Android

Member 12358097 wrote:

...Information Leakage flaw...

Associated Flaws by CWE ID:
	 	Information Exposure Through Sent Data (CWE ID 201)(5 flaws)
Description
Sensitive information may be exposed as a result of outbound network connections made by the application.  This can manifest in a couple of different ways.
In C/C++ applications, sometimes the developer fails to zero out a buffer before populating it with data.  This can cause information leakage if, for example, the buffer contains a data structure for which only certain fields were populated. The uninitialized fields would contain whatever data is present at that memory location.  Sensitive information from previously allocated variables could then be leaked when the buffer is sent over the network.
Mobile applications may also transmit sensitive information such as email or SMS messages, address book entries, GPS location data, and anything else that can be accessed by the mobile API.  This behavior is common in mobile spyware applications designed to exfiltrate data to a listening post or other data collection point.  This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability.  However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.
Effort to Fix: 2 - Implementation error. Fix is approx. 6-50 lines of code. 1 day to fix.
Recommendations
In C/C++ applications, ensure that all struct elements are initialized or zeroed before being sent.  In mobile applications, ensure that the transfer of sensitive data is intended and that it does not violate application security policy or user expectations.

        Bitmap bitmap = null;
        Uri uri = null;
if (destType == FILE_URI || destType == NATIVE_URI) {
            if (this.saveToPhotoAlbum) {
                Uri inputUri = getUriFromMediaStore();
                try {
                    //Just because we have a media URI doesn't mean we have a real file, we need to make it
                    uri = Uri.fromFile(new File(FileHelper.getRealPath(inputUri, this.cordova)));

                } catch (NullPointerException e) {
                    uri = null;
                }
            } else {
                uri = Uri.fromFile(new File(getTempDirectoryPath(), System.currentTimeMillis() + ".jpg"));
            }

            if (uri == null) {
                this.failPicture("Error capturing image - no media storage found.");
                return;
            }

            // If all this is true we shouldn't compress the image.
            if (this.targetHeight == -1 && this.targetWidth == -1 && this.mQuality == 100 &&
                    !this.correctOrientation) {
                writeUncompressedImage(uri);

                this.callbackContext.success(uri.toString());
            } else {
                bitmap = getScaledBitmap(FileHelper.stripFileProtocol(imageUri.toString()));

                if (rotate != 0 && this.correctOrientation) {
                    bitmap = getRotatedBitmap(rotate, bitmap, exif);
                }
// warning is for below line ,
                try (OutputStream os = this.cordova.getActivity().getContentResolver().openOutputStream(uri)) {

                    bitmap.compress(Bitmap.CompressFormat.JPEG, this.mQuality, os);

                }

try (OutputStream os = this.cordova.getActivity().getContentResolver().openOutputStream(uri))

Richard MacCutchan wrote:

I just have no idea what you are talking about.

Member 12717761 wrote:

you get aggresive and make an condescending remark

     Bitmap bitmap = null;
     Uri uri = null;
     if (destType == FILE_URI || destType == NATIVE_URI) {
            if (this.saveToPhotoAlbum) {
                Uri inputUri = getUriFromMediaStore();
                try {
                   
                    uri = Uri.fromFile(new File(FileHelper.getRealPath(inputUri, this.cordova)));

                } catch (NullPointerException e) {
                    uri = null;
                }
            } else {
                uri = Uri.fromFile(new File(getTempDirectoryPath(), System.currentTimeMillis() + ".jpg"));
            }

            if (uri == null) {
                this.failPicture("Error capturing image - no media storage found.");
                return;
            }

            // If all this is true we shouldn't compress the image.
            if (this.targetHeight == -1 && this.targetWidth == -1 && this.mQuality == 100 &&
                    !this.correctOrientation) {
                writeUncompressedImage(uri);

                this.callbackContext.success(uri.toString());
            } else {
                bitmap = getScaledBitmap(FileHelper.stripFileProtocol(imageUri.toString()));

                if (rotate != 0 && this.correctOrientation) {
                    bitmap = getRotatedBitmap(rotate, bitmap, exif);
                }

//i get warning for below line i.e OutputStream os....... 
                try (OutputStream os = this.cordova.getActivity().getContentResolver().openOutputStream(uri)) {

                    bitmap.compress(Bitmap.CompressFormat.JPEG, this.mQuality, os);

                }

Member 11828365 wrote:

I want to increase my knowledge...