The Java secure code review techniques and tools in the previous chapters still apply to the Android application. The secure Java coding is fundamental to the Android security review. On top of that, there are specific secure code review techniques for the Android application.
The following table summarizes the keywords and patterns for potential security issues we need to focus on:
|
Security inspection focuses |
Related high-risk APIs and keywords |
|
SQL injection |
rawQuery | execSQL | database | .sqlite | SQLiteDatabase |
|
Insecure SSL handling |
ALLOW_ALL_HOST_VERIFIER | NullHostnameVerifier SSLCertificateSocketFactory | SSLSocketFactory setDefaultHostnameVerifier WebViewClient.onReceivedSsLError |
|
Command injection |
getRuntime | ClassLoader |
|
WebView for XSS |
Android.webkit | setJavaScriptEnabled | addJavascriptInterface... |
