JavaScript is not currently enabled, but is required for full CodeSonar manual search and browse functionality.

If you are viewing this file in your hub's Web GUI, enable JavaScript in your browser: you will also need it for GUI functionality.

If you opened this file directly from disk, your browser may be directly suppressing JavaScript functionality: certain browsers perform this suppression on local files (but not files delivered by web servers) for security reasons.

CodeSonar® 9.2p0 CONFIDENTIAL CodeSecure Inc
Java


JAVA.MISC.SD.EXT : Sensitive Data Written to External Storage (Java)

要旨

Potentially sensitive data is stored in external storage.

Removable volumes, such as SD cards, appear in the file system as part of external storage. Storing sensitive information in external storage has several consequences:

The following are considered sensitive system data.

プロパティ

クラス名 Sensitive Data Written to External Storage (Java)
日本語クラス名 Sensitive Data Written to External Storage (Java)
クラス分類 セキュリティ (security)
ニーモニック JAVA.MISC.SD.EXT
カテゴリー
CWE CWE:200 Exposure of Sensitive Information to an Unauthorized Actor
CERT-Java CERT-Java:DRD00 Do not store sensitive information on external storage (SD card) unless encrypted first
  CERT-Java:DRD22 Do not cache sensitive information
  CERT-Java:MSC03-J Never hard code sensitive information
OWASP-2017 OWASP-2017:A3 Sensitive data exposure
  OWASP-2017:A5 Broken access control
OWASP-2021 OWASP-2021:A1 Broken access control
  OWASP-2021:A2 Cryptographic failures
  OWASP-2021:A6 Vulnerable and outdated components
OWASP-2025 OWASP-2025:A01 Broken Access Control
  OWASP-2025:A06 Insecure Design
対応言語 Available for Java and Kotlin.
有効/無効設定 このワーニングクラスのチェックはデフォルトで無効になっています。チェックを有効にするにはプロジェクト設定ファイル (configuration file)に以下の WARNING_FILTER ルールを追加してください。
WARNING_FILTER += allow class="Sensitive Data Written to External Storage (Java)"

package com.juliasoft.julia.tests.checks.sensitiveDataCaching;

import java.io.BufferedOutputStream;
import java.io.BufferedWriter;
import java.io.DataOutputStream;
import java.io.File;
import java.io.FileOutputStream;
import java.io.FileWriter;
import java.io.IOException;
import java.io.PrintWriter;
import java.io.RandomAccessFile;
import java.nio.ByteBuffer;
import java.nio.channels.FileChannel;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;

import android.app.Activity;
import android.os.Environment;
import android.telephony.TelephonyManager;

public class ExternalStorageLeak extends Activity {

  public void MyMethod()
  {

    try {
      TelephonyManager telephonyManager = (TelephonyManager) getSystemService(this.TELEPHONY_SERVICE); 
      String imei=telephonyManager.getDeviceId();
    
      usingBufferedWritter1(imei);
      usingBufferedWritter2(imei);
      usingFileWriter(imei);
      usingPrintWriter(imei);
      usingFileOutputStream(imei);
      usingDataOutputStream(imei);
      usingFileChannel(imei);
      usingPath(imei);
    } catch (IOException e) {
      e.printStackTrace();
    }
  }

  public static void usingBufferedWritter1(String fileContent) throws IOException
  {
      BufferedWriter writer = new BufferedWriter(new FileWriter("myfile0.txt"));
      writer.write(fileContent);                 // Sensitive Data Written to Local File (Java) warning issued here
      writer.close();
  }
      
  public static void usingBufferedWritter2(String fileContent) throws IOException
  {
      BufferedWriter writer = new BufferedWriter(new FileWriter(Environment.getExternalStorageDirectory()+"myfile1.txt"));
      writer.write(fileContent);                 // "Sensitive Data Written to External Storage" warning issued here 
      writer.close();
  }

  public static void usingFileWriter(String fileContent) throws IOException
  {
      FileWriter fileWriter = new FileWriter("/sdcard/Android/data/myfile2.txt");
      fileWriter.write(fileContent);             // "Sensitive Data Written to External Storage" warning issued here 
      fileWriter.close();
  }
      
  public static void usingPrintWriter(String fileContent) throws IOException
  {
      FileWriter fileWriter = new FileWriter(Environment.getLegacyExternalStorageDirectory()+"myfile3.txt");
      PrintWriter printWriter = new PrintWriter(fileWriter);
      printWriter.print(fileContent);            // "Sensitive Data Written to External Storage" warning issued here 
      printWriter.close();
  }

  public static void usingFileOutputStream(String fileContent) throws IOException
  {
      FileOutputStream outputStream = new FileOutputStream(new File(Environment.getExternalStorageDirectory(),"myfile4.txt"));
      byte[] strToBytes = fileContent.getBytes();
      outputStream.write(strToBytes);            // "Sensitive Data Written to External Storage" warning issued here 
      outputStream.close();
  }

  public static void usingDataOutputStream(String fileContent) throws IOException
  {
      FileOutputStream outputStream = new FileOutputStream(Environment.getLegacyExternalStorageObbDirectory()+"myfile5.txt");
      DataOutputStream dataOutStream = new DataOutputStream(new BufferedOutputStream(outputStream));
      dataOutStream.writeUTF(fileContent);       // "Sensitive Data Written to External Storage" warning issued here 
      dataOutStream.close();
  }
      
  public static void usingFileChannel(String fileContent) throws IOException
  {
      RandomAccessFile stream = new RandomAccessFile(Environment.getExternalStorageDirectory()+"myfile6.txt", "rw");
      FileChannel channel = stream.getChannel();
      byte[] strBytes = fileContent.getBytes();
      ByteBuffer buffer = ByteBuffer.allocate(strBytes.length);
      buffer.put(strBytes);
      buffer.flip();
      channel.write(buffer);                     // "Sensitive Data Written to External Storage" warning issued here 
      stream.close();
      channel.close();
  }

  public static void usingPath(String fileContent) throws IOException
  {
      Path path = Paths.get(Environment.getExternalStorageDirectory()+"myfile7.txt");
      Files.write(path, fileContent.getBytes()); // "Sensitive Data Written to External Storage" warning issued here 
  }
}

関連のある設定ファイルパラメータ

設定ファイルの以下のパラメータがこのワーニングクラスのチェックに影響します。

 

To report problems with this documentation, please visit https://support.codesecure.com/.