Skip to content

Commit 4a930bc

Browse files
committed
markdown fix
1 parent 855f228 commit 4a930bc

File tree

2 files changed

+7
-3
lines changed

2 files changed

+7
-3
lines changed

demos/android/MASVS-STORAGE/MASTG-DEMO-0069/MASTG-DEMO-0069.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,4 +32,4 @@ The output contains the extracted sensitive data, showing PII (email address) an
3232

3333
### Evaluation
3434

35-
This test fails because the app uses DataStore without encryption, storing sensitive data such as an access token (secret) and the user's email address (PII) in **plaintext** within the sandbox.
35+
This test fails because the app uses DataStore without encryption, storing sensitive data such as an access token (secret) and the user's email address (PII) in **plaintext** within the sandbox.

tests-beta/android/MASVS-STORAGE/MASTG-TEST-0305.md

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ The goal of this test is to detect insecure storage of sensitive information in
2020
## Steps
2121

2222
### Static Analysis
23+
2324
1. Obtain the application package (e.g., APK file) using @MASTG-TECH-0003.
2425
2. Use a static analysis technique (@MASTG-TECH-0014) to identify references to DataStore APIs such as:
2526
- `androidx.datastore.preferences.preferencesDataStore`
@@ -30,19 +31,21 @@ The goal of this test is to detect insecure storage of sensitive information in
3031
- a secure mechanism (e.g., applying an `EncryptedFile.Builder` for Preferences DataStore or using an encrypted custom serializer for Proto DataStore) is explicitly applied to the sensitive fields.
3132

3233
### Dynamic Analysis
34+
3335
1. Install and run the app on a rooted or emulated device (@MASTG-TECH-0005).
3436
2. Trigger app functionality that processes or stores sensitive data.
35-
3. Access the apps private storage (typically `/data/data/<package_name>/datastore/`) and locate the DataStore files. This requires accessing the app data directories (@MASTG-TECH-0008). File names usually end with:
37+
3. Access the app's private storage (typically `/data/data/<package_name>/datastore/`) and locate the DataStore files. This requires accessing the app data directories (@MASTG-TECH-0008). File names usually end with:
3638
- `.preferences_pb` (Preferences DataStore)
3739
- `.proto` (Proto DataStore)
3840
4. Extract the DataStore files from the device using @MASTG-TECH-0003.
39-
5. Inspect the file content using a suitable tool, applying the technique for Dynamic Analysis (@MASTG-TECH-0015) to confirm whether sensitive data is stored in plaintext. *Note: Proto DataStore files require a Proto decoder for inspection.*
41+
5. Inspect the file content using a suitable tool, applying the technique for Dynamic Analysis (@MASTG-TECH-0015) to confirm whether sensitive data is stored in plaintext. _Note: Proto DataStore files require a Proto decoder for inspection._
4042

4143
---
4244

4345
## Observation
4446

4547
The output should indicate:
48+
4649
- which DataStore files the app creates,
4750
- whether sensitive data (tokens, secrets, PII) is present inside these files,
4851
- whether the stored values appear in plaintext (or easily reversible format).
@@ -52,5 +55,6 @@ The output should indicate:
5255
## Evaluation
5356

5457
The test fails if:
58+
5559
- sensitive data is stored in DataStore files without encryption.
5660
- plaintext tokens, secrets, or PII can be read from the DataStore files through static or dynamic analysis.

0 commit comments

Comments
 (0)