: [L1, L2] diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0374.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0374.md index 2bce69c4ceb..729f620222f 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0374.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0374.md @@ -3,7 +3,7 @@ title: References to Implicit Intents Carrying Sensitive Extras platform: android id: MASTG-TEST-0374 type: [static, code, manual] -weakness: MASWE-0035 +weakness: MASWE-0032 best-practices: [MASTG-BEST-0056] knowledge: [MASTG-KNOW-0025] profiles: [L1, L2] diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0375.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0375.md index 4b87ffa604a..c5fb32b1a2b 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0375.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0375.md @@ -3,7 +3,7 @@ title: Missing Validation of Data Returned from Implicit Intents platform: android id: MASTG-TEST-0375 type: [dynamic, hooks, manual] -weakness: MASWE-0048 +weakness: MASWE-0051 best-practices: [MASTG-BEST-0057] knowledge: [MASTG-KNOW-0025, MASTG-KNOW-0138] profiles: [L1, L2] diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0382.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0382.md index 6e6e4b54cd2..7967f80fc3d 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0382.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0382.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of Enforced Updating APIs id: MASTG-TEST-0382 type: [dynamic, network, hooks, manual] -weakness: MASWE-0040 +weakness: MASWE-0043 profiles: [L2] knowledge: [MASTG-KNOW-0023] --- diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0392.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0392.md index 154ee5c618a..e1baf5cfb5f 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0392.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0392.md @@ -3,7 +3,7 @@ platform: android title: References to Enforced Updating APIs id: MASTG-TEST-0392 type: [static, code, manual] -weakness: MASWE-0040 +weakness: MASWE-0043 profiles: [L2] knowledge: [MASTG-KNOW-0023] --- diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0398.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0398.md index 8a4a46a0027..b96a1c5dde0 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0398.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0398.md @@ -4,7 +4,7 @@ title: References to WebViewClient URL Loading Handlers id: MASTG-TEST-0398 apis: [WebView, WebViewClient, shouldOverrideUrlLoading, shouldInterceptRequest, setWebViewClient] type: [static, code, manual] -weakness: MASWE-0038 +weakness: MASWE-0035 best-practices: [] profiles: [L1, L2] knowledge: [MASTG-KNOW-0018] diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0399.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0399.md index 645ac000dcf..d8c26c5d0ff 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0399.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0399.md @@ -4,7 +4,7 @@ title: SafeBrowsing Disabled id: MASTG-TEST-0399 apis: [WebView, WebSettings, EnableSafeBrowsing, setSafeBrowsingEnabled] type: [static, config, code] -weakness: MASWE-0038 +weakness: MASWE-0035 best-practices: [] knowledge: [MASTG-KNOW-0018] available_since: 27 diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0400.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0400.md index 13f70229e9d..f41241dddc9 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0400.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0400.md @@ -4,7 +4,7 @@ title: Runtime Use of WebViewClient URL Loading Handlers id: MASTG-TEST-0400 apis: [WebView, WebViewClient, shouldOverrideUrlLoading, shouldInterceptRequest, Uri, getHost, getScheme, getPath] type: [dynamic, hooks, manual] -weakness: MASWE-0038 +weakness: MASWE-0035 best-practices: [] profiles: [L1, L2] knowledge: [MASTG-KNOW-0018] diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0204.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0204.md index 3064682f172..6ab93b3affd 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0204.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0204.md @@ -7,7 +7,7 @@ best-practices: [MASTG-BEST-0001] prerequisites: - identify-sensitive-data - identify-security-relevant-contexts -weakness: MASWE-0016 +weakness: MASWE-0012 profiles: [L1, L2] knowledge: [MASTG-KNOW-0013] --- diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0205.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0205.md index 5b26f543dde..ff5ab5393bf 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0205.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0205.md @@ -7,7 +7,7 @@ best-practices: [MASTG-BEST-0001] prerequisites: - identify-sensitive-data - identify-security-relevant-contexts -weakness: MASWE-0016 +weakness: MASWE-0012 profiles: [L1, L2] knowledge: [MASTG-KNOW-0013] --- diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0208.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0208.md index 28f55692660..faff0edea0b 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0208.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0208.md @@ -3,7 +3,7 @@ platform: android title: Insufficient Key Sizes id: MASTG-TEST-0208 type: [static, code] -weakness: MASWE-0007 +weakness: MASWE-0013 profiles: [L1, L2] knowledge: [MASTG-KNOW-0012] --- diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0212.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0212.md index bd5cb1033d3..b72e64b7ae3 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0212.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0212.md @@ -3,7 +3,7 @@ title: Use of Hardcoded Cryptographic Keys in Code platform: android id: MASTG-TEST-0212 type: [static, code] -weakness: MASWE-0005 +weakness: MASWE-0003 profiles: [L1, L2] knowledge: [MASTG-KNOW-0012] --- diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0221.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0221.md index d0d0185beb4..95730f4b1cf 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0221.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0221.md @@ -3,7 +3,7 @@ title: Broken Symmetric Encryption Algorithms platform: android id: MASTG-TEST-0221 type: [static, code, manual] -weakness: MASWE-0011 +weakness: MASWE-0007 best-practices: [MASTG-BEST-0009] profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0232.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0232.md index b834865dff2..354a9ff1099 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0232.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0232.md @@ -3,7 +3,7 @@ title: Broken Symmetric Encryption Modes platform: android id: MASTG-TEST-0232 type: [static, code, manual] -weakness: MASWE-0011 +weakness: MASWE-0007 best-practices: [MASTG-BEST-0005] profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0307.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0307.md index d79f76d27eb..a7dab7611bc 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0307.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0307.md @@ -3,7 +3,7 @@ platform: android title: References to Asymmetric Key Pairs Used For Multiple Purposes id: MASTG-TEST-0307 type: [static, code] -weakness: MASWE-0011 +weakness: MASWE-0007 profiles: [L2] knowledge: [MASTG-KNOW-0012] --- diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0308.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0308.md index c3ec71eab06..e60df01669e 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0308.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0308.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of Asymmetric Key Pairs Used For Multiple Purposes id: MASTG-TEST-0308 type: [dynamic, hooks] -weakness: MASWE-0011 +weakness: MASWE-0007 profiles: [L2] knowledge: [MASTG-KNOW-0012] --- diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0309.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0309.md index 6e1c16c3976..4c96f3b2f76 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0309.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0309.md @@ -3,7 +3,7 @@ platform: android title: References to Reused Initialization Vectors in Symmetric Encryption id: MASTG-TEST-0309 type: [static, code] -weakness: MASWE-0011 +weakness: MASWE-0007 status: placeholder profiles: [L2] note: Reusing a symmetric key is acceptable when IVs or nonces follow the rules defined for the mode. NIST SP 800 38A states that CBC requires a fresh or unpredictable IV for every encryption. NIST SP 800 38D states that counter based modes require a nonce that never repeats under the same key. Repeating a key and IV or nonce pair defeats confidentiality and can also undermine integrity. diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0310.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0310.md index a549f20e8e0..ca3d145374e 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0310.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0310.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of Reused Initialization Vectors in Symmetric Encryption id: MASTG-TEST-0310 type: [dynamic, hooks] -weakness: MASWE-0011 +weakness: MASWE-0007 status: placeholder profiles: [L2] note: Reusing a symmetric key is acceptable when IVs or nonces follow the rules defined for the mode. NIST SP 800 38A states that CBC requires a fresh or unpredictable IV for every encryption. NIST SP 800 38D states that counter based modes require a nonce that never repeats under the same key. Repeating a key and IV or nonce pair defeats confidentiality and can also undermine integrity. diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0312.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0312.md index df6cdbb8d8b..8f63cd16c99 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0312.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0312.md @@ -3,7 +3,7 @@ title: References to Explicit Security Provider in Cryptographic APIs platform: android id: MASTG-TEST-0312 type: [static, code] -weakness: MASWE-0011 +weakness: MASWE-0007 best-practices: [MASTG-BEST-0020] profiles: [L1, L2] knowledge: [MASTG-KNOW-0011] diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0350.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0350.md index c20d6410971..ae44c331518 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0350.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0350.md @@ -3,7 +3,7 @@ title: Runtime Use of Broken Symmetric Encryption Modes platform: android id: MASTG-TEST-0350 type: [dynamic, hooks, manual] -weakness: MASWE-0011 +weakness: MASWE-0007 best-practices: [MASTG-BEST-0005] profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0217.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0217.md index 59f811a1f0a..3dca210d261 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0217.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0217.md @@ -3,7 +3,7 @@ title: Insecure TLS Protocols Explicitly Allowed in Code platform: android id: MASTG-TEST-0217 type: [static, code] -weakness: MASWE-0025 +weakness: MASWE-0026 profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0218.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0218.md index 0c146ed1690..bcb5394854d 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0218.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0218.md @@ -3,7 +3,7 @@ title: Insecure TLS Protocols in Network Traffic platform: android id: MASTG-TEST-0218 type: [dynamic, network] -weakness: MASWE-0025 +weakness: MASWE-0026 profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0233.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0233.md index 01e88c01d8a..e5a11a79f18 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0233.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0233.md @@ -3,7 +3,7 @@ title: Hardcoded HTTP URLs platform: android id: MASTG-TEST-0233 type: [static, code] -weakness: MASWE-0025 +weakness: MASWE-0026 related-tests: [MASTG-TEST-0235, MASTG-TEST-0236, MASTG-TEST-0238] profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0234.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0234.md index adc184ec4bd..ea0ae3daf18 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0234.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0234.md @@ -3,7 +3,7 @@ title: Missing Implementation of Server Hostname Verification with SSLSockets platform: android id: MASTG-TEST-0234 type: [static, code] -weakness: MASWE-0026 +weakness: MASWE-0027 profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0235.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0235.md index 9cdfcbaa6af..885e2b171ca 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0235.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0235.md @@ -3,7 +3,7 @@ title: Android App Configurations Allowing Cleartext Traffic platform: android id: MASTG-TEST-0235 type: [static, code] -weakness: MASWE-0025 +weakness: MASWE-0026 profiles: [L1, L2] knowledge: [MASTG-KNOW-0014] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0236.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0236.md index ce77a557972..c86e67bdfcf 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0236.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0236.md @@ -3,7 +3,7 @@ title: Cleartext Traffic Observed on the Network platform: network id: MASTG-TEST-0236 type: [dynamic, network] -weakness: MASWE-0025 +weakness: MASWE-0026 profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0237.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0237.md index 8c6df7e2720..daeeb3e3459 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0237.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0237.md @@ -3,7 +3,7 @@ title: Cross-Platform Framework Configurations Allowing Cleartext Traffic platform: android id: MASTG-TEST-0237 type: [static, code] -weakness: MASWE-0025 +weakness: MASWE-0026 status: placeholder note: Cross-platform frameworks (e.g. Flutter, React native, ...), typically have their own implementations for HTTP libraries, where cleartext traffic can be allowed. profiles: [L1, L2] diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0238.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0238.md index 2f163bf8c0c..f04f3d9ed80 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0238.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0238.md @@ -3,7 +3,7 @@ title: Runtime Use of Network APIs Transmitting Cleartext Traffic platform: android id: MASTG-TEST-0238 type: [dynamic, hooks] -weakness: MASWE-0025 +weakness: MASWE-0026 status: placeholder note: Using Frida, you can trace all traffic of the app, mitigating the limitation of the dynamic analysis that you do not know which app, or which location is responsible for the traffic. Using Frida (and `.backtrace()`), you can be sure this is from the analyzed app, and know the exact location. A new limitation is then that all relevant networking APIs need to be instrumented. profiles: [L1, L2] diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0239.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0239.md index 045620024fa..93d1df25b81 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0239.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0239.md @@ -3,8 +3,8 @@ title: Using low-level APIs (e.g. Socket) to set up a custom HTTP connection platform: android id: MASTG-TEST-0239 type: [static, code] -weakness: MASWE-0025 +weakness: MASWE-0026 status: placeholder -note: This test could also be for MASWE-0049 but we'd need to support multiple weaknesses. +note: This test could also be for MASWE-0047 but we'd need to support multiple weaknesses. profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0242.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0242.md index 25a3dcfac9c..19b44131665 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0242.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0242.md @@ -3,7 +3,7 @@ title: Missing Certificate Pinning in Network Security Configuration platform: android id: MASTG-TEST-0242 type: [static, code] -weakness: MASWE-0027 +weakness: MASWE-0028 profiles: [L2] knowledge: [MASTG-KNOW-0014, MASTG-KNOW-0015] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0243.