Skip to content

fix: generalize MASTG-TEST-0375 to cover explicit intents - #3914

Closed
KirthiSaiT wants to merge 1 commit into
OWASP:masterfrom
KirthiSaiT:fix/generalize-mastg-test-0375-for-explicit-intents
Closed

fix: generalize MASTG-TEST-0375 to cover explicit intents#3914
KirthiSaiT wants to merge 1 commit into
OWASP:masterfrom
KirthiSaiT:fix/generalize-mastg-test-0375-for-explicit-intents

Conversation

@KirthiSaiT

Copy link
Copy Markdown

This PR closes #3906

Description

MASTG-TEST-0375 was scoped only to implicit intents, but the same trust issue exists with explicit intents targeting external apps. If an app has a dedicated "Attach from Dropbox" button that uses an explicit intent, the data Dropbox returns is still fully controlled by Dropbox — the app should not treat it as trusted without validation.

Changes made to tests-beta/android/MASVS-CODE/MASTG-TEST-0375.md:

  • Renamed title from "Missing Validation of Data Returned from Implicit Intents" to "Missing Validation of Data Returned from Inter-App Intent Results"
  • Expanded Overview to cover both implicit and explicit intents, with the Dropbox example from the issue
  • Updated Steps to instruct testers to cover both implicit flows (file pickers, choosers) and explicit flows (named external app integrations)
  • Updated Observation to capture target package/component when the intent is explicit
  • Updated Evaluation to make clear the test applies regardless of intent type

AI Tool Disclosure

  • This contribution includes AI-generated content.

AI tools used: Claude
Models and versions: Claude Sonnet 4.6
Prompt summary: Analyzed issue #3906 and the existing MASTG-TEST-0375 file, then generalized the title, overview, steps, observation, and evaluation sections to cover both implicit and explicit inter-app intents while preserving the existing style and all cross-references.
Mobile security expertise level: medium

Contributor Checklist

  • I have read and understood the contributing guidelines.
  • I followed the project style guide.
  • I validated the technical correctness of my changes and understand the topic.
  • This PR adds clear value and is not spam or low-effort content.

The test was scoped only to implicit intents, but data returned from
explicit inter-app intents is equally untrusted and requires the same validation.

Changes:
- Rename title to Inter-App Intent Results
- Expand Overview to cover explicit intents targeting external apps
- Add Dropbox example to illustrate the explicit intent case
- Update Steps to cover both implicit and explicit flows
- Update Observation to capture target package/component in traces
- Update Evaluation to apply regardless of intent type

Fixes OWASP#3906
@github-actions

Copy link
Copy Markdown

Thank you for your contribution! However, you are not assigned to any of the linked issues:

To contribute to this project, please:

  1. Request to be assigned to the issue you want to work on
  2. Wait for a maintainer to assign you
  3. Reopen this PR once you are assigned

This helps us coordinate contributions and avoid duplicate work.

@github-actions

Copy link
Copy Markdown

Automated moderation result.

Verdict, ai-assisted.
Confidence, 90.

Reasons.
AI tool disclosure provided
Specific AI tools and models mentioned
Well-structured PR description
Changes justified and relevant to the issue
No signs of unreviewed bulk edits

Evidence.

Suggested action, Accept the PR as ai-assisted contribution..

@KirthiSaiT
KirthiSaiT deleted the fix/generalize-mastg-test-0375-for-explicit-intents branch June 29, 2026 20:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Generalize MASTG-TEST-0375 for both implicit and explicit intents

1 participant