René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Java] CWE-312: Query to detect cleartext storage of sensitive information using Android SharedPreferences","articleBody":"## CVE ID(s)\r\n\r\n*List the CVE ID(s) associated with this vulnerability. GitHub will automatically link CVE IDs to the [GitHub Advisory Database](https://github.com/advisories).*\r\n\r\n\r\n## Report\r\n\r\n*Describe the vulnerability. Provide any information you think will help GitHub assess the impact your query has on the open source community.*\r\n\u003ccode\u003eSharedPreferences\u003c/code\u003e is an Android API that stores application preferences using simple sets of data values. Almost every Android application uses this API. It allows to easily save, alter, and retrieve the values stored in \u003ccode\u003eSharedPreferences\u003c/code\u003e.\r\n\r\nHowever, sensitive information should not be saved in cleartext. Otherwise it can be accessed by any process or user on rooted devices, or can be disclosed through chained vulnerabilities e.g. unexpected access to its private storage through exposed components. Hundreds of GitHub repositories have this vulnerability of storing sensitive information in cleartext.\r\n\r\nThe query detects this issue and integrates with the existing core libraries. \r\n\r\nRelevant PR: [#4675](https://github.com/github/codeql/pull/4675)\r\n\r\n- [x] Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). *We would love to have you spread the word about the good work you are doing*\r\n\r\n## Result(s)\r\n\r\n*Provide at least one useful result found by your query, on some revision of a real project.*\r\n\r\n- [zhuo_ning-iot-controller](https://github.com/dustss/zhuo_ning-iot-controller)\r\n","author":{"url":"https://github.com/luchua-bc","@type":"Person","name":"luchua-bc"},"datePublished":"2020-11-16T17:38:29.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":6},"url":"https://github.com/205/securitylab/issues/205"}