Update MASWE-0002.md

OWASP · Nov 7, 2024 · bccf0b3 · bccf0b3
1 parent 3fe41a2
commit bccf0b3
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/weaknesses/MASVS-STORAGE/MASWE-0002.md b/weaknesses/MASVS-STORAGE/MASWE-0002.md
@@ -12,13 +12,15 @@ mappings:
 
 refs:
 - https://developer.android.com/about/versions/nougat/android-7.0-changes#permfilesys
+- https://developer.android.com/privacy-and-security/security-tips#internal-storage
 draft:
   description: Sensitive data may be stored in internal locations without ensuring
     exclusive app access (e.g. by using the wrong file permissions) and may be accessible
     to other apps.
   topics:
   - File permissions (Android)
   - improperly configured FileProvider (Android)
+  - [Avoid the deprecated MODE_WORLD_WRITEABLE and MODE_WORLD_READABLE modes for IPC files](https://developer.android.com/privacy-and-security/security-tips#internal-storage). They don't provide the ability to limit data access to particular applications, and they don't provide any control of data format. If you want to share your data with other app processes, consider using a content provider instead, which offers read and write permissions to other apps and can make dynamic permission grants on a case-by-case basis.
 status: draft
 
 ---