fix: generalize MASTG-TEST-0375 to cover explicit intents - #3914
Closed
KirthiSaiT wants to merge 1 commit into
Closed
fix: generalize MASTG-TEST-0375 to cover explicit intents#3914KirthiSaiT wants to merge 1 commit into
KirthiSaiT wants to merge 1 commit into
Conversation
The test was scoped only to implicit intents, but data returned from explicit inter-app intents is equally untrusted and requires the same validation. Changes: - Rename title to Inter-App Intent Results - Expand Overview to cover explicit intents targeting external apps - Add Dropbox example to illustrate the explicit intent case - Update Steps to cover both implicit and explicit flows - Update Observation to capture target package/component in traces - Update Evaluation to apply regardless of intent type Fixes OWASP#3906
|
Thank you for your contribution! However, you are not assigned to any of the linked issues:
To contribute to this project, please:
This helps us coordinate contributions and avoid duplicate work. |
|
Automated moderation result. Verdict, ai-assisted. Reasons. Evidence.
Suggested action, Accept the PR as ai-assisted contribution.. |
KirthiSaiT
deleted the
fix/generalize-mastg-test-0375-for-explicit-intents
branch
June 29, 2026 20:01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR closes #3906
Description
MASTG-TEST-0375was scoped only to implicit intents, but the same trust issue exists with explicit intents targeting external apps. If an app has a dedicated "Attach from Dropbox" button that uses an explicit intent, the data Dropbox returns is still fully controlled by Dropbox — the app should not treat it as trusted without validation.Changes made to
tests-beta/android/MASVS-CODE/MASTG-TEST-0375.md:AI Tool Disclosure
AI tools used: Claude
Models and versions: Claude Sonnet 4.6
Prompt summary: Analyzed issue #3906 and the existing MASTG-TEST-0375 file, then generalized the title, overview, steps, observation, and evaluation sections to cover both implicit and explicit inter-app intents while preserving the existing style and all cross-references.
Mobile security expertise level: medium
Contributor Checklist