STATIC CODE ANALYSIS RESULT
SOURCE: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp.apk
TOTAL FILES: 4331
JAVA FILES: 1958
Restored 112 file(s) out of 120 corrupt file(s)
5
7
10
337
<?xml version="1.0" ?><manifest android:versionCode="24" android:versionName="4.2.1" package="com.kbank.otp" platformBuildVersionCode="23" platformBuildVersionName="6.0-2704002" xmlns:android="http://schemas.android.com/apk/res/android">
<uses-sdk android:minSdkVersion="9" android:targetSdkVersion="23"/>
<supports-screens android:largeScreens="true" android:xlargeScreens="true"/>
<uses-feature android:glEsVersion="0x20000" android:required="true"/>
<permission android:name="com.kbank.otp.permission.MAPS_RECEIVE" android:protectionLevel="signature"/>
<uses-permission android:name="com.kbank.otp.permission.MAPS_RECEIVE"/>
<uses-permission android:name="android.permission.INTERNET"/>
<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
<uses-permission android:name="com.google.android.providers.gsf.permission.READ_GSERVICES"/>
<uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION"/>
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/>
<uses-permission android:name="android.permission.READ_PHONE_STATE"/>
<uses-permission android:name="android.permission.ACCESS_WIFI_STATE"/>
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
<uses-permission android:name="android.permission.ACCESS_DOWNLOAD_MANAGER"/>
<uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE"/>
<uses-permission android:name="android.permission.WAKE_LOCK"/>
<uses-permission android:name="com.google.android.c2dm.permission.RECEIVE"/>
<permission android:name="com.kbank.otp.permission.C2D_MESSAGE" android:protectionLevel="signature"/>
<uses-permission android:name="com.kbank.otp.permission.C2D_MESSAGE"/>
<application android:allowBackup="true" android:hardwareAccelerated="true" android:icon="@drawable/ic_launcher" android:label="@string/title_application" android:name="com.kbank.otp.TheApplication" android:theme="@style/AppTheme">
<activity android:configChanges="locale|layoutDirection" android:label="@string/title_application" android:launchMode="singleTask" android:name="com.kbank.otp.MainActivity" android:screenOrientation="portrait" android:windowSoftInputMode="adjustPan|stateHidden">
<intent-filter>
<category android:name="android.intent.category.DEFAULT"/>
<action android:name="android.intent.action.VIEW"/>
<data android:scheme="com.kbank.otp"/>
</intent-filter>
</activity>
<activity android:name="com.kbank.otp.SplashActivity" android:screenOrientation="portrait" android:theme="@android:style/Theme.Black.NoTitleBar">
<intent-filter>
<action android:name="android.intent.action.MAIN"/>
<category android:name="android.intent.category.LAUNCHER"/>
</intent-filter>
</activity>
<meta-data android:name="com.google.android.gms.version" android:value="@integer/google_play_services_version"/>
<meta-data android:name="com.google.android.maps.v2.API_KEY" android:value="AIzaSyCSzNhgjE648S215MjCk02Oq69MegrIpYs"/>
<meta-data android:name="com.google.firebase.messaging.default_notification_icon" android:resource="@drawable/ic_stat_ic_notification"/>
<meta-data android:name="com.google.firebase.messaging.default_notification_color" android:resource="@color/statusbar_color"/>
<service android:name="com.kbank.otp.services.FirebaseMessagingService">
<intent-filter>
<action android:name="com.google.firebase.MESSAGING_EVENT"/>
</intent-filter>
</service>
<service android:name="com.kbank.otp.services.FirebaseInstanceIDService">
<intent-filter>
<action android:name="com.google.firebase.INSTANCE_ID_EVENT"/>
</intent-filter>
</service>
<service android:exported="false" android:name="com.kbank.otp.services.FirebaseTokenService"/>
<activity android:name="com.kbank.otp.MoneyTransferActivity"/>
<uses-library android:name="android.test.runner"/>
<activity android:exported="false" android:name="com.google.android.gms.common.api.GoogleApiActivity" android:theme="@android:style/Theme.Translucent.NoTitleBar"/>
<service android:exported="true" android:name="com.google.firebase.messaging.FirebaseMessagingService">
<intent-filter android:priority="-500">
<action android:name="com.google.firebase.MESSAGING_EVENT"/>
</intent-filter>
</service>
<receiver android:enabled="true" android:exported="false" android:name="com.google.android.gms.measurement.AppMeasurementReceiver"/>
<receiver android:enabled="true" android:name="com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver" android:permission="android.permission.INSTALL_PACKAGES">
<intent-filter>
<action android:name="com.android.vending.INSTALL_REFERRER"/>
