界: Security Features

軟體安全性並非安全性軟體。我們關注驗證、Access Control、保密性、加密以及權限管理之類的主題。

314 找到的項目

弱點

Privacy Violation: Unobfuscated Logging

Python

Abstract

隱私資訊 (比如客戶密碼或社會安全號碼) 處理不當會導致使用者隱私資訊洩漏，且是不合法的行為。

Explanation

在以下情況會發生隱私違反情況：

1.私人使用者資訊進入程式。
2.資料寫入到外部位置，例如主控台、檔案系統或網路。

範例 1：以下易受攻擊的程式碼包含一個組態陳述式，其允許記錄未經過模糊處理的密碼「admin_password」。


from oslo_config import cfg
 ...
opts = [
  cfg.StrOpt('admin_password',secret=False,
               help="User's password")]
 ...              
grp = cfg.OptGroup('mygroup')
cfg.CONF.register_opts(opts, group=grp)
 ...
logger.warning("Adding %s" % cfg.CONF.mygroup.admin_password)

Example 1 中的程式碼將 admin_password 以純文字 (未經過模糊處理) 寫入記錄輸出，因為 secret 的值設定為 False。雖然許多的開發人員相信事件記錄為儲存資料的安全位置，但不應對其絕對信賴，特別是關係到隱私問題時。

隱私資料可以透過多種方式進入到程式中：

- 直接來自於使用者的密碼或個人資訊

- 應用程式從資料庫或其他資料存放區存取

- 間接地來自於合作者或者其他第三方

有時候，未標示為隱私的資料仍有可能在不同的內容中有隱私含意。例如，學生的學號通常不會視為隱私資訊，因為學號中沒有明確和公開的資訊以對應於個別學生的個人資訊。不過，如果學校以學生的身份證字號來產生學號，則此學號應視為隱私資訊。

安全性和隱私似乎時常互相矛盾。從安全的觀點來看，您應該要記錄所有重要的操作，以便於日後辨別所有的異常活動。不過，當其中包含了私人資料時，此種作法將會造成風險。

雖然有多種情況會發生隱私資料處理不安全，但常見的風險多是來自盲目的信賴。程式設計師通常會信賴程式執行的作業環境，所以相信將隱私資訊儲存在檔案系統、登錄或是其他局部控制的資源中是可以接受的。但即使限制特定資源的存取權，也並不保證可以信任有存取權的個人。例如，在 2004 年時一位無恥的 AOL 員工將大約 9 千 2 百萬名客戶的私人電子郵件地址賣給了一個透過發送垃圾郵件進行行銷的賭博網站 [1]。

為了應對此類受矚目的資料攻擊事件，隱私資料的收集和管理正日益規範。要求各組織根據其位置、所管理的業務類型，以及其所處理的隱私資訊性質，遵守以下一個或多個聯邦和州的規定：

- Safe Harbor Privacy Framework [3]

- Gramm-Leach Bliley Act (GLBA) [4]

- Health Insurance Portability and Accountability Act (HIPAA) [5]

- California SB-1386 [6]

雖已制訂規範，但隱私違反的情況仍持續發生。

References

[1] J. Oates AOL man pleads guilty to selling 92m email addies The Register

[2] Privacy Initiatives U.S. Federal Trade Commission

[3] Safe Harbor Privacy Framework U.S. Department of Commerce

[4] Financial Privacy: The Gramm-Leach Bliley Act (GLBA) Federal Trade Commission

[5] Health Insurance Portability and Accountability Act (HIPAA) U.S. Department of Human Services

[6] California SB-1386 Government of the State of California

[7] M. Howard, D. LeBlanc Writing Secure Code, Second Edition Microsoft Press

[8] Standards Mapping - CIS Azure Kubernetes Service Benchmark 3.0

[9] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 3.0

[10] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 2

[11] Standards Mapping - CIS Google Kubernetes Engine Benchmark confidentiality

[12] Standards Mapping - CIS Kubernetes Benchmark complete

[13] Standards Mapping - Common Weakness Enumeration CWE ID 359

[14] Standards Mapping - Common Weakness Enumeration Top 25 2019 [4] CWE ID 200

[15] Standards Mapping - Common Weakness Enumeration Top 25 2020 [7] CWE ID 200

[16] Standards Mapping - Common Weakness Enumeration Top 25 2021 [20] CWE ID 200

[17] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000169, CCI-001199, CCI-001312, CCI-001314, CCI-002475

[18] Standards Mapping - FIPS200 MP

[19] Standards Mapping - General Data Protection Regulation (GDPR) Privacy Violation

[20] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-4 Information Flow Enforcement (P1), SC-28 Protection of Information at Rest (P1)

[21] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-4 Information Flow Enforcement, SC-28 Protection of Information at Rest

