界: Security Features

软件安全不是安全软件。此处我们关注的主题包括身份验证、Access Control、机密性、加密和权限管理。

314 个项目已找到

弱点

Privacy Violation: Unobfuscated Logging

Python

Abstract

对私人信息（如客户密码或社会保障号码）处理不当会损害用户隐私，这通常是一种非法行为。

Explanation

Privacy Violation 会在以下情况下发生：

1.用户私人信息进入了程序。
2.数据被写到外部位置，如控制台、文件系统或网络。

示例 1：下面易受攻击的代码包含一个配置语句，该语句允许以未屏蔽形式记录密码“admin_password”。


from oslo_config import cfg
 ...
opts = [
  cfg.StrOpt('admin_password',secret=False,
               help="User's password")]
 ...              
grp = cfg.OptGroup('mygroup')
cfg.CONF.register_opts(opts, group=grp)
 ...
logger.warning("Adding %s" % cfg.CONF.mygroup.admin_password)

Example 1 中的代码将 admin_password 以明文（未屏蔽）形式写入日志输出，因为 secret 的值设置为 False。虽然许多开发人员认为事件日志是存储数据的安全位置，但这不是绝对的，特别是涉及到隐私问题时。

可以通过多种方式将私人数据输入到程序中：

- 以密码或个人信息的形式直接从用户处获取

- 由应用程序访问数据库或者其他数据存储器

- 从合作伙伴或其他第三方间接获取

有时，未贴上私人标签的数据在其他上下文中也有可能成为私人信息。例如，学生的学号通常不视为私人信息，因为学号中并没有明确且公开可用的信息来反映学生的个人信息。但是，如果学校用学生的社会保障号码生成学号，那么这时学号应被视为私人信息。

安全和隐私似乎一直是一对矛盾。从安全的角度看，您应该记录所有重要的操作，以便日后可以鉴定那些非法的操作。然而，当其中牵涉到私人数据时，这种做法就存在一定风险了。

虽然不安全地处理私人数据有多种形式，但是常见的风险来自于盲目的信任。程序员通常会信任运行程序的操作环境，因此认为将私人信息存放在文件系统、注册表或者其他本地控制的资源中是值得信任的。尽管已经限制了某些资源的访问权限，但仍无法保证所有访问这些资源的个体都是值得信任的。例如，2004 年，一个不道德的 AOL 员工将大约 9200 万个私有客户电子邮件地址卖给了一个通过垃圾邮件进行营销的境外赌博网站 [1]。

为能够妥善应对此类备受瞩目的信息盗取事件，私人数据的收集与管理正日益规范化。要求各个组织应根据其经营地点、所从事的业务类型及其处理的私人数据性质，遵守下列一个或若干个联邦和州的规定：

- Safe Harbor Privacy Framework [3]

- Gramm-Leach Bliley Act (GLBA) [4]

- Health Insurance Portability and Accountability Act (HIPAA) [5]

- California SB-1386 [6]

这些规范业已存在，但侵犯隐私的情况仍时有发生。

References

[1] J. Oates AOL man pleads guilty to selling 92m email addies The Register

[2] Privacy Initiatives U.S. Federal Trade Commission

[3] Safe Harbor Privacy Framework U.S. Department of Commerce

[4] Financial Privacy: The Gramm-Leach Bliley Act (GLBA) Federal Trade Commission

[5] Health Insurance Portability and Accountability Act (HIPAA) U.S. Department of Human Services

[6] California SB-1386 Government of the State of California

[7] M. Howard, D. LeBlanc Writing Secure Code, Second Edition Microsoft Press

[8] Standards Mapping - CIS Azure Kubernetes Service Benchmark 3.0

[9] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 3.0

[10] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 2

[11] Standards Mapping - CIS Google Kubernetes Engine Benchmark confidentiality

[12] Standards Mapping - CIS Kubernetes Benchmark complete

[13] Standards Mapping - Common Weakness Enumeration CWE ID 359

[14] Standards Mapping - Common Weakness Enumeration Top 25 2019 [4] CWE ID 200

[15] Standards Mapping - Common Weakness Enumeration Top 25 2020 [7] CWE ID 200

[16] Standards Mapping - Common Weakness Enumeration Top 25 2021 [20] CWE ID 200

[17] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000169, CCI-001199, CCI-001312, CCI-001314, CCI-002475

[18] Standards Mapping - FIPS200 MP

[19] Standards Mapping - General Data Protection Regulation (GDPR) Privacy Violation

[20] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-4 Information Flow Enforcement (P1), SC-28 Protection of Information at Rest (P1)