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0243.md index 3b724f78a3a..67f273dd41b 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0243.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0243.md @@ -3,7 +3,7 @@ title: Expired Certificate Pins in the Network Security Configuration platform: android id: MASTG-TEST-0243 type: [static, code] -weakness: MASWE-0027 +weakness: MASWE-0028 profiles: [L2] knowledge: [MASTG-KNOW-0014, MASTG-KNOW-0015] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0244.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0244.md index bd66406ab98..4e5512c0374 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0244.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0244.md @@ -3,7 +3,7 @@ title: Missing Certificate Pinning in Network Traffic platform: network id: MASTG-TEST-0244 type: [dynamic, network] -weakness: MASWE-0027 +weakness: MASWE-0028 profiles: [L2] knowledge: [MASTG-KNOW-0015] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0282.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0282.md index ae1a481d9ba..340f56807b4 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0282.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0282.md @@ -3,7 +3,7 @@ title: Unsafe Custom Trust Evaluation platform: android id: MASTG-TEST-0282 type: [static, code, manual] -weakness: MASWE-0026 +weakness: MASWE-0027 best-practices: [MASTG-BEST-0021] profiles: [L1, L2] knowledge: [MASTG-KNOW-0010] diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0283.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0283.md index 47ac9665e54..9d584a323a3 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0283.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0283.md @@ -3,7 +3,7 @@ title: Incorrect Implementation of Server Hostname Verification platform: android id: MASTG-TEST-0283 type: [static, code, manual] -weakness: MASWE-0026 +weakness: MASWE-0027 profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0284.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0284.md index b92a6219fa6..60cf48547fb 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0284.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0284.md @@ -3,7 +3,7 @@ title: Incorrect SSL Error Handling in WebViews platform: android id: MASTG-TEST-0284 type: [static, code, manual] -weakness: MASWE-0026 +weakness: MASWE-0027 best-practices: [MASTG-BEST-0021] profiles: [L1, L2] knowledge: [MASTG-KNOW-0010] diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0285.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0285.md index cc1ad3de8f3..7a6deb7c1dc 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0285.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0285.md @@ -4,7 +4,7 @@ platform: android id: MASTG-TEST-0285 type: [static, code] deprecated_since: 24 -weakness: MASWE-0026 +weakness: MASWE-0027 profiles: [L1, L2] knowledge: [MASTG-KNOW-0014] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0286.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0286.md index 7545c0b359f..b90d7b99db7 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0286.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0286.md @@ -3,7 +3,7 @@ title: Network Security Configuration Allowing Trust in User-Provided CAs platform: android id: MASTG-TEST-0286 type: [static, code] -weakness: MASWE-0026 +weakness: MASWE-0027 profiles: [L1, L2] knowledge: [MASTG-KNOW-0014] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0295.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0295.md index 1ebc5b25900..b05ce463b4c 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0295.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0295.md @@ -3,7 +3,7 @@ title: GMS Security Provider Not Updated platform: android id: MASTG-TEST-0295 type: [static, code] -weakness: MASWE-0026 +weakness: MASWE-0027 profiles: [L2] best-practices: [MASTG-BEST-0020] knowledge: [MASTG-KNOW-0011, MASTG-KNOW-0010] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0250.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0250.md index 882cd69a5f7..d1b50a1c10c 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0250.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0250.md @@ -5,7 +5,7 @@ alias: references-to-content-provider-access-in-webviews id: MASTG-TEST-0250 apis: [WebView, WebSettings, getSettings, ContentProvider, setAllowContentAccess, setAllowUniversalAccessFromFileURLs, setJavaScriptEnabled] type: [static, code] -weakness: MASWE-0037 +weakness: MASWE-0034 best-practices: [MASTG-BEST-0011, MASTG-BEST-0012, MASTG-BEST-0013, MASTG-BEST-0049] profiles: [L1, L2] knowledge: [MASTG-KNOW-0018] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0251.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0251.md index af38f718ca9..c22930464a9 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0251.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0251.md @@ -5,7 +5,7 @@ alias: references-to-content-provider-access-in-webviews id: MASTG-TEST-0251 apis: [WebView, WebSettings, getSettings, ContentProvider, setAllowContentAccess, setAllowUniversalAccessFromFileURLs, setJavaScriptEnabled] type: [dynamic, hooks, manual] -weakness: MASWE-0037 +weakness: MASWE-0034 best-practices: [MASTG-BEST-0011, MASTG-BEST-0012, MASTG-BEST-0013, MASTG-BEST-0049] profiles: [L1, L2] knowledge: [MASTG-KNOW-0018] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0252.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0252.md index 4aef642b2cc..7dbad1a7fbc 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0252.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0252.md @@ -5,7 +5,7 @@ alias: references-to-local-file-access-in-webviews id: MASTG-TEST-0252 apis: [WebView, WebSettings, getSettings, setAllowFileAccess, setAllowFileAccessFromFileURLs, setAllowUniversalAccessFromFileURLs] type: [static, code] -weakness: MASWE-0037 +weakness: MASWE-0034 best-practices: [MASTG-BEST-0010, MASTG-BEST-0011, MASTG-BEST-0012] profiles: [L1, L2] knowledge: [MASTG-KNOW-0018] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0253.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0253.md index 75ecededd13..cc012c96345 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0253.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0253.md @@ -5,7 +5,7 @@ alias: references-to-local-file-access-in-webviews id: MASTG-TEST-0253 apis: [WebView, WebSettings, getSettings, setAllowFileAccess, setAllowFileAccessFromFileURLs, setAllowUniversalAccessFromFileURLs] type: [dynamic, hooks, manual] -weakness: MASWE-0037 +weakness: MASWE-0034 best-practices: [MASTG-BEST-0010, MASTG-BEST-0011, MASTG-BEST-0012] profiles: [L1, L2] knowledge: [MASTG-KNOW-0018] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0258.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0258.md index 25c9f2f18b4..116d44a5a14 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0258.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0258.md @@ -3,7 +3,7 @@ platform: android title: References to Keyboard Caching Attributes in UI Elements id: MASTG-TEST-0258 type: [static, code] -weakness: MASWE-0028 +weakness: MASWE-0036 best-practices: [MASTG-BEST-0019] profiles: [L2] knowledge: [MASTG-KNOW-0055] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0289.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0289.md index d0fea7d1ffd..71acfe9552f 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0289.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0289.md @@ -5,7 +5,7 @@ id: MASTG-TEST-0289 type: [dynamic, filesystem, manual] profiles: [L2] best-practices: [MASTG-BEST-0014] -weakness: MASWE-0030 +weakness: MASWE-0038 prerequisites: - identify-sensitive-screens knowledge: [MASTG-KNOW-0053] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0291.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0291.md index a08647ad0ff..0ba0f84055a 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0291.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0291.md @@ -5,7 +5,7 @@ id: MASTG-TEST-0291 type: [static, code] profiles: [L2] best-practices: [MASTG-BEST-0014] -weakness: MASWE-0030 +weakness: MASWE-0038 knowledge: [MASTG-KNOW-0053] --- diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0292.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0292.md index f27b573c3e4..eba586d9a51 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0292.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0292.md @@ -5,7 +5,7 @@ id: MASTG-TEST-0292 type: [static, code] profiles: [L2] best-practices: [MASTG-BEST-0014, MASTG-BEST-0015] -weakness: MASWE-0030 +weakness: MASWE-0038 knowledge: [MASTG-KNOW-0053] status: placeholder note: This test verifies whether an app prevents sensitive data from being captured in the Recents screen when backgrounded. diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0293.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0293.md index 5eba5312bfc..bbd9a3bac20 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0293.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0293.md @@ -5,7 +5,7 @@ id: MASTG-TEST-0293 type: [static, code] profiles: [L2] best-practices: [MASTG-BEST-0014, MASTG-BEST-0017] -weakness: MASWE-0030 +weakness: MASWE-0038 knowledge: [MASTG-KNOW-0053] status: placeholder note: This test verifies whether an app prevents sensitive data from being captured in screenshots and screen recordings of `SurfaceView` components. diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0294.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0294.md index d038474daba..90f6591d301 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0294.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0294.md @@ -5,7 +5,7 @@ id: MASTG-TEST-0294 type: [static, code] profiles: [L2] best-practices: [MASTG-BEST-0014, MASTG-BEST-0018] -weakness: MASWE-0030 +weakness: MASWE-0038 knowledge: [MASTG-KNOW-0053] status: placeholder note: This test verifies whether an app prevents sensitive data from being captured in screenshots and screen recordings of Jetpack Compose dialogs. diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0315.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0315.md index 6bd215d83d9..a4fbf0eb8b1 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0315.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0315.md @@ -4,7 +4,7 @@ title: Sensitive Data Exposed via Notifications id: MASTG-TEST-0315 apis: [NotificationManager] type: [static, code] -weakness: MASWE-0029 +weakness: MASWE-0037 prerequisites: - identify-sensitive-data profiles: [L2] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0316.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0316.md index b637386c61f..ae88d57875d 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0316.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0316.md @@ -3,7 +3,7 @@ platform: android title: App Exposing User Authentication Data in Text Input Fields id: MASTG-TEST-0316 type: [static, code, manual] -weakness: MASWE-0028 +weakness: MASWE-0036 profiles: [L2] --- diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0320.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0320.md index e7b2dd86604..20155334477 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0320.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0320.md @@ -3,7 +3,7 @@ platform: android title: WebViews Not Cleaning Up Sensitive Data id: MASTG-TEST-0320 type: [dynamic, hooks] -weakness: MASWE-0003 +weakness: MASWE-0001 profiles: [L1, L2] best-practices: [MASTG-BEST-0028] knowledge: [MASTG-KNOW-0018] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0334.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0334.md index 261bb8512dd..619371d6477 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0334.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0334.md @@ -3,7 +3,7 @@ platform: android title: Native Code Exposed Through WebViews id: MASTG-TEST-0334 type: [static, code, manual] -weakness: MASWE-0037 +weakness: MASWE-0034 best-practices: [MASTG-BEST-0011, MASTG-BEST-0012, MASTG-BEST-0013, MASTG-BEST-0035] profiles: [L1, L2] knowledge: [MASTG-KNOW-0018] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0340.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0340.md index e9d9510439f..b10d0dbf1a7 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0340.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0340.md @@ -4,7 +4,7 @@ title: References to Overlay Attack Protections id: MASTG-TEST-0340 apis: [onFilterTouchEventForSecurity, setFilterTouchesWhenObscured, FLAG_WINDOW_IS_OBSCURED, FLAG_WINDOW_IS_PARTIALLY_OBSCURED] type: [static, code] -weakness: MASWE-0028 +weakness: MASWE-0036 best-practices: [MASTG-BEST-0040] profiles: [L2] knowledge: [MASTG-KNOW-0022] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0355.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0355.md index 520c49fe668..b2defd57e06 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0355.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0355.md @@ -3,7 +3,7 @@ platform: android title: References to Unauthorized Database Access through Content Providers id: MASTG-TEST-0355 type: [static, config, manual] -weakness: MASWE-0020 +weakness: MASWE-0018 profiles: [L1, L2] best-practices: [MASTG-BEST-0049] knowledge: [MASTG-KNOW-0020, MASTG-KNOW-0117] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0356.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0356.md index df839a408cb..eba97f8f4a0 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0356.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0356.md @@ -3,7 +3,7 @@ platform: android title: Runtime Verification of Unauthorized Database Access through Content Providers id: MASTG-TEST-0356 type: [dynamic, filesystem, manual] -weakness: MASWE-0020 +weakness: MASWE-0018 profiles: [L1, L2] best-practices: [MASTG-BEST-0049] knowledge: [MASTG-KNOW-0020, MASTG-KNOW-0117] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0357.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0357.md index 328d77e0d23..ba5fd56662e 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0357.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0357.md @@ -2,7 +2,7 @@ title: References to Oversharing of File-Based Content Providers platform: android id: MASTG-TEST-0357 -weakness: MASWE-0020 +weakness: MASWE-0018 type: [static, config, code, manual] best-practices: [MASTG-BEST-0049] profiles: [L1, L2] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0364.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0364.md index 83888e3ec24..5449e49b1e5 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0364.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0364.md @@ -3,7 +3,7 @@ platform: android title: Exported And Unprotected Activities That Expose Sensitive Functionality id: MASTG-TEST-0364 type: [static, config, code, manual] -weakness: MASWE-0020 +weakness: MASWE-0018 best-practices: [MASTG-BEST-0052] profiles: [L1, L2] knowledge: [MASTG-KNOW-0132, MASTG-KNOW-0017, MASTG-KNOW-0020] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0365.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0365.md index 8629a3f7344..8877a504d18 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0365.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0365.md @@ -3,7 +3,7 @@ platform: android title: Exported And Unprotected Services That Expose Sensitive Functionality id: MASTG-TEST-0365 type: [static, config, code, manual] -weakness: MASWE-0020 +weakness: MASWE-0018 best-practices: [MASTG-BEST-0052] profiles: [L1, L2] knowledge: [MASTG-KNOW-0133, MASTG-KNOW-0017, MASTG-KNOW-0020] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0366.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0366.md index 62b03938d28..a439da046d2 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0366.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0366.md @@ -3,7 +3,7 @@ platform: android title: Exported And Unprotected Broadcast Receivers That Expose Sensitive Functionality id: MASTG-TEST-0366 type: [static, config, code, manual] -weakness: MASWE-0020 +weakness: MASWE-0018 best-practices: [MASTG-BEST-0052] profiles: [L1, L2] knowledge: [MASTG-KNOW-0134, MASTG-KNOW-0017, MASTG-KNOW-0020] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0381.