Create MASTG-TEST — References to Outgoing Inter-App URLs Carrying Sensitive Data

[cpholguera]

• MASTG-TEST-0x01 — References to Outgoing Inter-App URLs Carrying Sensitive Data (static, code, manual)
  • Static disassembly analysis to locate outgoing open(_:options:completionHandler:) calls and check whether sensitive data is placed in the URL handed to another app
  • Covers the "Checking if the App is Calling Other App's Universal Links" part of the v1 test, generalized to both custom URL schemes and universal links
  • Maps to a new cross-platform weakness (see Create MASWE-0120 for Sensitive Data Leaked via Outgoing Inter-App Communication maswe#181), not to MASWE-0058

DRAFT:

---
platform: ios
title: References to Outgoing Inter-App URLs Carrying Sensitive Data
id: MASTG-TEST-0x01
type: [static, code, manual]
weakness: MASWE-0120
profiles: [L1, L2]
best-practices: [MASTG-BEST-0045]
knowledge: [MASTG-KNOW-0078, MASTG-KNOW-0079, MASTG-KNOW-0080]
apis: [open, openURL]
---

## Overview

An app can launch another app and pass it data by opening a URL with `open(_:options:completionHandler:)` (or the deprecated `openURL:options:completionHandler:`). The data is carried in the URL's host, path, or query, and the receiving app is selected by the system, not by the sending app (@MASTG-KNOW-0078).

When the URL is a custom URL scheme (@MASTG-KNOW-0079), any app on the device can register the same scheme, so a malicious or unexpected app may receive the request. When the URL is a universal link (@MASTG-KNOW-0080), the request is routed based on domain association, but the sending app still has no guarantee about which app or web context ultimately handles it. In both cases, putting sensitive data (such as authentication tokens, session identifiers, passwords, or personally identifiable information) in the outgoing URL can expose it to unauthorized parties.

This test checks whether the app places sensitive data in URLs it opens in other apps.

## Steps

1. Use @MASTG-TECH-0058 to extract the relevant binaries from the app package.
2. Use @MASTG-TECH-0066 to look for the relevant APIs in the app binaries.

## Observation

The output should contain the code locations where the app opens an outgoing URL (for example, calls to `open(_:options:completionHandler:)`) and the URL values or components passed to them.

## Evaluation

The test case fails if the app includes sensitive data in a URL it opens in another app.

**Further Validation Required:**

Inspect each reported call site using @MASTG-TECH-0076 to determine whether the outgoing URL carries sensitive data:

- Determine whether the host, path, or query of the URL contains sensitive data such as tokens, session identifiers, passwords, or personally identifiable information.
- Determine whether the value is derived from a sensitive source rather than being a static, non-sensitive identifier.

To complement this static analysis, you can use @MASTG-TECH-0x02 to trace outgoing `open(_:)` calls at runtime and inspect the URLs being sent.