[21] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-4 Information Flow Enforcement, SC-28 Protection of Information at Rest

[22] Standards Mapping - OWASP Top 10 2007 A6 Information Leakage and Improper Error Handling

[23] Standards Mapping - OWASP Top 10 2010 A7 Insecure Cryptographic Storage

[24] Standards Mapping - OWASP Top 10 2013 A6 Sensitive Data Exposure

[25] Standards Mapping - OWASP Top 10 2017 A3 Sensitive Data Exposure

[26] Standards Mapping - OWASP Top 10 2021 A02 Cryptographic Failures

[27] Standards Mapping - OWASP API 2023 API3 Broken Object Property Level Authorization

[28] Standards Mapping - OWASP Application Security Verification Standard 4.0 8.2.2 Client-side Data Protection (L1 L2 L3), 8.3.4 Sensitive Private Data (L1 L2 L3), 10.2.1 Malicious Code Search (L2 L3)

[29] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[30] Standards Mapping - OWASP Mobile 2023 M6 Inadequate Privacy Controls

[31] Standards Mapping - OWASP Mobile 2024 M6 Inadequate Privacy Controls

[32] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 4.1

[33] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 3.4, Requirement 6.3.1.3, Requirement 6.5.6, Requirement 6.5.8, Requirement 8.4

[34] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 3.2, Requirement 3.4, Requirement 6.5.5, Requirement 8.4

[35] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 3.2, Requirement 3.4, Requirement 4.2, Requirement 6.5.3, Requirement 8.2.1

[36] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 3.2, Requirement 3.4, Requirement 4.2, Requirement 6.5.3, Requirement 8.2.1

[37] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 3.2, Requirement 3.4, Requirement 4.2, Requirement 6.5.3, Requirement 8.2.1

[38] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 3.2, Requirement 3.4, Requirement 4.2, Requirement 6.5.3, Requirement 8.2.1

[39] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 3.3.1, Requirement 3.5.1, Requirement 4.2.2, Requirement 6.2.4, Requirement 8.3.1

[40] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 3.3 - Sensitive Data Retention, Control Objective 6.1 - Sensitive Data Protection, Control Objective 7 - Use of Cryptography

[41] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 3.3 - Sensitive Data Retention, Control Objective 6.1 - Sensitive Data Protection, Control Objective 7 - Use of Cryptography

[42] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 3.3 - Sensitive Data Retention, Control Objective 6.1 - Sensitive Data Protection, Control Objective 7 - Use of Cryptography

[43] Standards Mapping - SANS Top 25 2010 Porous Defenses - CWE ID 311

[44] Standards Mapping - SANS Top 25 2011 Porous Defenses - CWE ID 311

[45] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3620 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3620 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3620 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3620 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3620 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3620 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3620 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[54] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[55] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[56] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[57] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[58] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[59] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[60] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[61] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[62] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[63] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[64] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[65] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[66] Standards Mapping - Web Application Security Consortium Version 2.00 Information Leakage (WASC-13)

[67] Standards Mapping - Web Application Security Consortium 24 + 2 Information Leakage

desc.structural.python.privacy_violation_unobfuscated_logging

Privilege Management: Amazon Web Services Unchecked Permissions

Java/JSP

Abstract

攻击者可利用控制权限或 access control 列表的方法未经检验的参数来访问敏感数据。

Explanation

攻击者可通过下列方法来利用未经检验的权限中的漏洞：

1. 数据从不可信赖的数据源进入应用程序。

2. 事先未经过任何健全性检查，此数据即用于表示用户或组标识符、权限列表或应用权限的资源。应用程序随后会使用这些未经检查的数据来编辑权限设置。

References

[1] MSC03-J. Never hard code sensitive information CERT

[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 1.0

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 4.0

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[5] Standards Mapping - CIS Google Kubernetes Engine Benchmark normal

[6] Standards Mapping - Common Weakness Enumeration CWE ID 266

[7] Standards Mapping - Common Weakness Enumeration Top 25 2023 [22] CWE ID 269

[8] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000213, CCI-002165

[9] Standards Mapping - FIPS200 AC

[10] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[11] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-3 Access Enforcement (P1)

[12] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-3 Access Enforcement

[13] Standards Mapping - OWASP Top 10 2004 A2 Broken Access Control

[14] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[15] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[16] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[17] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[18] Standards Mapping - OWASP API 2023 API1 Broken Object Level Authorization

[19] Standards Mapping - OWASP Mobile 2014 M5 Poor Authorization and Authentication

[20] Standards Mapping - OWASP Mobile 2023 M3 Insecure Authentication/Authorization