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0381.md index 71df8f12d05..7a3bcc249de 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0381.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0381.md @@ -3,7 +3,7 @@ title: References to Insecure PendingIntent Creation platform: android id: MASTG-TEST-0381 type: [static] -weakness: MASWE-0035 +weakness: MASWE-0032 best-practices: [MASTG-BEST-0063] profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0393.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0393.md index 6178e5da4cf..f7e26df9299 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0393.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0393.md @@ -3,7 +3,7 @@ title: Use of Unverified App Links platform: android id: MASTG-TEST-0393 type: [static, config] -weakness: MASWE-0032 +weakness: MASWE-0029 profiles: [L1, L2] knowledge: [MASTG-KNOW-0019] best-practices: [MASTG-BEST-0070] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0394.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0394.md index 421ed6a08c7..2d112f6fef9 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0394.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0394.md @@ -4,7 +4,7 @@ platform: android id: MASTG-TEST-0394 type: [static, code, manual] profiles: [L1, L2] -weakness: MASWE-0032 +weakness: MASWE-0029 knowledge: [MASTG-KNOW-0019] best-practices: [MASTG-BEST-0071] apis: [getData, getQueryParameter] diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0206.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0206.md index 8bf7226ad99..67818fdd045 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0206.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0206.md @@ -3,7 +3,7 @@ platform: android title: Undeclared PII in Network Traffic Capture id: MASTG-TEST-0206 type: [dynamic, network] -weakness: MASWE-0068 +weakness: MASWE-0074 prerequisites: - identify-sensitive-data - privacy-policy diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0254.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0254.md index fa665c245e7..bbbd98886ef 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0254.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0254.md @@ -3,7 +3,7 @@ title: Dangerous App Permissions platform: android id: MASTG-TEST-0254 type: [static, code] -weakness: MASWE-0072 +weakness: MASWE-0067 profiles: [P] knowledge: [MASTG-KNOW-0017] --- diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0255.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0255.md index 756e207559e..a1b301f5ddf 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0255.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0255.md @@ -2,7 +2,7 @@ platform: android title: Permission Requests Not Minimized id: MASTG-TEST-0255 -weakness: MASWE-0072 +weakness: MASWE-0067 status: placeholder note: This test checks if the app requests permissions that have privacy-preserving alternatives. profiles: [P] diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0256.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0256.md index 2253902eb38..659a0255c4d 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0256.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0256.md @@ -2,7 +2,7 @@ platform: android title: Missing Permission Rationale id: MASTG-TEST-0256 -weakness: MASWE-0072 +weakness: MASWE-0067 status: placeholder note: This test checks if the app does not provide a rationale for requesting permissions. See https://developer.android.com/training/permissions/requesting#explain and https://developer.android.com/training/permissions/explaining-access#privacy-dashboard-show-rationale profiles: [P] diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0257.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0257.md index f17d234e291..398151d5ffd 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0257.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0257.md @@ -2,7 +2,7 @@ platform: android title: Not Resetting Unused Permissions id: MASTG-TEST-0257 -weakness: MASWE-0072 +weakness: MASWE-0067 status: placeholder note: This test checks if the app does not remove unnecessary access to granted permissions. See https://developer.android.com/training/permissions/requesting#remove-access profiles: [P] diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0318.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0318.md index 6841e62c0c3..a508345fea5 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0318.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0318.md @@ -3,7 +3,7 @@ platform: android title: References to SDK APIs Known to Handle Sensitive User Data id: MASTG-TEST-0318 type: [static, code] -weakness: MASWE-0068 +weakness: MASWE-0074 profiles: [P] --- diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0319.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0319.md index c7e076a9f15..5227c020f83 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0319.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0319.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of SDK APIs Known to Handle Sensitive User Data id: MASTG-TEST-0319 type: [dynamic, hooks] -weakness: MASWE-0068 +weakness: MASWE-0074 prerequisites: - identify-sensitive-data profiles: [P] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0224.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0224.md index c8bde627621..144ae530c84 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0224.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0224.md @@ -4,7 +4,7 @@ platform: android id: MASTG-TEST-0224 type: [static, code] available_since: 24 -weakness: MASWE-0062 +weakness: MASWE-0057 best-practices: [MASTG-BEST-0006] profiles: [R] knowledge: [MASTG-KNOW-0003] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0225.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0225.md index b8ca2c9ea2f..02da5204400 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0225.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0225.md @@ -3,7 +3,7 @@ title: Usage of Insecure APK Signature Key Size platform: android id: MASTG-TEST-0225 type: [static, code] -weakness: MASWE-0062 +weakness: MASWE-0057 profiles: [R] knowledge: [MASTG-KNOW-0003] --- diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0226.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0226.md index a1ff39b54bc..679483c0f00 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0226.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0226.md @@ -3,7 +3,7 @@ title: Debuggable Flag Enabled in the AndroidManifest platform: android id: MASTG-TEST-0226 type: [static, code] -weakness: MASWE-0050 +weakness: MASWE-0064 best-practices: [MASTG-BEST-0007] profiles: [R] knowledge: [MASTG-KNOW-0007] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0227.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0227.md index 12ec7654dfb..7e0ef567cc5 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0227.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0227.md @@ -3,7 +3,7 @@ title: Debugging Enabled for WebViews platform: android id: MASTG-TEST-0227 type: [static, code] -weakness: MASWE-0050 +weakness: MASWE-0064 best-practices: [MASTG-BEST-0008] profiles: [R] knowledge: [MASTG-KNOW-0028] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0247.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0247.md index 675bbdb2a88..86a10f402ee 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0247.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0247.md @@ -4,7 +4,7 @@ title: References to APIs for Detecting Secure Screen Lock id: MASTG-TEST-0247 apis: [KeyguardManager, BiometricManager#canAuthenticate] type: [static, code] -weakness: MASWE-0049 +weakness: MASWE-0017 best-practices: [] profiles: [L2] knowledge: [MASTG-KNOW-0001] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0249.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0249.md index d23667ba810..6e124072fff 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0249.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0249.md @@ -4,7 +4,7 @@ title: Runtime Use of Secure Screen Lock Detection APIs id: MASTG-TEST-0249 apis: [KeyguardManager, BiometricManager#canAuthenticate] type: [dynamic, hooks] -weakness: MASWE-0049 +weakness: MASWE-0017 best-practices: [] profiles: [L2] knowledge: [MASTG-KNOW-0001] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0263.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0263.md index 73e02c91e27..dcffd702dbc 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0263.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0263.md @@ -4,7 +4,7 @@ title: Logging of StrictMode Violations id: MASTG-TEST-0263 apis: [StrictMode] type: [dynamic, logs] -weakness: MASWE-0054 +weakness: MASWE-0062 profiles: [R] --- diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0264.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0264.md index 0911e1c82bb..846b049e63a 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0264.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0264.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of StrictMode APIs id: MASTG-TEST-0264 type: [dynamic, hooks] -weakness: MASWE-0054 +weakness: MASWE-0062 best-practices: [] profiles: [R] --- diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0265.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0265.md index 2119670c329..c992f26d931 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0265.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0265.md @@ -3,7 +3,7 @@ platform: android title: References to StrictMode APIs id: MASTG-TEST-0265 type: [static, code] -weakness: MASWE-0054 +weakness: MASWE-0062 best-practices: [] profiles: [R] --- diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0288.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0288.md index 0da4b80d944..e80954a16d7 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0288.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0288.md @@ -4,7 +4,7 @@ title: Debugging Symbols in Native Binaries alias: debugging-symbols-in-native-binaries id: MASTG-TEST-0288 type: [static, code] -weakness: MASWE-0054 +weakness: MASWE-0062 best-practices: [] profiles: [R] --- diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0324.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0324.md index 605e4fc26cf..d9722d0d286 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0324.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0324.md @@ -3,7 +3,7 @@ platform: android title: References to Root Detection Mechanisms id: MASTG-TEST-0324 type: [static, code] -weakness: MASWE-0056 +weakness: MASWE-0052 best-practices: [MASTG-BEST-0029, MASTG-BEST-0030] profiles: [R] knowledge: [MASTG-KNOW-0027] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0325.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0325.md index a9bf3ab5765..f7586110312 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0325.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0325.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of Root Detection Techniques id: MASTG-TEST-0325 type: [dynamic, hooks] -weakness: MASWE-0056 +weakness: MASWE-0052 best-practices: [MASTG-BEST-0029, MASTG-BEST-0030] profiles: [R] knowledge: [MASTG-KNOW-0027] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0338.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0338.md index 40c0bfba2d8..e0a8db1b6ff 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0338.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0338.md @@ -4,7 +4,7 @@ platform: android id: MASTG-TEST-0338 apis: [javax.crypto.Mac, java.security.Signature, java.security.MessageDigest] type: [static, code, manual] -weakness: MASWE-0063 +weakness: MASWE-0058 false_negative_prone: true profiles: [R] knowledge: [MASTG-KNOW-0036] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0341.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0341.md index 9103c826177..65034884e04 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0341.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0341.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of Hook Detection Techniques id: MASTG-TEST-0341 type: [dynamic, hooks] -weakness: MASWE-0064 +weakness: MASWE-0059 best-practices: [MASTG-BEST-0041] profiles: [R] knowledge: [MASTG-KNOW-0030, MASTG-KNOW-0032, MASTG-KNOW-0118] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0351.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0351.md index ecc19b8ca7f..af8a335d173 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0351.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0351.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of Emulator Detection Techniques id: MASTG-TEST-0351 type: [dynamic, hooks] -weakness: MASWE-0058 +weakness: MASWE-0054 best-practices: [MASTG-BEST-0046] profiles: [R] knowledge: [MASTG-KNOW-0031] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0352.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0352.md index cc448523713..718b562b980 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0352.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0352.md @@ -3,7 +3,7 @@ platform: android title: References to Debugging Detection APIs id: MASTG-TEST-0352 type: [static, code, manual] -weakness: MASWE-0060 +weakness: MASWE-0065 best-practices: [MASTG-BEST-0007, MASTG-BEST-0029, MASTG-BEST-0047] profiles: [R] knowledge: [MASTG-KNOW-0007, MASTG-KNOW-0028] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0353.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0353.md index f5bf69cd97c..5d5a7fdd551 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0353.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0353.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of Debugging Detection APIs id: MASTG-TEST-0353 type: [dynamic, hooks, manual] -weakness: MASWE-0060 +weakness: MASWE-0065 best-practices: [MASTG-BEST-0007, MASTG-BEST-0029, MASTG-BEST-0047] profiles: [R] knowledge: [MASTG-KNOW-0007, MASTG-KNOW-0028] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0368.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0368.md index 724e94894ee..efbdd9036cf 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0368.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0368.md @@ -3,7 +3,7 @@ platform: android title: Insufficient Obfuscation of Security-Relevant Java/Kotlin Code id: MASTG-TEST-0368 type: [static, code, manual] -weakness: MASWE-0051 +weakness: MASWE-0060 best-practices: [MASTG-BEST-0029] profiles: [R] knowledge: [MASTG-KNOW-0033] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0369.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0369.md index 5fc7b27ab11..13ee92f230a 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0369.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0369.md @@ -3,7 +3,7 @@ platform: android title: Insufficient Obfuscation of Security-Relevant Native Code id: MASTG-TEST-0369 type: [static, package, manual] -weakness: MASWE-0051 +weakness: MASWE-0060 best-practices: [MASTG-BEST-0029] profiles: [R] knowledge: [MASTG-KNOW-0033] diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0200.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0200.md index 3a782d04142..280bf8413e9 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0200.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0200.md @@ -3,7 +3,7 @@ platform: android title: Files Written to External Storage id: MASTG-TEST-0200 type: [dynamic, filesystem, manual] -weakness: MASWE-0004 +weakness: MASWE-0002 profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0201.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0201.md index 8c6c2a1f532..1ac9b6fb7d9 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0201.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0201.md @@ -4,7 +4,7 @@ title: Runtime Use of APIs to Access External Storage id: MASTG-TEST-0201 apis: [Environment#getExternalStorageDirectory, Environment#getExternalStorageDirectory, Environment#getExternalFilesDir, Environment#getExternalCacheDir, FileOutputStream] type: [dynamic, hooks, manual] -weakness: MASWE-0004 +weakness: MASWE-0002 profiles: [L1, L2] knowledge: [MASTG-KNOW-0042] --- diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0202.