</intent-filter>
</receiver>
<service android:enabled="true" android:exported="false" android:name="com.google.android.gms.measurement.AppMeasurementService"/>
<receiver android:exported="true" android:name="com.google.firebase.iid.FirebaseInstanceIdReceiver" android:permission="com.google.android.c2dm.permission.SEND">
<intent-filter>
<action android:name="com.google.android.c2dm.intent.RECEIVE"/>
<action android:name="com.google.android.c2dm.intent.REGISTRATION"/>
<category android:name="com.kbank.otp"/>
</intent-filter>
</receiver>
<receiver android:exported="false" android:name="com.google.firebase.iid.FirebaseInstanceIdInternalReceiver"/>
<service android:exported="true" android:name="com.google.firebase.iid.FirebaseInstanceIdService">
<intent-filter android:priority="-500">
<action android:name="com.google.firebase.INSTANCE_ID_EVENT"/>
</intent-filter>
</service>
<provider android:authorities="com.kbank.otp.firebaseinitprovider" android:exported="false" android:initOrder="100" android:name="com.google.firebase.provider.FirebaseInitProvider"/>
</application>
</manifest>
-
com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver
- android.permission.INSTALL_PACKAGES
-
com.google.firebase.iid.FirebaseInstanceIdReceiver
- com.google.android.c2dm.permission.SEND
- com.google.firebase.iid.FirebaseInstanceIdService
- com.google.firebase.messaging.FirebaseMessagingService
- com.kbank.otp.services.FirebaseInstanceIDService
- com.kbank.otp.services.FirebaseMessagingService
- com.kbank.otp.MainActivity
- com.kbank.otp.SplashActivity
A View that displays web pages. This class is the basis upon which you can roll your own web browser or simply display some online content within your Activity. It uses the WebKit rendering engine to display web pages and includes methods to navigate forward and backward through a history, zoom in and out, perform text searches and more. WebViews may be implemented using the "Android/AOSP" (WebViewClient) or Chrome (WebChromeClient) browsers.
File:
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/MoneyTransferActivity.java
-
BaseURL not redefined in this WebView.
-
File system access is enabled in this WebView. If untrusted data is used to specify the URL opened by this WebView, a malicious app or site may be able to read your app's private files, if it returns the response to them. To validate this vulnerability, load the following local file in this WebView: file://<install_dir>/quark/poc/html/FILE_SYS_WARN.html
-
While not a vulnerability by itself, it appears this app does not explicitly disable Content Provider access from WebViews. If the WebViews take in untrusted input, this can allow for data theft. To validate this vulnerability, load the following local file in this WebView: file://<install_dir>/quark/poc/html/WV_CPA_WARNING.html
-
JavaScript running in a file scheme context can access content from any origin. This is an insecure default value for minSdkVersion < 16 or may have been overridden (setAllowUniversalAccessFromFileURLs) in later versions. To validate this vulnerability, load the following local file in this WebView: file://<install_dir>/quark/poc/html/UNIV_FILE_WARNING.html
-
addJavascriptInterface not used in this WebView.
FILE: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/MoneyTransferActivity.java
-
DOM Storage not enabled for this WebView.
FILE: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/MoneyTransferActivity.java
- BaseURL not redefined in this WebView.
- File system access is enabled in this WebView. If untrusted data is used to specify the URL opened by this WebView, a malicious app or site may be able to read your app's private files, if it returns the response to them. To validate this vulnerability, load the following local file in this WebView: file://<install_dir>/quark/poc/html/FILE_SYS_WARN.html
- While not a vulnerability by itself, it appears this app does not explicitly disable Content Provider access from WebViews. If the WebViews take in untrusted input, this can allow for data theft. To validate this vulnerability, load the following local file in this WebView: file://<install_dir>/quark/poc/html/WV_CPA_WARNING.html
- JavaScript running in a file scheme context can access content from any origin. This is an insecure default value for minSdkVersion < 16 or may have been overridden (setAllowUniversalAccessFromFileURLs) in later versions. To validate this vulnerability, load the following local file in this WebView: file://<install_dir>/quark/poc/html/UNIV_FILE_WARNING.html
- addJavascriptInterface not used in this WebView.