[21] Standards Mapping - OWASP Mobile 2024 M3 Insecure Authentication/Authorization

[22] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-AUTH-1

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.8

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.8

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.8

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.8

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[28] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 5.4 - Authentication and Access Control

[29] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 5.4 - Authentication and Access Control

[30] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 5.4 - Authentication and Access Control, Control Objective C.2.3 - Web Software Access Controls

[31] Standards Mapping - SANS Top 25 2009 Porous Defenses - CWE ID 285

[32] Standards Mapping - SANS Top 25 2010 Porous Defenses - CWE ID 285

[33] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3500 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3500 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3500 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3500 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3500 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3500 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3500 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[54] Standards Mapping - Web Application Security Consortium Version 2.00 Insufficient Authorization (WASC-02)

[55] Standards Mapping - Web Application Security Consortium 24 + 2 Insufficient Authorization

desc.dataflow.java.privilege_management_amazon_web_services_unchecked_permissions

Privilege Management: Android Activity Recognition

Java/JSP

Abstract

应用程序声明使用了对用户身体活动识别的访问权限。

Explanation

此权限具有“危险”保护级别。指定为“危险”的权限意味着用户数据隐私或设备操作的风险增加。在这种情况下，访问身体活动信息可能会对用户隐私和个人安全造成危险。需要访问用户身体活动信息的应用程序必须非常谨慎地对其进行管理。

示例 1：AndroidManifest.xml 的 <uses-permission .../> 元素声明使用了 ACTIVITY_RECOGNITION 权限，使应用程序能够识别用户的身体活动。

 <uses-permission android:name="android.permission.ACTIVITY_RECOGNITION"/>

References

[1] Security guidelines - Permissions

[2] User Data

[3] Permissions and APIs that Access Sensitive Information

[4] Standards Mapping - CIS Azure Kubernetes Service Benchmark 2.0

[5] Standards Mapping - CIS Microsoft Azure Foundations Benchmark partial

[6] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 4.0

[7] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[8] Standards Mapping - CIS Google Kubernetes Engine Benchmark normal

[9] Standards Mapping - Common Weakness Enumeration CWE ID 250

[10] Standards Mapping - Common Weakness Enumeration Top 25 2023 [22] CWE ID 269

[11] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000381, CCI-002233, CCI-002235

[12] Standards Mapping - FIPS200 AC

[13] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[14] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-6 Least Privilege (P1)

[15] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-6 Least Privilege

[16] Standards Mapping - OWASP Top 10 2004 A2 Broken Access Control

[17] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[18] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[19] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[20] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[21] Standards Mapping - OWASP Application Security Verification Standard 4.0 10.2.2 Malicious Code Search (L2 L3)

[22] Standards Mapping - OWASP Mobile 2014 M5 Poor Authorization and Authentication

[23] Standards Mapping - OWASP Mobile 2023 M8 Security Misconfiguration

[24] Standards Mapping - OWASP Mobile 2024 M8 Security Misconfiguration

[25] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-AUTH-1

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.6

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.6

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.6

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.6

[30] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[31] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[32] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection

[33] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection

[34] Standards Mapping - SANS Top 25 2009 Porous Defenses - CWE ID 285

[35] Standards Mapping - SANS Top 25 2010 Porous Defenses - CWE ID 285

[36] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3500 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3500 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3500 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3500 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3500 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3500 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3500 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[54] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[55] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[56] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[57] Standards Mapping - Web Application Security Consortium Version 2.00 Insufficient Authorization (WASC-02)

[58] Standards Mapping - Web Application Security Consortium 24 + 2 Insufficient Authorization

desc.config.java.privilege_management_android_activity_recognition

Privilege Management: Android Calendar

Java/JSP

Abstract

应用程序声明使用了对用户日历数据的访问权限。

Explanation

此权限具有“危险”保护级别。指定为“危险”的权限意味着用户数据隐私或设备操作的风险增加。在这种情况下，访问用户日历可能会对用户隐私和个人安全造成危险。应用程序必须将日历数据视为敏感数据，并极为谨慎地对其进行管理以维护隐私。

示例 1：AndroidManifest.xml 的 <uses-permission .../> 元素声明使用了 READ_CALENDAR 权限，使应用程序能够读取用户的日历数据。

 <uses-permission android:name="android.permission.READ_CALENDAR"/>

示例 2：AndroidManifest.xml 的 <uses-permission .../> 元素声明使用了 WRITE_CALENDAR 权限，使应用程序能够写入用户的日历数据。

 <uses-permission android:name="android.permission.WRITE_CALENDAR"/>