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0202.md index 28a275984ba..77a223a313f 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0202.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0202.md @@ -4,7 +4,7 @@ title: References to APIs and Permissions for Accessing External Storage id: MASTG-TEST-0202 apis: [Environment#getExternalStoragePublicDirectory, Environment#getExternalStorageDirectory, Environment#getExternalFilesDir, Environment#getExternalCacheDir, MediaStore, WRITE_EXTERNAL_STORAGE, MANAGE_EXTERNAL_STORAGE] type: [static, code, manual] -weakness: MASWE-0004 +weakness: MASWE-0002 profiles: [L1, L2] knowledge: [MASTG-KNOW-0042] --- diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0203.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0203.md index 4d13c11384e..4992b40dfae 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0203.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0203.md @@ -4,7 +4,7 @@ title: Runtime Use of Logging APIs id: MASTG-TEST-0203 apis: [Log, Logger, System.out.print, System.err.print, java.lang.Throwable#printStackTrace] type: [dynamic, hooks] -weakness: MASWE-0001 +weakness: MASWE-0005 best-practices: [MASTG-BEST-0002] profiles: [L1, L2, P] knowledge: [MASTG-KNOW-0049] diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0207.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0207.md index face731f209..fd5c9810f59 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0207.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0207.md @@ -5,7 +5,7 @@ id: MASTG-TEST-0207 type: [dynamic, filesystem] prerequisites: - identify-sensitive-data -weakness: MASWE-0003 +weakness: MASWE-0001 profiles: [L2] best-practices: [MASTG-BEST-0050] knowledge: [MASTG-KNOW-0041] diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0216.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0216.md index 4d8a5c13015..2baccf49d31 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0216.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0216.md @@ -3,7 +3,7 @@ platform: android title: Sensitive Data Not Excluded From Backup id: MASTG-TEST-0216 type: [dynamic, filesystem] -weakness: MASWE-0002 +weakness: MASWE-0006 best-practices: [MASTG-BEST-0004] profiles: [L1, L2, P] knowledge: [MASTG-KNOW-0050] diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0231.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0231.md index eb469c93c0a..777ed756ce4 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0231.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0231.md @@ -4,7 +4,7 @@ title: References to Logging APIs id: MASTG-TEST-0231 apis: [Log, Logger, System.out.print, System.err.print, java.lang.Throwable#printStackTrace, android.util.Log] type: [static, code] -weakness: MASWE-0001 +weakness: MASWE-0005 best-practices: [MASTG-BEST-0002] profiles: [L1, L2, P] knowledge: [MASTG-KNOW-0049] diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0262.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0262.md index 7fe2e182ab1..f5bdc3c0c16 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0262.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0262.md @@ -3,7 +3,7 @@ platform: android title: References to Backup Configurations Not Excluding Sensitive Data id: MASTG-TEST-0262 type: [static, code] -weakness: MASWE-0002 +weakness: MASWE-0006 best-practices: [MASTG-BEST-0004] profiles: [L1, L2, P] knowledge: [MASTG-KNOW-0050] diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0287.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0287.md index 9a32f23ae09..508bfe110ba 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0287.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0287.md @@ -3,7 +3,7 @@ title: Runtime Storage of Unencrypted Data via the SharedPreferences API platform: android id: MASTG-TEST-0287 type: [dynamic, hooks, manual] -weakness: MASWE-0003 +weakness: MASWE-0001 best-practices: [MASTG-BEST-0050] profiles: [L1, L2] prerequisites: diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0304.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0304.md index 85e13ea5c0e..a02e5d5ec30 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0304.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0304.md @@ -3,7 +3,7 @@ title: References to Sensitive Data Unencrypted via Android Room Database platform: android id: MASTG-TEST-0304 type: [static, code] -weakness: MASWE-0003 +weakness: MASWE-0001 best-practices: [] profiles: [L1, L2] knowledge: [MASTG-KNOW-0037] diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0305.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0305.md index 4fdc72a97ae..09dedefa937 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0305.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0305.md @@ -3,7 +3,7 @@ title: Sensitive Data Stored Unencrypted via DataStore platform: android id: MASTG-TEST-0305 type: [static, dynamic] -weakness: MASWE-0003 +weakness: MASWE-0001 best-practices: [] profiles: [L1, L2] status: placeholder diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0306.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0306.md index a18f57ae150..d02afed5425 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0306.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0306.md @@ -3,7 +3,7 @@ title: References to Sensitive Data Stored Unencrypted via Android Room DB platform: android id: MASTG-TEST-0306 type: [static, code] -weakness: MASWE-0003 +weakness: MASWE-0001 best-practices: [] profiles: [L1, L2] status: placeholder diff --git a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0266.md b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0266.md index f3cbfee8ba2..f7b3620a04e 100644 --- a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0266.md +++ b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0266.md @@ -4,7 +4,7 @@ title: References to APIs for Event-Bound Biometric Authentication id: MASTG-TEST-0266 apis: [LAContext.evaluatePolicy] type: [static, code] -weakness: MASWE-0021 +weakness: MASWE-0020 profiles: [L2] knowledge: [MASTG-KNOW-0056, MASTG-KNOW-0057] --- diff --git a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0267.md b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0267.md index e7df753d8a4..e434e79dce4 100644 --- a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0267.md +++ b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0267.md @@ -4,7 +4,7 @@ title: Runtime Use Of Event-Bound Biometric Authentication id: MASTG-TEST-0267 apis: [LAContext.evaluatePolicy] type: [dynamic, hooks] -weakness: MASWE-0021 +weakness: MASWE-0020 best-practices: [] profiles: [L2] knowledge: [MASTG-KNOW-0056] diff --git a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0268.md b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0268.md index 7f392f0a3fe..9d1ad575ae9 100644 --- a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0268.md +++ b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0268.md @@ -4,7 +4,7 @@ title: References to APIs Allowing Fallback to Non-Biometric Authentication id: MASTG-TEST-0268 apis: [kSecAccessControlUserPresence, kSecAccessControlDevicePasscode, SecAccessControlCreateWithFlags] type: [static, code] -weakness: MASWE-0022 +weakness: MASWE-0021 profiles: [L2] knowledge: [MASTG-KNOW-0056] --- diff --git a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0269.md b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0269.md index 8c718d9e399..8f89ce0cb01 100644 --- a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0269.md +++ b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0269.md @@ -4,7 +4,7 @@ title: Runtime Use Of APIs Allowing Fallback to Non-Biometric Authentication id: MASTG-TEST-0269 apis: [kSecAccessControlUserPresence, kSecAccessControlDevicePasscode, SecAccessControlCreateWithFlags] type: [dynamic, hooks] -weakness: MASWE-0022 +weakness: MASWE-0021 profiles: [L2] knowledge: [MASTG-KNOW-0056] --- diff --git a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0270.md b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0270.md index bda09c84f6f..b2e1a513e6d 100644 --- a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0270.md +++ b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0270.md @@ -4,7 +4,7 @@ title: References to APIs Detecting Biometric Enrollment Changes id: MASTG-TEST-0270 apis: [kSecAccessControlBiometryCurrentSet,SecAccessControlCreateWithFlags] type: [static, code] -weakness: MASWE-0023 +weakness: MASWE-0022 profiles: [L2] knowledge: [MASTG-KNOW-0056] --- diff --git a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0271.md b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0271.md index a8197caabd7..b104e394e1d 100644 --- a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0271.md +++ b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0271.md @@ -4,7 +4,7 @@ title: Runtime Use Of APIs Detecting Biometric Enrollment Changes id: MASTG-TEST-0271 apis: [kSecAccessControlBiometryCurrentSet,SecAccessControlCreateWithFlags] type: [dynamic, hooks] -weakness: MASWE-0023 +weakness: MASWE-0022 profiles: [L2] knowledge: [MASTG-KNOW-0056] --- diff --git a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0273.md b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0273.md index a2d90b55b68..8b06b1a469d 100644 --- a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0273.md +++ b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0273.md @@ -3,7 +3,7 @@ platform: ios title: Identify Dependencies with Known Vulnerabilities by Scanning Dependency Managers Artifacts id: MASTG-TEST-0273 type: [static, code] -weakness: MASWE-0041 +weakness: MASWE-0044 profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0275.md b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0275.md index 9ea7c87734b..86ca73ab87b 100644 --- a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0275.md +++ b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0275.md @@ -3,7 +3,7 @@ platform: ios title: Dependencies with Known Vulnerabilities in the App's SBOM id: MASTG-TEST-0275 type: [static, developer] -weakness: MASWE-0041 +weakness: MASWE-0044 profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0383.md b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0383.md index b4b0ecbbb39..8217a33b1be 100644 --- a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0383.md +++ b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0383.md @@ -3,7 +3,7 @@ platform: ios title: References to Enforced Updating APIs id: MASTG-TEST-0383 type: [static, code, manual] -weakness: MASWE-0040 +weakness: MASWE-0043 profiles: [L2] knowledge: [MASTG-KNOW-0074] --- diff --git a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0384.md b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0384.md index 0905b9abe1f..9f527e63629 100644 --- a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0384.md +++ b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0384.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Use of Enforced Updating APIs id: MASTG-TEST-0384 type: [dynamic, network, hooks, manual] -weakness: MASWE-0040 +weakness: MASWE-0043 profiles: [L2] knowledge: [MASTG-KNOW-0074] --- diff --git a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0386.md b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0386.md index 0c281177b3e..c79b368b9af 100644 --- a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0386.md +++ b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0386.md @@ -3,7 +3,7 @@ title: References to Object Deserialization of Untrusted Data platform: ios id: MASTG-TEST-0386 type: [static, code, manual] -weakness: MASWE-0048 +weakness: MASWE-0051 profiles: [L1, L2] knowledge: [MASTG-KNOW-0075] best-practices: [MASTG-BEST-0064] diff --git a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0209.md b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0209.md index 1cbf4ceef4c..e580655d10c 100644 --- a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0209.md +++ b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0209.md @@ -3,7 +3,7 @@ platform: ios title: Insufficient Key Sizes id: MASTG-TEST-0209 type: [static, code] -weakness: MASWE-0007 +weakness: MASWE-0013 profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0210.md b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0210.md index 0435dcb400c..6b67a82eff5 100644 --- a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0210.md +++ b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0210.md @@ -3,7 +3,7 @@ platform: ios title: Broken Symmetric Encryption Algorithms id: MASTG-TEST-0210 type: [static, code, manual] -weakness: MASWE-0011 +weakness: MASWE-0007 profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0211.md b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0211.md index 423ff8e1b67..7ae007ab586 100644 --- a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0211.md +++ b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0211.md @@ -3,7 +3,7 @@ platform: ios title: Broken Hashing Algorithms id: MASTG-TEST-0211 type: [static, code, manual] -weakness: MASWE-0012 +weakness: MASWE-0008 profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0213.md b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0213.md index 403616c7918..d4180368930 100644 --- a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0213.md +++ b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0213.md @@ -3,7 +3,7 @@ title: Use of Hardcoded Cryptographic Keys in Code platform: ios id: MASTG-TEST-0213 type: [static, code, manual] -weakness: MASWE-0005 +weakness: MASWE-0003 profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0214.md b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0214.md index b287a26ac01..5831bc0c314 100644 --- a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0214.md +++ b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0214.md @@ -3,7 +3,7 @@ title: Hardcoded Cryptographic Keys in Files platform: ios id: MASTG-TEST-0214 type: [static, code, manual] -weakness: MASWE-0005 +weakness: MASWE-0003 profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0311.md b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0311.md index 99788d53206..3cfc66abfb6 100644 --- a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0311.md +++ b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0311.md @@ -3,7 +3,7 @@ platform: ios title: Insecure Random API Usage id: MASTG-TEST-0311 type: [static, code, manual] -weakness: MASWE-0016 +weakness: MASWE-0012 profiles: [L1, L2] best-practices: [MASTG-BEST-0025] knowledge: [MASTG-KNOW-0070] diff --git a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0317.md b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0317.md index cdf5684af98..753a068fc98 100644 --- a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0317.md +++ b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0317.md @@ -3,7 +3,7 @@ title: Broken Symmetric Encryption Modes platform: ios id: MASTG-TEST-0317 type: [static, code, manual] -weakness: MASWE-0011 +weakness: MASWE-0007 best-practices: [MASTG-BEST-0005] profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0349.md b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0349.md index a8080b2f329..c3291202422 100644 --- a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0349.md +++ b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0349.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Use of Insecure Random APIs id: MASTG-TEST-0349 type: [dynamic, hooks, manual] -weakness: MASWE-0016 +weakness: MASWE-0012 profiles: [L1, L2] best-practices: [MASTG-BEST-0025] knowledge: [MASTG-KNOW-0070] diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0321.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0321.md index e196e5d9b5c..6d53c614985 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0321.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0321.md @@ -3,7 +3,7 @@ platform: ios title: Hardcoded HTTP URLs id: MASTG-TEST-0321 type: [static, code] -weakness: MASWE-0025 +weakness: MASWE-0026 profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0322.