[22] Standards Mapping - OWASP Top 10 2007 A6 Information Leakage and Improper Error Handling

[23] Standards Mapping - OWASP Top 10 2010 A7 Insecure Cryptographic Storage

[24] Standards Mapping - OWASP Top 10 2013 A6 Sensitive Data Exposure

[25] Standards Mapping - OWASP Top 10 2017 A3 Sensitive Data Exposure

[26] Standards Mapping - OWASP Top 10 2021 A02 Cryptographic Failures

[27] Standards Mapping - OWASP API 2023 API3 Broken Object Property Level Authorization

[28] Standards Mapping - OWASP Application Security Verification Standard 4.0 8.2.2 Client-side Data Protection (L1 L2 L3), 8.3.4 Sensitive Private Data (L1 L2 L3), 10.2.1 Malicious Code Search (L2 L3)

[29] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[30] Standards Mapping - OWASP Mobile 2023 M6 Inadequate Privacy Controls

[31] Standards Mapping - OWASP Mobile 2024 M6 Inadequate Privacy Controls

[32] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 4.1

[33] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 3.4, Requirement 6.3.1.3, Requirement 6.5.6, Requirement 6.5.8, Requirement 8.4

[34] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 3.2, Requirement 3.4, Requirement 6.5.5, Requirement 8.4

[35] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 3.2, Requirement 3.4, Requirement 4.2, Requirement 6.5.3, Requirement 8.2.1

[36] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 3.2, Requirement 3.4, Requirement 4.2, Requirement 6.5.3, Requirement 8.2.1

[37] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 3.2, Requirement 3.4, Requirement 4.2, Requirement 6.5.3, Requirement 8.2.1

[38] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 3.2, Requirement 3.4, Requirement 4.2, Requirement 6.5.3, Requirement 8.2.1

[39] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 3.3.1, Requirement 3.5.1, Requirement 4.2.2, Requirement 6.2.4, Requirement 8.3.1

[40] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 3.3 - Sensitive Data Retention, Control Objective 6.1 - Sensitive Data Protection, Control Objective 7 - Use of Cryptography

[41] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 3.3 - Sensitive Data Retention, Control Objective 6.1 - Sensitive Data Protection, Control Objective 7 - Use of Cryptography

[42] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 3.3 - Sensitive Data Retention, Control Objective 6.1 - Sensitive Data Protection, Control Objective 7 - Use of Cryptography

[43] Standards Mapping - SANS Top 25 2010 Porous Defenses - CWE ID 311

[44] Standards Mapping - SANS Top 25 2011 Porous Defenses - CWE ID 311

[45] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3620 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3620 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3620 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3620 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3620 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3620 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3620 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[54] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[55] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[56] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[57] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[58] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[59] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[60] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[61] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[62] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[63] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[64] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[65] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000650 CAT II, APSC-DV-002330 CAT II, APSC-DV-002340 CAT II, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II

[66] Standards Mapping - Web Application Security Consortium Version 2.00 Information Leakage (WASC-13)

[67] Standards Mapping - Web Application Security Consortium 24 + 2 Information Leakage

desc.structural.python.privacy_violation_unobfuscated_logging

Privilege Management: Amazon Web Services Unchecked Permissions

Java/JSP

Abstract

用來控制權限或 Access Control 清單的方法，其引數如果未經驗證，會讓攻擊者藉機存取敏感資料。

Explanation

攻擊者可能透過以下方式來利用未經檢查之權限中的弱點：

1. 資料從不可信賴的來源進入應用程式。

2. 資料用於表示使用者或群組識別碼、權限清單或是套用權限的資源，且事先未進行任何例行性檢查。應用程式接著會使用這些未經檢查的資料來編輯權限設定。

References

[1] MSC03-J. Never hard code sensitive information CERT

[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 1.0

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 4.0

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[5] Standards Mapping - CIS Google Kubernetes Engine Benchmark normal

[6] Standards Mapping - Common Weakness Enumeration CWE ID 266

[7] Standards Mapping - Common Weakness Enumeration Top 25 2023 [22] CWE ID 269

[8] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000213, CCI-002165

[9] Standards Mapping - FIPS200 AC

[10] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[11] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-3 Access Enforcement (P1)

[12] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-3 Access Enforcement

[13] Standards Mapping - OWASP Top 10 2004 A2 Broken Access Control

[14] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[15] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[16] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[17] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[18] Standards Mapping - OWASP API 2023 API1 Broken Object Level Authorization

[19] Standards Mapping - OWASP Mobile 2014 M5 Poor Authorization and Authentication

[20] Standards Mapping - OWASP Mobile 2023 M3 Insecure Authentication/Authorization

