Port MASTG-TEST-0028: Testing for Testing Deep Links (android)

[cpholguera]

This PR closes #2980

Description

Ports MASTG-TEST-0028 (Testing Deep Links) from v1 to v2 for Android, targeting deep link weaknesses that allow link hijacking and unvalidated external input (MASWE-0058). The single v1 test is split into two focused v2 tests: one for http/https App Links declared without OS verification, and one for custom URL scheme handlers that act on URI parameters without validation. General theory, OS-version behavior, and the website-association verification workflow are moved out of the test into Knowledge and Techniques.

New v2 Tests (tests-beta)

• MASTG-TEST-0393 — Use of Unverified App Links (static, config)

  • Static analysis to identify http/https deep link <intent-filter> elements declared without android:autoVerify="true"
  • Evaluation notes that autoVerify alone is necessary but not sufficient, pointing to the website-association verification technique

• MASTG-TEST-0394 — Missing Input Validation in Custom URL Scheme Handlers (static, code, manual)

  • Static analysis to locate custom URL scheme handlers and the URI parameters they read (getData, getQueryParameter)
  • Highlights that Android has no sourceApplication equivalent, so every custom URL scheme handler is reachable by any app on the device
  • References a dynamic complement (@MASTG-TECH-0173) for runtime confirmation of handler methods and parameters

New Demos (MASVS-PLATFORM)

• MASTG-DEMO-0151 — Deep Link Intent Filter Missing android:autoVerify with semgrep (for MASTG-TEST-0393)

  • Kotlin sample whose http/https App Link performs a sensitive action with correctly validated input, isolating the weakness to the missing verification rather than input handling

• MASTG-DEMO-0152 — Custom URL Scheme Handler Without Input Validation with semgrep (for MASTG-TEST-0394)

  • Kotlin sample registering mastestapp://transfer and passing the raw amount parameter to a sensitive action without type conversion or bounds checking
  • SAST run scans both the reverse-engineered handler entry point (DeepLinkActivity_reversed.java, where getIntent().getData() is called) and the parameter extraction (MastgTest_reversed.java)

New SAST Rules

• mastg-android-deeplink-autoverify-missing.yml — flags http/https deep links without android:autoVerify="true"

• mastg-android-custom-deeplink-scheme.yml — flags custom (non http/https) URL scheme deep links

• mastg-android-deeplink-unvalidated-parameter.yml — locates the deep link handler entry point (getData) and the URI parameters it reads (getQueryParameter)

  All three rules use order-independent matching so they work across arbitrary real-world manifests regardless of manifest child-element order.

New Techniques

• MASTG-TECH-0172 — Listing Deep Links — enumerating deep links from the manifest, Dumpsys, and the App Link Verification Tester
• MASTG-TECH-0173 — Monitoring Deep Link Handlers at Runtime with Frida — dynamic identification of handler methods and processed parameters
• MASTG-TECH-0174 — Verifying App Link Website Association — confirming verification via adb shell pm get-app-links and the App Link Verification Tester, with common Digital Asset Links failure causes

New Best Practices

• MASTG-BEST-0070 — Verify Android App Links with autoVerify and Digital Asset Links (linked from MASTG-TEST-0393)
• MASTG-BEST-0071 — Validate Input Parameters in Deep Link and Custom URL Scheme Handlers (linked from MASTG-TEST-0394)

Deprecation

• MASTG-TEST-0028 (v1) — marked status: deprecated, covered_by: [MASTG-TEST-0393, MASTG-TEST-0394]

Supporting File Updates

• MASTG-KNOW-0019 (Deep Links) — expanded to cover App Link verification (autoVerify + Digital Asset Links, redirects, subdomains, wildcards), Android version-dependent verification behavior (API < 31 vs ≥ 31), incoming intent handling (getIntent, getData, onNewIntent), URI parameter parsing (getQueryParameter, getPathSegments, getLastPathSegment), and the absence of an Android equivalent to iOS's sourceApplication; added a reference to the "Measuring the Insecurity of Mobile Deep Links of Android" research paper

---

AI Tool Disclosure

Check exactly one option.

• This contribution does not include AI-generated content.
• This contribution includes AI-generated content.