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0322.md index de0d105e9bb..1656d09bf05 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0322.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0322.md @@ -3,7 +3,7 @@ platform: ios title: App Transport Security Configurations Allowing Cleartext Traffic id: MASTG-TEST-0322 type: [static, code, manual] -weakness: MASWE-0025 +weakness: MASWE-0026 profiles: [L1, L2] knowledge: [MASTG-KNOW-0071] --- diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0323.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0323.md index 597255ffeee..88811686c64 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0323.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0323.md @@ -3,7 +3,7 @@ platform: ios title: Uses of Low-Level Networking APIs for Cleartext Traffic id: MASTG-TEST-0323 type: [static, code, manual] -weakness: MASWE-0025 +weakness: MASWE-0026 profiles: [L1, L2] knowledge: [MASTG-KNOW-0073] --- diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0342.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0342.md index 24a0fe73010..a2991ee60b7 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0342.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0342.md @@ -3,7 +3,7 @@ platform: ios title: References to Weak ATS TLS Policy Exceptions in Info.plist id: MASTG-TEST-0342 type: [static, code] -weakness: MASWE-0025 +weakness: MASWE-0026 profiles: [L1, L2] best-practices: [MASTG-BEST-0042] knowledge: [MASTG-KNOW-0071] diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0343.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0343.md index 104c0cfb23f..c9c95fbe4c8 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0343.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0343.md @@ -3,7 +3,7 @@ platform: ios title: URLSession TLS Protocol Configuration id: MASTG-TEST-0343 type: [static, code, manual] -weakness: MASWE-0025 +weakness: MASWE-0026 profiles: [L1, L2] best-practices: [MASTG-BEST-0042] knowledge: [MASTG-KNOW-0071, MASTG-KNOW-0073] diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0344.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0344.md index ca0ea5987b2..104276da966 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0344.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0344.md @@ -3,7 +3,7 @@ platform: ios title: Network.framework TLS Protocol Configuration id: MASTG-TEST-0344 type: [static, code, manual] -weakness: MASWE-0025 +weakness: MASWE-0026 profiles: [L1, L2] best-practices: [MASTG-BEST-0043] knowledge: [MASTG-KNOW-0073] diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0345.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0345.md index 377beee5d05..3291f828bd9 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0345.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0345.md @@ -3,7 +3,7 @@ platform: ios title: Embedded or Third-party TLS Stack Configuration id: MASTG-TEST-0345 type: [static, code, manual] -weakness: MASWE-0025 +weakness: MASWE-0026 profiles: [L1, L2] best-practices: [MASTG-BEST-0043] knowledge: [MASTG-KNOW-0073] diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0348.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0348.md index 1f0d87bd4c8..5ec4771709a 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0348.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0348.md @@ -3,7 +3,7 @@ title: Insecure TLS Protocols in Network Traffic platform: ios id: MASTG-TEST-0348 type: [dynamic, network] -weakness: MASWE-0025 +weakness: MASWE-0026 profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0385.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0385.md index 5e3fef4fbb7..a1b4a005f8a 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0385.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0385.md @@ -3,7 +3,7 @@ platform: ios title: Missing Certificate Pinning in ATS id: MASTG-TEST-0385 type: [static] -weakness: MASWE-0027 +weakness: MASWE-0028 profiles: [L2] prerequisites: - identify-first-party-domains diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0396.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0396.md index 6625b1ac59b..81854ce47bc 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0396.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0396.md @@ -3,7 +3,7 @@ title: References to URLSessionDelegate Bypassing Certificate Validation platform: ios id: MASTG-TEST-0396 type: [static, code, manual] -weakness: MASWE-0026 +weakness: MASWE-0027 best-practices: [MASTG-BEST-0073] profiles: [L1, L2] knowledge: [MASTG-KNOW-0072] diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0397.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0397.md index 2eaf6e643fd..2ceaddc0477 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0397.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0397.md @@ -3,7 +3,7 @@ title: References to WKNavigationDelegate Bypassing Certificate Validation platform: ios id: MASTG-TEST-0397 type: [static, code, manual] -weakness: MASWE-0026 +weakness: MASWE-0027 best-practices: [MASTG-BEST-0073] profiles: [L1, L2] knowledge: [MASTG-KNOW-0072] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0276.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0276.md index a063ea44553..62b06ceac82 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0276.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0276.md @@ -3,7 +3,7 @@ platform: ios title: Use of the iOS General Pasteboard id: MASTG-TEST-0276 type: [static, code, manual] -weakness: MASWE-0028 +weakness: MASWE-0036 threat: [app] prerequisites: - identify-sensitive-data diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0277.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0277.md index 4840cbd232c..650f4557c1e 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0277.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0277.md @@ -3,7 +3,7 @@ platform: ios title: Sensitive Data in the iOS General Pasteboard at Runtime id: MASTG-TEST-0277 type: [dynamic, hooks] -weakness: MASWE-0028 +weakness: MASWE-0036 threat: [app] prerequisites: - identify-sensitive-data diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0278.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0278.md index 9ca2eec6e9d..00828380659 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0278.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0278.md @@ -3,7 +3,7 @@ platform: ios title: Pasteboard Contents Not Cleared After Use id: MASTG-TEST-0278 type: [static, code] -weakness: MASWE-0028 +weakness: MASWE-0036 threat: [app] profiles: [L2] knowledge: [MASTG-KNOW-0083] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0279.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0279.md index 497a6241949..2193aac7aea 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0279.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0279.md @@ -3,7 +3,7 @@ platform: ios title: Pasteboard Contents Not Expiring id: MASTG-TEST-0279 type: [static, code] -weakness: MASWE-0028 +weakness: MASWE-0036 threat: [app] profiles: [L2] knowledge: [MASTG-KNOW-0083] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0280.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0280.md index 4506a44916c..66705b3a075 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0280.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0280.md @@ -3,7 +3,7 @@ platform: ios title: Pasteboard Contents Not Restricted to Local Device id: MASTG-TEST-0280 type: [static, code] -weakness: MASWE-0028 +weakness: MASWE-0036 threat: [app] profiles: [L2] knowledge: [MASTG-KNOW-0083] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0290.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0290.md index 2c2092f253b..46b05a3cfb4 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0290.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0290.md @@ -4,7 +4,7 @@ platform: ios id: MASTG-TEST-0290 type: [dynamic, filesystem] profiles: [L2] -weakness: MASWE-0030 +weakness: MASWE-0038 prerequisites: - identify-sensitive-screens knowledge: [MASTG-KNOW-0099] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0331.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0331.md index 929a0658ae7..4b57f9f9958 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0331.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0331.md @@ -5,7 +5,7 @@ id: MASTG-TEST-0331 type: [static, code] available_since: 2.0 deprecated_since: 12.0 -weakness: MASWE-0038 +weakness: MASWE-0035 profiles: [L1, L2] best-practices: [MASTG-BEST-0032] knowledge: [MASTG-KNOW-0076] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0332.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0332.md index b1e01e24b85..b517f2eb59d 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0332.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0332.md @@ -3,7 +3,7 @@ platform: ios title: Attacker-Controlled URI in WebViews id: MASTG-TEST-0332 type: [static, code, manual] -weakness: MASWE-0038 +weakness: MASWE-0035 best-practices: [MASTG-BEST-0034] profiles: [L1, L2, P] knowledge: [MASTG-KNOW-0076] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0333.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0333.md index 42668cff6ad..cc8810e1f9d 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0333.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0333.md @@ -3,7 +3,7 @@ platform: ios title: Overly Broad File Read Access in WebViews id: MASTG-TEST-0333 type: [static, code, manual] -weakness: MASWE-0037 +weakness: MASWE-0034 best-practices: [MASTG-BEST-0033] knowledge: [MASTG-KNOW-0076] profiles: [L1, L2] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0335.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0335.md index 3045c08d545..d74ed20146b 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0335.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0335.md @@ -3,7 +3,7 @@ platform: ios title: WebView File Origin Access Relaxed by Configuration id: MASTG-TEST-0335 type: [static, code, manual] -weakness: MASWE-0037 +weakness: MASWE-0034 best-practices: [MASTG-BEST-0033] profiles: [L1, L2] knowledge: [MASTG-KNOW-0076] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0336.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0336.md index 229ff798397..0efa25f3fd3 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0336.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0336.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Setting of Relaxed WebView File Origin Policies id: MASTG-TEST-0336 type: [dynamic, hooks, manual] -weakness: MASWE-0037 +weakness: MASWE-0034 best-practices: [MASTG-BEST-0033] profiles: [L1, L2] knowledge: [MASTG-KNOW-0076] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0346.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0346.md index 6865f71b0c0..97d8d07a3d5 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0346.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0346.md @@ -3,7 +3,7 @@ platform: ios title: References to APIs Hiding Sensitive Data in Text Input Fields id: MASTG-TEST-0346 type: [static, code, manual] -weakness: MASWE-0028 +weakness: MASWE-0036 profiles: [L2] best-practices: [MASTG-BEST-0044] knowledge: [MASTG-KNOW-0121, MASTG-KNOW-0141] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0347.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0347.md index 3feb238763b..a717f7e11a4 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0347.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0347.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Use of APIs Hiding Sensitive Data in Text Input Fields id: MASTG-TEST-0347 type: [dynamic, hooks] -weakness: MASWE-0028 +weakness: MASWE-0036 profiles: [L2] best-practices: [MASTG-BEST-0044] knowledge: [MASTG-KNOW-0121, MASTG-KNOW-0141] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0370.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0370.md index 31ab81b8931..2339cd92c82 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0370.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0370.md @@ -3,7 +3,7 @@ platform: ios title: Missing Input Validation in Custom URL Scheme Handlers id: MASTG-TEST-0370 type: [static, code] -weakness: MASWE-0032 +weakness: MASWE-0029 profiles: [L1, L2] best-practices: [MASTG-BEST-0045, MASTG-BEST-0054] knowledge: [MASTG-KNOW-0079] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0371.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0371.md index 10600cdb023..c5f8c5cdd3c 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0371.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0371.md @@ -3,7 +3,7 @@ platform: ios title: Missing Source Validation in Custom URL Scheme Handlers id: MASTG-TEST-0371 type: [static, code] -weakness: MASWE-0032 +weakness: MASWE-0029 profiles: [L1, L2] best-practices: [MASTG-BEST-0045, MASTG-BEST-0055] knowledge: [MASTG-KNOW-0079] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0376.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0376.md index e420c39292e..f4300212a36 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0376.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0376.md @@ -3,7 +3,7 @@ platform: ios title: References to Native Bridge APIs in WebViews id: MASTG-TEST-0376 type: [static, code] -weakness: MASWE-0037 +weakness: MASWE-0034 best-practices: [MASTG-BEST-0058] profiles: [L1, L2] knowledge: [MASTG-KNOW-0076] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0377.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0377.md index 3316561b94d..8048402bec3 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0377.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0377.md @@ -3,7 +3,7 @@ platform: ios title: References to `evaluateJavaScript` Used as Bridge Reply in `WKScriptMessageHandler` id: MASTG-TEST-0377 type: [static, code, manual] -weakness: MASWE-0037 +weakness: MASWE-0034 best-practices: [MASTG-BEST-0062] profiles: [L1, L2] knowledge: [MASTG-KNOW-0076, MASTG-KNOW-0139] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0378.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0378.md index 3ce29634c2c..7d9e7b1c1e0 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0378.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0378.md @@ -3,7 +3,7 @@ platform: ios title: References to Password Fields in WebView-Loaded HTML id: MASTG-TEST-0378 type: [static, code, manual] -weakness: MASWE-0037 +weakness: MASWE-0034 best-practices: [MASTG-BEST-0059, MASTG-BEST-0060] profiles: [L1, L2] knowledge: [MASTG-KNOW-0076, MASTG-KNOW-0139] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0379.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0379.md index 43abc9cb93a..b2ffe517e08 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0379.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0379.md @@ -3,7 +3,7 @@ platform: ios title: References to `evaluateJavaScript` Without Content World Isolation id: MASTG-TEST-0379 type: [static, code] -weakness: MASWE-0037 +weakness: MASWE-0034 best-practices: [MASTG-BEST-0061] profiles: [L1, L2] knowledge: [MASTG-KNOW-0076, MASTG-KNOW-0139] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0380.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0380.md index 2e8f467f267..60bca186fd3 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0380.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0380.md @@ -3,7 +3,7 @@ platform: ios title: References to `evaluateJavaScript` Writing Sensitive Data into WebView DOM id: MASTG-TEST-0380 type: [static, code, manual] -weakness: MASWE-0037 +weakness: MASWE-0034 best-practices: [MASTG-BEST-0059] profiles: [L1, L2] knowledge: [MASTG-KNOW-0076, MASTG-KNOW-0139] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0389.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0389.md index 785f5ef36f0..a8453a88375 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0389.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0389.md @@ -3,7 +3,7 @@ platform: ios title: References to the App-Wide Restriction of Custom Keyboards id: MASTG-TEST-0389 type: [static, code, manual] -weakness: MASWE-0034 +weakness: MASWE-0031 prerequisites: - identify-sensitive-data best-practices: [MASTG-BEST-0069] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0390.