[21] Standards Mapping - OWASP Mobile 2024 M3 Insecure Authentication/Authorization

[22] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-AUTH-1

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.8

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.8

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.8

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.8

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[28] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 5.4 - Authentication and Access Control

[29] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 5.4 - Authentication and Access Control

[30] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 5.4 - Authentication and Access Control, Control Objective C.2.3 - Web Software Access Controls

[31] Standards Mapping - SANS Top 25 2009 Porous Defenses - CWE ID 285

[32] Standards Mapping - SANS Top 25 2010 Porous Defenses - CWE ID 285

[33] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3500 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3500 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3500 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3500 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3500 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3500 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3500 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II

[54] Standards Mapping - Web Application Security Consortium Version 2.00 Insufficient Authorization (WASC-02)

[55] Standards Mapping - Web Application Security Consortium 24 + 2 Insufficient Authorization

desc.dataflow.java.privilege_management_amazon_web_services_unchecked_permissions

Privilege Management: Android Activity Recognition

Java/JSP

Abstract

該應用程式宣告使用某項權限，來控制使用者體能活動辨識的存取權。

Explanation

此權限具有「危險」保護層級。被指定為危險的權限意味著使用者資料隱私或裝置操作的風險增加。在這種情況下，存取體能活動資訊會對使用者隱私和人身安全構成威脅。必須非常謹慎地管理需要使用者體能活動資訊存取權的應用程式。

範例 1：AndroidManifest.xml 的<uses-permission .../> 元素宣告使用 ACTIVITY_RECOGNITION 權限，這讓應用程式能辨識使用者的體能活動。

 <uses-permission android:name="android.permission.ACTIVITY_RECOGNITION"/>

References

[1] Security guidelines - Permissions

[2] User Data

[3] Permissions and APIs that Access Sensitive Information

[4] Standards Mapping - CIS Azure Kubernetes Service Benchmark 2.0

[5] Standards Mapping - CIS Microsoft Azure Foundations Benchmark partial

[6] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 4.0

[7] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[8] Standards Mapping - CIS Google Kubernetes Engine Benchmark normal

[9] Standards Mapping - Common Weakness Enumeration CWE ID 250

[10] Standards Mapping - Common Weakness Enumeration Top 25 2023 [22] CWE ID 269

[11] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000381, CCI-002233, CCI-002235

[12] Standards Mapping - FIPS200 AC

[13] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[14] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-6 Least Privilege (P1)

[15] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-6 Least Privilege

[16] Standards Mapping - OWASP Top 10 2004 A2 Broken Access Control

[17] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[18] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[19] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[20] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[21] Standards Mapping - OWASP Application Security Verification Standard 4.0 10.2.2 Malicious Code Search (L2 L3)

[22] Standards Mapping - OWASP Mobile 2014 M5 Poor Authorization and Authentication

[23] Standards Mapping - OWASP Mobile 2023 M8 Security Misconfiguration

[24] Standards Mapping - OWASP Mobile 2024 M8 Security Misconfiguration

[25] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-AUTH-1

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.6

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.6

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.6

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.6

[30] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[31] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[32] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection

[33] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection

[34] Standards Mapping - SANS Top 25 2009 Porous Defenses - CWE ID 285

[35] Standards Mapping - SANS Top 25 2010 Porous Defenses - CWE ID 285

[36] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3500 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3500 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3500 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3500 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3500 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3500 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3500 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[54] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[55] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[56] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000500 CAT II, APSC-DV-000510 CAT I, APSC-DV-001500 CAT II

[57] Standards Mapping - Web Application Security Consortium Version 2.00 Insufficient Authorization (WASC-02)

[58] Standards Mapping - Web Application Security Consortium 24 + 2 Insufficient Authorization

desc.config.java.privilege_management_android_activity_recognition

Privilege Management: Android Calendar

Java/JSP

Abstract

該應用程式宣告使用某項權限，來控制使用者行事曆資料存取權。

Explanation

此權限具有「危險」保護層級。被指定為危險的權限意味著使用者資料隱私或裝置操作的風險增加。在這種情況下，存取使用者的行事曆可能會對使用者隱私和人身安全構成威脅。應用程式必須將行事曆資料視為敏感資料，並極其謹慎地管理它以維護隱私。

範例 1：AndroidManifest.xml 的<uses-permission .../> 元素宣告使用 READ_CALENDAR 權限，這讓應用程式能讀取使用者的行事曆資料。

 <uses-permission android:name="android.permission.READ_CALENDAR"/>

範例 2：AndroidManifest.xml 的<uses-permission .../> 元素宣告使用 WRITE_CALENDAR 權限，這讓應用程式能寫入使用者的行事曆資料。

 <uses-permission android:name="android.permission.WRITE_CALENDAR"/>