Update MASTG-KNOW-0036 and implement MASTG-TEST-0287#3706
Merged
Conversation
Clarified the usage of EncryptedSharedPreferences and added a link to its source code. Updated the warning regarding the Jetpack security crypto library deprecation.
Collaborator
Author
|
@copilot create the content for tests-beta/android/MASVS-STORAGE/MASTG-TEST-0287.md and remove status and note. |
Contributor
|
@cpholguera I've opened a new pull request, #3707, to work on those changes. Once the pull request is ready, I'll request review from you. |
…3707) * Initial plan * Create content for MASTG-TEST-0287 and remove status/note fields Co-authored-by: cpholguera <29175115+cpholguera@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: cpholguera <29175115+cpholguera@users.noreply.github.com>
cpholguera
changed the title
cpholguera
marked this pull request as draft
February 13, 2026 18:14
cpholguera
commented
Apr 14, 2026
cpholguera
marked this pull request as ready for review
April 14, 2026 07:25
Collaborator
|
For The [`SharedPreferences`](https://developer.android.com/training/data-storage/shared-preferences "Shared Preferences") API is commonly used to permanently save small collections of key-value pairs in the app's sandbox storage.Since Android 4.2 (API level 17), the `SharedPreferences` object can only be declared private and not world-readable, i.e., accessible to all apps. However, values stored in `SharedPreferences` are written to plain-text XML files in the app sandbox, so they can be extracted if the app data directory becomes accessible, for example through device compromise, backup extraction, or physical access to rooted or unlocked devices. |
jacobocasado
suggested changes
Apr 25, 2026
jacobocasado
left a comment
jacobocasado
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed all changed files from this PR :)
Co-authored-by: Jaco <43786394+jacobocasado@users.noreply.github.com>
Co-authored-by: Jaco <43786394+jacobocasado@users.noreply.github.com>
cpholguera
commented
Jun 4, 2026
Co-authored-by: Jaco <43786394+jacobocasado@users.noreply.github.com> Co-authored-by: Carlos Holguera <perezholguera@gmail.com>
…ecation of insecure modes
Co-authored-by: Jaco <43786394+jacobocasado@users.noreply.github.com>
…lidating sensitive data storage in SharedPreferences
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clarified the usage of EncryptedSharedPreferences and added a link to its source code. Updated the warning regarding the Jetpack security crypto library deprecation.