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0390.md index ec8e2e59905..f6077aec18b 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0390.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0390.md @@ -3,7 +3,7 @@ platform: ios title: Full Access Requested by a Custom Keyboard Extension id: MASTG-TEST-0390 type: [static, code, manual] -weakness: MASWE-0072 +weakness: MASWE-0067 prerequisites: - identify-sensitive-data best-practices: [MASTG-BEST-0069] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0395.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0395.md index 950e90f8bed..d230e1031e0 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0395.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0395.md @@ -3,7 +3,7 @@ platform: ios title: Missing Input Validation in Universal Link Handlers id: MASTG-TEST-0395 type: [static, code, manual] -weakness: MASWE-0032 +weakness: MASWE-0029 profiles: [L1, L2] best-practices: [MASTG-BEST-0072] knowledge: [MASTG-KNOW-0080] diff --git a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0281.md b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0281.md index ba56eef245e..2e9bb95eea5 100644 --- a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0281.md +++ b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0281.md @@ -3,7 +3,7 @@ platform: ios title: Undeclared Known Tracking Domains id: MASTG-TEST-0281 type: [static, dynamic] -weakness: MASWE-0073 +weakness: MASWE-0075 profiles: [P] --- diff --git a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0360.md b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0360.md index 17c19d7e43f..92a13596b32 100644 --- a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0360.md +++ b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0360.md @@ -3,7 +3,7 @@ title: Purpose String Accuracy for Reachable Protected Resource Access platform: ios id: MASTG-TEST-0360 type: [static, config, manual] -weakness: MASWE-0072 +weakness: MASWE-0067 profiles: [P] best-practices: [MASTG-BEST-0051] knowledge: [MASTG-KNOW-0077] diff --git a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0361.md b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0361.md index 536319fee4c..c7486a205e0 100644 --- a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0361.md +++ b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0361.md @@ -3,7 +3,7 @@ title: Runtime Use of Protected Resource APIs Without Accurate Purpose Strings platform: ios id: MASTG-TEST-0361 type: [dynamic, hooks, manual] -weakness: MASWE-0072 +weakness: MASWE-0067 profiles: [P] best-practices: [MASTG-BEST-0051] knowledge: [MASTG-KNOW-0077] diff --git a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0362.md b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0362.md index bb207761231..b45a62b7fa0 100644 --- a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0362.md +++ b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0362.md @@ -3,7 +3,7 @@ title: Entitlements for Unjustified Capability Exposure platform: ios id: MASTG-TEST-0362 type: [static, package, manual] -weakness: MASWE-0072 +weakness: MASWE-0067 profiles: [P] best-practices: [MASTG-BEST-0051] knowledge: [MASTG-KNOW-0077] diff --git a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0363.md b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0363.md index 6186b1f10f0..1b45304eaa8 100644 --- a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0363.md +++ b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0363.md @@ -3,7 +3,7 @@ title: Runtime Use of Entitlement-Backed APIs for Unjustified Capability Exposur platform: ios id: MASTG-TEST-0363 type: [dynamic, hooks, manual] -weakness: MASWE-0072 +weakness: MASWE-0067 profiles: [P] best-practices: [MASTG-BEST-0051] knowledge: [MASTG-KNOW-0077] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0219.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0219.md index a3c18a170da..0f281b237cd 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0219.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0219.md @@ -3,7 +3,7 @@ platform: ios title: Testing for Debugging Symbols id: MASTG-TEST-0219 type: [static, code] -weakness: MASWE-0054 +weakness: MASWE-0062 profiles: [R] knowledge: [MASTG-KNOW-0063] --- diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0220.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0220.md index 0190a67b430..e7d8157c5ad 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0220.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0220.md @@ -3,7 +3,7 @@ platform: ios title: Usage of Outdated Code Signature Format id: MASTG-TEST-0220 type: [static, code] -weakness: MASWE-0062 +weakness: MASWE-0057 profiles: [R] knowledge: [MASTG-KNOW-0058] --- diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0240.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0240.md index 576c91129b0..e2c03a71288 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0240.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0240.md @@ -3,7 +3,7 @@ platform: ios title: Jailbreak Detection in Code id: MASTG-TEST-0240 type: [static, code] -weakness: MASWE-0056 +weakness: MASWE-0052 false_negative_prone: true profiles: [R] knowledge: [MASTG-KNOW-0084] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0241.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0241.md index 019c4687b05..cedafbff1ec 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0241.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0241.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Use of Jailbreak Detection Techniques id: MASTG-TEST-0241 type: [dynamic, hooks] -weakness: MASWE-0056 +weakness: MASWE-0052 false_negative_prone: true profiles: [R] knowledge: [MASTG-KNOW-0084] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0246.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0246.md index d3ca376abd4..db764c98773 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0246.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0246.md @@ -4,7 +4,7 @@ title: Runtime Use of Secure Screen Lock Detection APIs id: MASTG-TEST-0246 apis: [LAContext.canEvaluatePolicy, kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly] type: [dynamic, hooks] -weakness: MASWE-0049 +weakness: MASWE-0017 best-practices: [] profiles: [L2] knowledge: [MASTG-KNOW-0056] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0248.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0248.md index 23bafea8a3a..a280b72d8e1 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0248.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0248.md @@ -4,7 +4,7 @@ title: References to APIs for Detecting Secure Screen Lock id: MASTG-TEST-0248 apis: [LAContext.canEvaluatePolicy, kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly] type: [static, code] -weakness: MASWE-0049 +weakness: MASWE-0017 best-practices: [] profiles: [L2] knowledge: [MASTG-KNOW-0056] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0261.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0261.md index b10fdec3874..6b2068610b8 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0261.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0261.md @@ -3,7 +3,7 @@ platform: ios title: Debuggable Entitlement Enabled in the entitlements.plist id: MASTG-TEST-0261 type: [static, code] -weakness: MASWE-0050 +weakness: MASWE-0064 profiles: [R] knowledge: [MASTG-KNOW-0062] --- diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0354.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0354.md index d9c0b6f5c4c..4033af49d87 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0354.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0354.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Use of Hook Detection Techniques id: MASTG-TEST-0354 type: [dynamic, hooks] -weakness: MASWE-0064 +weakness: MASWE-0059 profiles: [R] knowledge: [MASTG-KNOW-0087] best-practices: [MASTG-BEST-0048] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0358.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0358.md index 2b3aca9cd56..173bce4f850 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0358.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0358.md @@ -3,7 +3,7 @@ platform: ios title: Implementation Details Exposure Through Logging APIs id: MASTG-TEST-0358 type: [static, code] -weakness: MASWE-0054 +weakness: MASWE-0062 best-practices: [MASTG-BEST-0022] knowledge: [MASTG-KNOW-0064, MASTG-KNOW-0101] profiles: [R] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0359.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0359.md index ab8602515e1..45f174b518b 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0359.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0359.md @@ -3,7 +3,7 @@ platform: ios title: Implementation Details Exposure in Logs id: MASTG-TEST-0359 type: [dynamic, logs] -weakness: MASWE-0054 +weakness: MASWE-0062 best-practices: [MASTG-BEST-0022] knowledge: [MASTG-KNOW-0064, MASTG-KNOW-0101] profiles: [R] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0367.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0367.md index 3913667ce03..c8395d95615 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0367.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0367.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Use of Virtual Device Detection Techniques id: MASTG-TEST-0367 type: [dynamic] -weakness: MASWE-0058 +weakness: MASWE-0054 best-practices: [MASTG-BEST-0053] profiles: [R] knowledge: [MASTG-KNOW-0135] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0387.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0387.md index 5a67d786464..562f1b3bd1f 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0387.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0387.md @@ -4,7 +4,7 @@ title: References to Storage Integrity Check APIs id: MASTG-TEST-0387 apis: [HMAC, CCHmac, CCHmacFinal, CC_SHA256, CC_SHA512, SecKeyCreateSignature] type: [static, code, manual] -weakness: MASWE-0063 +weakness: MASWE-0058 false_negative_prone: true profiles: [R] knowledge: [MASTG-KNOW-0086] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0391.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0391.md index 5c1dabc1f0e..374f4c095a3 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0391.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0391.md @@ -3,7 +3,7 @@ platform: ios title: Insufficient Obfuscation of Security-Relevant Native Code id: MASTG-TEST-0391 type: [static, package, manual] -weakness: MASWE-0051 +weakness: MASWE-0060 best-practices: [MASTG-BEST-0029] profiles: [R] knowledge: [MASTG-KNOW-0089] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0401.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0401.md index c8e14801f4c..75780eb473b 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0401.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0401.md @@ -4,7 +4,7 @@ title: References to Debugging Detection APIs id: MASTG-TEST-0401 apis: [ptrace, PT_DENY_ATTACH, sysctl, KERN_PROC_PID, P_TRACED, getppid, task_get_exception_ports, EXC_MASK_BREAKPOINT] type: [static, code, manual] -weakness: MASWE-0060 +weakness: MASWE-0065 best-practices: [MASTG-BEST-0029, MASTG-BEST-0074] profiles: [R] knowledge: [MASTG-KNOW-0085] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0402.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0402.md index d20af155548..785c219d1e3 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0402.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0402.md @@ -4,7 +4,7 @@ title: Runtime Use of Debugging Detection APIs id: MASTG-TEST-0402 apis: [ptrace, PT_DENY_ATTACH, sysctl, KERN_PROC_PID, P_TRACED, getppid, task_get_exception_ports, EXC_MASK_BREAKPOINT] type: [dynamic, hooks, manual] -weakness: MASWE-0060 +weakness: MASWE-0065 best-practices: [MASTG-BEST-0029, MASTG-BEST-0074] profiles: [R] knowledge: [MASTG-KNOW-0085] diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0215.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0215.md index 730f7943a8b..dd3d3468b85 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0215.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0215.md @@ -3,7 +3,7 @@ platform: ios title: Sensitive Data Not Marked For Backup Exclusion id: MASTG-TEST-0215 type: [static, code] -weakness: MASWE-0002 +weakness: MASWE-0006 best-practices: [MASTG-BEST-0023] profiles: [L1, L2, P] knowledge: [MASTG-KNOW-0102] diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0296.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0296.md index 01b5ec27abb..b119bad2c9f 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0296.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0296.md @@ -3,7 +3,7 @@ platform: ios title: Sensitive Data Exposure in Logs id: MASTG-TEST-0296 type: [dynamic, logs] -weakness: MASWE-0001 +weakness: MASWE-0005 prerequisites: - identify-sensitive-data best-practices: [MASTG-BEST-0022] diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0297.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0297.md index e583a714f62..70590eb0ccd 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0297.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0297.md @@ -3,7 +3,7 @@ platform: ios title: Sensitive Data Exposure Through Logging APIs id: MASTG-TEST-0297 type: [static, code] -weakness: MASWE-0001 +weakness: MASWE-0005 prerequisites: - identify-sensitive-data best-practices: [MASTG-BEST-0022] diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0298.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0298.md index d6806e4cf6f..8185b892e24 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0298.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0298.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Monitoring of Files Eligible for Backup id: MASTG-TEST-0298 type: [dynamic, hooks] -weakness: MASWE-0002 +weakness: MASWE-0006 best-practices: [MASTG-BEST-0023] profiles: [L1, L2, P] knowledge: [MASTG-KNOW-0102] diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0299.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0299.md index 4a53f96a50a..7a88cd4bd29 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0299.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0299.md @@ -6,7 +6,7 @@ type: [dynamic, filesystem] prerequisites: - identify-sensitive-data profiles: [L1] -weakness: MASWE-0003 +weakness: MASWE-0001 best-practices: [MASTG-BEST-0024] knowledge: [MASTG-KNOW-0082, MASTG-KNOW-0091, MASTG-KNOW-0108] --- diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0300.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0300.md index 2fcfbd1fa95..4129dc4f510 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0300.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0300.md @@ -5,7 +5,7 @@ id: MASTG-TEST-0300 type: [static, code] profiles: [L2] best-practices: [MASTG-BEST-0024] -weakness: MASWE-0003 +weakness: MASWE-0001 knowledge: [MASTG-KNOW-0091, MASTG-KNOW-0057, MASTG-KNOW-0108] --- diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0301.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0301.md index 8350627adc4..7f24967f0ff 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0301.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0301.md @@ -4,7 +4,7 @@ title: Runtime Use of APIs for Storing Unencrypted Data in Private Storage id: MASTG-TEST-0301 type: [dynamic, hooks] profiles: [L2] -weakness: MASWE-0003 +weakness: MASWE-0001 best-practices: [MASTG-BEST-0024] knowledge: [MASTG-KNOW-0091, MASTG-KNOW-0057, MASTG-KNOW-0108] --- diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0302.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0302.md index d739bc29adc..2fe5d691c8e 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0302.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0302.md @@ -6,7 +6,7 @@ type: [dynamic, filesystem] prerequisites: - identify-sensitive-data profiles: [L2] -weakness: MASWE-0003 +weakness: MASWE-0001 best-practices: [MASTG-BEST-0024] knowledge: [MASTG-KNOW-0108] --- diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0303.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0303.md index fa842e5a776..3c536548b61 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0303.