Java

JAVA.MISC.SD.CACHE : Sensitive Data Cached (Java)

Summary

Potentially sensitive data is stored in a cache.

The following are considered sensitive system data.

Properties

Class Name Sensitive Data Cached (Java)
Significance security
Mnemonic JAVA.MISC.SD.CACHE
Categories
CWE CWE:524 Use of Cache Containing Sensitive Information
CERT-Java CERT-Java:DRD22 Do not cache sensitive information
OWASP-2017 OWASP-2017:A3 Sensitive data exposure
OWASP-2021 OWASP-2021:A2 Cryptographic failures
Availability Available for Java only.

Android Only. Warnings of this class will only be reported in Android code: that is, code that uses the Android API.
Enabling Checks for this warning class are disabled by default. To enable them, add the following WARNING_FILTER rule to the project configuration file. 
WARNING_FILTER += allow class="Sensitive Data Cached (Java)"

Example

In the following example, an IMEI (International Mobile Equipment Identity) is cached in three different locations. 

package com.juliasoft.julia.tests.checks.sensitiveDataCaching;

import java.util.Locale;

import android.app.Activity;
import android.content.ClipData;
import android.content.ClipDescription;
import android.content.ClipboardManager;
import android.content.Context;
import android.provider.UserDictionary;
import android.telephony.TelephonyManager;
import android.content.SharedPreferences;
import android.content.SharedPreferences.Editor;

public class CacheLeak extends Activity {

  public void MyMethod()
  {
      TelephonyManager telephonyManager = (TelephonyManager) getSystemService(this.TELEPHONY_SERVICE); 
      String imei=telephonyManager.getDeviceId();
      UserDictionary.Words.addWord(this, imei, 100, "imei" , Locale.ITALY); /* "Sensitive Data Cached (Java)" 
                                      * warning issued here: IMEI can be accessed through spellchecker and word suggestions. 
                                      */ 
  }

  public void MyMethod2()
  {
      TelephonyManager telephonyManager = (TelephonyManager) getSystemService(this.TELEPHONY_SERVICE); 
      String imei=telephonyManager.getDeviceId();
      ClipboardManager cpManage =  (ClipboardManager) getSystemService(Context.CLIPBOARD_SERVICE);
      cpManage.setText(imei);        /* "Sensitive Data Cached (Java)" 
                                      * warning issued here: IMEI can be accessed by pasting from clipboard. 
                                      */ 
  }

  public void MyMethod4()
  {
      TelephonyManager telephonyManager = (TelephonyManager) getSystemService(this.TELEPHONY_SERVICE); 
      String imei=telephonyManager.getDeviceId();
      SharedPreferences sharedPref = PreferenceManager.getDefaultSharedPreferences(this);
      Editor editor = sharedPref.edit();
      editor.putString("key", imei); // "Sensitive Data Cached (Java)" warning issued here
                                      * warning issued here: IMEI can be accessed preferences and the autocompiling fields. 
                                      */ 
      editor.commit();
  }
}

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.