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0303.md @@ -5,7 +5,7 @@ id: MASTG-TEST-0303 type: [static, code] profiles: [L1, L2] best-practices: [MASTG-BEST-0024] -weakness: MASWE-0004 +weakness: MASWE-0002 knowledge: [MASTG-KNOW-0122, MASTG-KNOW-0091, MASTG-KNOW-0057, MASTG-KNOW-0108] --- diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0313.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0313.md index f012c5f707b..71bc21fd357 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0313.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0313.md @@ -3,7 +3,7 @@ platform: ios title: References to APIs for Preventing Keyboard Caching of Text Fields id: MASTG-TEST-0313 type: [static, code, manual] -weakness: MASWE-0028 +weakness: MASWE-0036 profiles: [L2] best-practices: [MASTG-BEST-0026] knowledge: [MASTG-KNOW-0100] diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0314.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0314.md index fcaabed60a9..6d584e73c2f 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0314.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0314.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Monitoring of Text Fields Eligible for Keyboard Caching id: MASTG-TEST-0314 type: [dynamic, hooks] -weakness: MASWE-0028 +weakness: MASWE-0036 profiles: [L2] prerequisites: - identify-sensitive-data diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0388.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0388.md index ed644d12192..9b3ab0ada71 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0388.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0388.md @@ -3,7 +3,7 @@ platform: ios title: References to Sensitive Data Stored Unprotected in Shared App Group Containers id: MASTG-TEST-0388 type: [static, code, manual] -weakness: MASWE-0003 +weakness: MASWE-0001 prerequisites: - identify-sensitive-data best-practices: [MASTG-BEST-0068] From 63df10cd36d9bf511cf33d9a82da707cf347cc86 Mon Sep 17 00:00:00 2001 From: Carlos Holguera Date: Mon, 3 Aug 2026 12:22:03 +0200 Subject: [PATCH 5/5] re-update MASWE IDs for MASWE v1.0.0 rc after enforcing consecutive IDs --- best-practices/MASTG-BEST-0007.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0337.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0339.md | 2 +- tests-beta/android/MASVS-CODE/MASTG-TEST-0375.md | 2 +- tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0206.md | 2 +- tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0254.md | 2 +- tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0255.md | 2 +- tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0256.md | 2 +- tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0257.md | 2 +- tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0318.md | 2 +- tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0319.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0224.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0225.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0226.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0227.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0263.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0264.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0265.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0288.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0324.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0325.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0338.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0341.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0351.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0352.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0353.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0368.md | 2 +- tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0369.md | 2 +- tests-beta/ios/MASVS-CODE/MASTG-TEST-0386.md | 2 +- tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0390.md | 2 +- tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0281.md | 2 +- tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0360.md | 2 +- tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0361.md | 2 +- tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0362.md | 2 +- tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0363.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0219.md | 4 ++-- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0220.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0240.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0241.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0261.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0354.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0358.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0359.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0367.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0387.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0391.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0401.md | 2 +- tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0402.md | 2 +- 48 files changed, 49 insertions(+), 49 deletions(-) diff --git a/best-practices/MASTG-BEST-0007.md b/best-practices/MASTG-BEST-0007.md index 8ab302965a5..78ef1992b97 100644 --- a/best-practices/MASTG-BEST-0007.md +++ b/best-practices/MASTG-BEST-0007.md @@ -8,4 +8,4 @@ knowledge: [MASTG-KNOW-0007] Ensure the debuggable flag in the AndroidManifest.xml is set to `false` for all release builds. -**Note:** Disabling debugging via the `debuggable` flag is an important first step but does not fully protect the app from advanced attacks. Skilled attackers can enable debugging through various means, such as binary patching (see @MASTG-TECH-0038) to allow attachment of a debugger or the use of binary instrumentation tools like @MASTG-TOOL-0001 to achieve similar capabilities. For apps requiring a higher level of security, consider implementing anti-debugging techniques as an additional layer of defense. Refer to @MASWE-0065 for detailed guidance. +**Note:** Disabling debugging via the `debuggable` flag is an important first step but does not fully protect the app from advanced attacks. Skilled attackers can enable debugging through various means, such as binary patching (see @MASTG-TECH-0038) to allow attachment of a debugger or the use of binary instrumentation tools like @MASTG-TOOL-0001 to achieve similar capabilities. For apps requiring a higher level of security, consider implementing anti-debugging techniques as an additional layer of defense. Refer to @MASWE-0064 for detailed guidance. diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0337.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0337.md index 8969fc8630f..a520322b099 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0337.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0337.md @@ -3,7 +3,7 @@ title: References to Object Deserialization of Untrusted Data platform: android id: MASTG-TEST-0337 type: [static, code] -weakness: MASWE-0051 +weakness: MASWE-0050 profiles: [L1, L2] knowledge: [MASTG-KNOW-0021] --- diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0339.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0339.md index d60bf4631d0..c6dd7bfd98b 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0339.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0339.md @@ -3,7 +3,7 @@ title: SQL Injection in Content Providers platform: android id: MASTG-TEST-0339 type: [static, code] -weakness: MASWE-0051 +weakness: MASWE-0050 best-practices: [MASTG-BEST-0039] profiles: [L1, L2] knowledge: [MASTG-KNOW-0117] diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0375.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0375.md index c5fb32b1a2b..62cd2eb8489 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0375.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0375.md @@ -3,7 +3,7 @@ title: Missing Validation of Data Returned from Implicit Intents platform: android id: MASTG-TEST-0375 type: [dynamic, hooks, manual] -weakness: MASWE-0051 +weakness: MASWE-0050 best-practices: [MASTG-BEST-0057] knowledge: [MASTG-KNOW-0025, MASTG-KNOW-0138] profiles: [L1, L2] diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0206.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0206.md index 67818fdd045..66e172df37d 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0206.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0206.md @@ -3,7 +3,7 @@ platform: android title: Undeclared PII in Network Traffic Capture id: MASTG-TEST-0206 type: [dynamic, network] -weakness: MASWE-0074 +weakness: MASWE-0073 prerequisites: - identify-sensitive-data - privacy-policy diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0254.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0254.md index bbbd98886ef..c443f431cdc 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0254.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0254.md @@ -3,7 +3,7 @@ title: Dangerous App Permissions platform: android id: MASTG-TEST-0254 type: [static, code] -weakness: MASWE-0067 +weakness: MASWE-0066 profiles: [P] knowledge: [MASTG-KNOW-0017] --- diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0255.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0255.md index a1b301f5ddf..38b77738291 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0255.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0255.md @@ -2,7 +2,7 @@ platform: android title: Permission Requests Not Minimized id: MASTG-TEST-0255 -weakness: MASWE-0067 +weakness: MASWE-0066 status: placeholder note: This test checks if the app requests permissions that have privacy-preserving alternatives. profiles: [P] diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0256.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0256.md index 659a0255c4d..e44fca7d88c 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0256.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0256.md @@ -2,7 +2,7 @@ platform: android title: Missing Permission Rationale id: MASTG-TEST-0256 -weakness: MASWE-0067 +weakness: MASWE-0066 status: placeholder note: This test checks if the app does not provide a rationale for requesting permissions. See https://developer.android.com/training/permissions/requesting#explain and https://developer.android.com/training/permissions/explaining-access#privacy-dashboard-show-rationale profiles: [P] diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0257.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0257.md index 398151d5ffd..cca29a5ecfa 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0257.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0257.md @@ -2,7 +2,7 @@ platform: android title: Not Resetting Unused Permissions id: MASTG-TEST-0257 -weakness: MASWE-0067 +weakness: MASWE-0066 status: placeholder note: This test checks if the app does not remove unnecessary access to granted permissions. See https://developer.android.com/training/permissions/requesting#remove-access profiles: [P] diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0318.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0318.md index a508345fea5..a28ace42d7d 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0318.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0318.md @@ -3,7 +3,7 @@ platform: android title: References to SDK APIs Known to Handle Sensitive User Data id: MASTG-TEST-0318 type: [static, code] -weakness: MASWE-0074 +weakness: MASWE-0073 profiles: [P] --- diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0319.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0319.md index 5227c020f83..705d9de1233 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0319.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0319.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of SDK APIs Known to Handle Sensitive User Data id: MASTG-TEST-0319 type: [dynamic, hooks] -weakness: MASWE-0074 +weakness: MASWE-0073 prerequisites: - identify-sensitive-data profiles: [P] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0224.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0224.md index 144ae530c84..071f2a073ea 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0224.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0224.md @@ -4,7 +4,7 @@ platform: android id: MASTG-TEST-0224 type: [static, code] available_since: 24 -weakness: MASWE-0057 +weakness: MASWE-0056 best-practices: [MASTG-BEST-0006] profiles: [R] knowledge: [MASTG-KNOW-0003] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0225.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0225.md index 02da5204400..0e7a334b546 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0225.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0225.md @@ -3,7 +3,7 @@ title: Usage of Insecure APK Signature Key Size platform: android id: MASTG-TEST-0225 type: [static, code] -weakness: MASWE-0057 +weakness: MASWE-0056 profiles: [R] knowledge: [MASTG-KNOW-0003] --- diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0226.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0226.md index 679483c0f00..05e7ffe05d9 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0226.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0226.md @@ -3,7 +3,7 @@ title: Debuggable Flag Enabled in the AndroidManifest platform: android id: MASTG-TEST-0226 type: [static, code] -weakness: MASWE-0064 +weakness: MASWE-0063 best-practices: [MASTG-BEST-0007] profiles: [R] knowledge: [MASTG-KNOW-0007] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0227.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0227.md index 7e0ef567cc5..111e33ebc5c 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0227.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0227.md @@ -3,7 +3,7 @@ title: Debugging Enabled for WebViews platform: android id: MASTG-TEST-0227 type: [static, code] -weakness: MASWE-0064 +weakness: MASWE-0063 best-practices: [MASTG-BEST-0008] profiles: [R] knowledge: [MASTG-KNOW-0028] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0263.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0263.md index dcffd702dbc..364fd9f58f7 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0263.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0263.md @@ -4,7 +4,7 @@ title: Logging of StrictMode Violations id: MASTG-TEST-0263 apis: [StrictMode] type: [dynamic, logs] -weakness: MASWE-0062 +weakness: MASWE-0061 profiles: [R] --- diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0264.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0264.md index 846b049e63a..6a884274405 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0264.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0264.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of StrictMode APIs id: MASTG-TEST-0264 type: [dynamic, hooks] -weakness: MASWE-0062 +weakness: MASWE-0061 best-practices: [] profiles: [R] --- diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0265.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0265.md index c992f26d931..6e3055806e4 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0265.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0265.md @@ -3,7 +3,7 @@ platform: android title: References to StrictMode APIs id: MASTG-TEST-0265 type: [static, code] -weakness: MASWE-0062 +weakness: MASWE-0061 best-practices: [] profiles: [R] --- diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0288.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0288.md index e80954a16d7..0cb364f2cff 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0288.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0288.md @@ -4,7 +4,7 @@ title: Debugging Symbols in Native Binaries alias: debugging-symbols-in-native-binaries id: MASTG-TEST-0288 type: [static, code] -weakness: MASWE-0062 +weakness: MASWE-0061 best-practices: [] profiles: [R] --- diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0324.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0324.md index d9722d0d286..fbfd794fb1b 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0324.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0324.md @@ -3,7 +3,7 @@ platform: android title: References to Root Detection Mechanisms id: MASTG-TEST-0324 type: [static, code] -weakness: MASWE-0052 +weakness: MASWE-0051 best-practices: [MASTG-BEST-0029, MASTG-BEST-0030] profiles: [R] knowledge: [MASTG-KNOW-0027] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0325.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0325.md index f7586110312..5cc3c1008ec 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0325.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0325.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of Root Detection Techniques id: MASTG-TEST-0325 type: [dynamic, hooks] -weakness: MASWE-0052 +weakness: MASWE-0051 best-practices: [MASTG-BEST-0029, MASTG-BEST-0030] profiles: [R] knowledge: [MASTG-KNOW-0027] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0338.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0338.md index e0a8db1b6ff..106095d4b48 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0338.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0338.md @@ -4,7 +4,7 @@ platform: android id: MASTG-TEST-0338 apis: [javax.crypto.Mac, java.security.Signature, java.security.MessageDigest] type: [static, code, manual] -weakness: MASWE-0058 +weakness: MASWE-0057 false_negative_prone: true profiles: [R] knowledge: [MASTG-KNOW-0036] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0341.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0341.md index 65034884e04..ef366cdefbe 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0341.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0341.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of Hook Detection Techniques id: MASTG-TEST-0341 type: [dynamic, hooks] -weakness: MASWE-0059 +weakness: MASWE-0058 best-practices: [MASTG-BEST-0041] profiles: [R] knowledge: [MASTG-KNOW-0030, MASTG-KNOW-0032, MASTG-KNOW-0118] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0351.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0351.md index af8a335d173..2f8f1592fb8 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0351.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0351.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of Emulator Detection Techniques id: MASTG-TEST-0351 type: [dynamic, hooks] -weakness: MASWE-0054 +weakness: MASWE-0053 best-practices: [MASTG-BEST-0046] profiles: [R] knowledge: [MASTG-KNOW-0031] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0352.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0352.md index 718b562b980..67b5922dd17 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0352.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0352.md @@ -3,7 +3,7 @@ platform: android title: References to Debugging Detection APIs id: MASTG-TEST-0352 type: [static, code, manual] -weakness: MASWE-0065 +weakness: MASWE-0064 best-practices: [MASTG-BEST-0007, MASTG-BEST-0029, MASTG-BEST-0047] profiles: [R] knowledge: [MASTG-KNOW-0007, MASTG-KNOW-0028] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0353.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0353.md index 5d5a7fdd551..4875743fd6c 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0353.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0353.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of Debugging Detection APIs id: MASTG-TEST-0353 type: [dynamic, hooks, manual] -weakness: MASWE-0065 +weakness: MASWE-0064 best-practices: [MASTG-BEST-0007, MASTG-BEST-0029, MASTG-BEST-0047] profiles: [R] knowledge: [MASTG-KNOW-0007, MASTG-KNOW-0028] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0368.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0368.md index efbdd9036cf..a13cd7e3eac 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0368.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0368.md @@ -3,7 +3,7 @@ platform: android title: Insufficient Obfuscation of Security-Relevant Java/Kotlin Code id: MASTG-TEST-0368 type: [static, code, manual] -weakness: MASWE-0060 +weakness: MASWE-0059 best-practices: [MASTG-BEST-0029] profiles: [R] knowledge: [MASTG-KNOW-0033] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0369.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0369.md index 13ee92f230a..72d3b08ee94 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0369.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0369.md @@ -3,7 +3,7 @@ platform: android title: Insufficient Obfuscation of Security-Relevant Native Code id: MASTG-TEST-0369 type: [static, package, manual] -weakness: MASWE-0060 +weakness: MASWE-0059 best-practices: [MASTG-BEST-0029] profiles: [R] knowledge: [MASTG-KNOW-0033] diff --git a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0386.md b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0386.md index c79b368b9af..4fbaee91b59 100644 --- a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0386.md +++ b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0386.md @@ -3,7 +3,7 @@ title: References to Object Deserialization of Untrusted Data platform: ios id: MASTG-TEST-0386 type: [static, code, manual] -weakness: MASWE-0051 +weakness: MASWE-0050 profiles: [L1, L2] knowledge: [MASTG-KNOW-0075] best-practices: [MASTG-BEST-0064] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0390.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0390.md index f6077aec18b..1800b7f1e61 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0390.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0390.md @@ -3,7 +3,7 @@ platform: ios title: Full Access Requested by a Custom Keyboard Extension id: MASTG-TEST-0390 type: [static, code, manual] -weakness: MASWE-0067 +weakness: MASWE-0066 prerequisites: - identify-sensitive-data best-practices: [MASTG-BEST-0069] diff --git a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0281.md b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0281.md index 2e9bb95eea5..075bca83af8 100644 --- a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0281.md +++ b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0281.md @@ -3,7 +3,7 @@ platform: ios title: Undeclared Known Tracking Domains id: MASTG-TEST-0281 type: [static, dynamic] -weakness: MASWE-0075 +weakness: MASWE-0074 profiles: [P] --- diff --git a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0360.md b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0360.md index 92a13596b32..f7ac5e2ccc2 100644 --- a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0360.md +++ b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0360.md @@ -3,7 +3,7 @@ title: Purpose String Accuracy for Reachable Protected Resource Access platform: ios id: MASTG-TEST-0360 type: [static, config, manual] -weakness: MASWE-0067 +weakness: MASWE-0066 profiles: [P] best-practices: [MASTG-BEST-0051] knowledge: [MASTG-KNOW-0077] diff --git a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0361.md b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0361.md index c7486a205e0..d2b410890fd 100644 --- a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0361.md +++ b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0361.md @@ -3,7 +3,7 @@ title: Runtime Use of Protected Resource APIs Without Accurate Purpose Strings platform: ios id: MASTG-TEST-0361 type: [dynamic, hooks, manual] -weakness: MASWE-0067 +weakness: MASWE-0066 profiles: [P] best-practices: [MASTG-BEST-0051] knowledge: [MASTG-KNOW-0077] diff --git a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0362.md b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0362.md index b45a62b7fa0..7ef2b6255fa 100644 --- a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0362.md +++ b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0362.md @@ -3,7 +3,7 @@ title: Entitlements for Unjustified Capability Exposure platform: ios id: MASTG-TEST-0362 type: [static, package, manual] -weakness: MASWE-0067 +weakness: MASWE-0066 profiles: [P] best-practices: [MASTG-BEST-0051] knowledge: [MASTG-KNOW-0077] diff --git a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0363.md b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0363.md index 1b45304eaa8..816bc3bb3a0 100644 --- a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0363.md +++ b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0363.md @@ -3,7 +3,7 @@ title: Runtime Use of Entitlement-Backed APIs for Unjustified Capability Exposur platform: ios id: MASTG-TEST-0363 type: [dynamic, hooks, manual] -weakness: MASWE-0067 +weakness: MASWE-0066 profiles: [P] best-practices: [MASTG-BEST-0051] knowledge: [MASTG-KNOW-0077] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0219.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0219.md index 0f281b237cd..e5a4bc416a0 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0219.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0219.md @@ -3,14 +3,14 @@ platform: ios title: Testing for Debugging Symbols id: MASTG-TEST-0219 type: [static, code] -weakness: MASWE-0062 +weakness: MASWE-0061 profiles: [R] knowledge: [MASTG-KNOW-0063] --- ## Overview -This test case checks for [debugging symbols](https://mas.owasp.org/MASWE/MASVS-RESILIENCE/MASWE-0093/) in all binaries contained in the app. +This test case checks for debugging symbols in all binaries contained in the app. Debugging symbols are added by the [compiler to ease development](https://developer.apple.com/documentation/xcode/building-your-app-to-include-debugging-information "Building your app to include debugging information") and allow symbolication of crashes. However, they can also be used to reverse engineer the app and should not be present in a released app. [Symbolication can also be performed](https://developer.apple.com/documentation/xcode/adding-identifiable-symbol-names-to-a-crash-report "Adding identifiable symbol names to a crash report") with a separate dSYM file. diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0220.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0220.md index e7d8157c5ad..56b2a142bce 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0220.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0220.md @@ -3,7 +3,7 @@ platform: ios title: Usage of Outdated Code Signature Format id: MASTG-TEST-0220 type: [static, code] -weakness: MASWE-0057 +weakness: MASWE-0056 profiles: [R] knowledge: [MASTG-KNOW-0058] --- diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0240.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0240.md index e2c03a71288..297a6bcd0cd 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0240.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0240.md @@ -3,7 +3,7 @@ platform: ios title: Jailbreak Detection in Code id: MASTG-TEST-0240 type: [static, code] -weakness: MASWE-0052 +weakness: MASWE-0051 false_negative_prone: true profiles: [R] knowledge: [MASTG-KNOW-0084] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0241.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0241.md index cedafbff1ec..6a4f89df27a 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0241.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0241.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Use of Jailbreak Detection Techniques id: MASTG-TEST-0241 type: [dynamic, hooks] -weakness: MASWE-0052 +weakness: MASWE-0051 false_negative_prone: true profiles: [R] knowledge: [MASTG-KNOW-0084] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0261.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0261.md index 6b2068610b8..3740270b2a3 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0261.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0261.md @@ -3,7 +3,7 @@ platform: ios title: Debuggable Entitlement Enabled in the entitlements.plist id: MASTG-TEST-0261 type: [static, code] -weakness: MASWE-0064 +weakness: MASWE-0063 profiles: [R] knowledge: [MASTG-KNOW-0062] --- diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0354.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0354.md index 4033af49d87..a63f85de8ca 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0354.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0354.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Use of Hook Detection Techniques id: MASTG-TEST-0354 type: [dynamic, hooks] -weakness: MASWE-0059 +weakness: MASWE-0058 profiles: [R] knowledge: [MASTG-KNOW-0087] best-practices: [MASTG-BEST-0048] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0358.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0358.md index 173bce4f850..16b009ca971 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0358.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0358.md @@ -3,7 +3,7 @@ platform: ios title: Implementation Details Exposure Through Logging APIs id: MASTG-TEST-0358 type: [static, code] -weakness: MASWE-0062 +weakness: MASWE-0061 best-practices: [MASTG-BEST-0022] knowledge: [MASTG-KNOW-0064, MASTG-KNOW-0101] profiles: [R] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0359.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0359.md index 45f174b518b..8f4bd72ad90 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0359.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0359.md @@ -3,7 +3,7 @@ platform: ios title: Implementation Details Exposure in Logs id: MASTG-TEST-0359 type: [dynamic, logs] -weakness: MASWE-0062 +weakness: MASWE-0061 best-practices: [MASTG-BEST-0022] knowledge: [MASTG-KNOW-0064, MASTG-KNOW-0101] profiles: [R] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0367.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0367.md index c8395d95615..de9dee2f259 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0367.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0367.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Use of Virtual Device Detection Techniques id: MASTG-TEST-0367 type: [dynamic] -weakness: MASWE-0054 +weakness: MASWE-0053 best-practices: [MASTG-BEST-0053] profiles: [R] knowledge: [MASTG-KNOW-0135] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0387.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0387.md index 562f1b3bd1f..73bd9285b34 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0387.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0387.md @@ -4,7 +4,7 @@ title: References to Storage Integrity Check APIs id: MASTG-TEST-0387 apis: [HMAC, CCHmac, CCHmacFinal, CC_SHA256, CC_SHA512, SecKeyCreateSignature] type: [static, code, manual] -weakness: MASWE-0058 +weakness: MASWE-0057 false_negative_prone: true profiles: [R] knowledge: [MASTG-KNOW-0086] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0391.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0391.md index 374f4c095a3..b5542b57efa 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0391.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0391.md @@ -3,7 +3,7 @@ platform: ios title: Insufficient Obfuscation of Security-Relevant Native Code id: MASTG-TEST-0391 type: [static, package, manual] -weakness: MASWE-0060 +weakness: MASWE-0059 best-practices: [MASTG-BEST-0029] profiles: [R] knowledge: [MASTG-KNOW-0089] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0401.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0401.md index 75780eb473b..5335fae49e8 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0401.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0401.md @@ -4,7 +4,7 @@ title: References to Debugging Detection APIs id: MASTG-TEST-0401 apis: [ptrace, PT_DENY_ATTACH, sysctl, KERN_PROC_PID, P_TRACED, getppid, task_get_exception_ports, EXC_MASK_BREAKPOINT] type: [static, code, manual] -weakness: MASWE-0065 +weakness: MASWE-0064 best-practices: [MASTG-BEST-0029, MASTG-BEST-0074] profiles: [R] knowledge: [MASTG-KNOW-0085] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0402.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0402.md index 785c219d1e3..0000e9bfdce 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0402.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0402.md @@ -4,7 +4,7 @@ title: Runtime Use of Debugging Detection APIs id: MASTG-TEST-0402 apis: [ptrace, PT_DENY_ATTACH, sysctl, KERN_PROC_PID, P_TRACED, getppid, task_get_exception_ports, EXC_MASK_BREAKPOINT] type: [dynamic, hooks, manual] -weakness: MASWE-0065 +weakness: MASWE-0064 best-practices: [MASTG-BEST-0029, MASTG-BEST-0074] profiles: [R] knowledge: [MASTG-KNOW-0085]