FILE: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/MoneyTransferActivity.java
- DOM Storage not enabled for this WebView.
FILE: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/MoneyTransferActivity.java
File:
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/WebFragment.java
-
BaseURL not redefined in this WebView.
-
File system access is enabled in this WebView. If untrusted data is used to specify the URL opened by this WebView, a malicious app or site may be able to read your app's private files, if it returns the response to them. To validate this vulnerability, load the following local file in this WebView: file://<install_dir>/quark/poc/html/FILE_SYS_WARN.html
-
While not a vulnerability by itself, it appears this app does not explicitly disable Content Provider access from WebViews. If the WebViews take in untrusted input, this can allow for data theft. To validate this vulnerability, load the following local file in this WebView: file://<install_dir>/quark/poc/html/WV_CPA_WARNING.html
-
JavaScript running in a file scheme context can access content from any origin. This is an insecure default value for minSdkVersion < 16 or may have been overridden (setAllowUniversalAccessFromFileURLs) in later versions. To validate this vulnerability, load the following local file in this WebView: file://<install_dir>/quark/poc/html/UNIV_FILE_WARNING.html
-
addJavascriptInterface not used in this WebView.
FILE: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/WebFragment.java
-
DOM Storage not enabled for this WebView.
FILE: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/WebFragment.java
- BaseURL not redefined in this WebView.
- File system access is enabled in this WebView. If untrusted data is used to specify the URL opened by this WebView, a malicious app or site may be able to read your app's private files, if it returns the response to them. To validate this vulnerability, load the following local file in this WebView: file://<install_dir>/quark/poc/html/FILE_SYS_WARN.html
- While not a vulnerability by itself, it appears this app does not explicitly disable Content Provider access from WebViews. If the WebViews take in untrusted input, this can allow for data theft. To validate this vulnerability, load the following local file in this WebView: file://<install_dir>/quark/poc/html/WV_CPA_WARNING.html
- JavaScript running in a file scheme context can access content from any origin. This is an insecure default value for minSdkVersion < 16 or may have been overridden (setAllowUniversalAccessFromFileURLs) in later versions. To validate this vulnerability, load the following local file in this WebView: file://<install_dir>/quark/poc/html/UNIV_FILE_WARNING.html
- addJavascriptInterface not used in this WebView.
FILE: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/WebFragment.java
- DOM Storage not enabled for this WebView.
FILE: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/WebFragment.java
This is a list of all the findings related to Certificate validation.
File:
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/WebFragment.java
-
Unsafe implementation of onReceivedSslError handler found in: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/WebFragment.java. Specifically, the implementation ignores all SSL certificate validation errors, making your app vulnerable to man-in-the-middle attacks. To properly handle SSL certificate validation, change your code to invoke SslErrorHandler.cancel(). For details, please see: https://developer.android.com/reference/android/webkit/WebViewClient.html
- Unsafe implementation of onReceivedSslError handler found in: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/WebFragment.java. Specifically, the implementation ignores all SSL certificate validation errors, making your app vulnerable to man-in-the-middle attacks. To properly handle SSL certificate validation, change your code to invoke SslErrorHandler.cancel(). For details, please see: https://developer.android.com/reference/android/webkit/WebViewClient.html
This section lists any issues related to File permissions.
This section lists any issues related to pending intents.
File:
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/app/TaskStackBuilder.java
-
Implicit Intent: localIntent used to create instance of PendingIntent. A malicious application could potentially intercept, redirect and/or modify (in a limited manner) this Intent. Pending Intents retain the UID of your application and all related permissions, allowing another application to act as yours. File: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/app/TaskStackBuilder.java More details: https://www.securecoding.cert.org/confluence/display/android/DRD21-J.+Always+pass+explicit+intents+to+a+PendingIntent
- Implicit Intent: localIntent used to create instance of PendingIntent. A malicious application could potentially intercept, redirect and/or modify (in a limited manner) this Intent. Pending Intents retain the UID of your application and all related permissions, allowing another application to act as yours. File: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/app/TaskStackBuilder.java More details: https://www.securecoding.cert.org/confluence/display/android/DRD21-J.+Always+pass+explicit+intents+to+a+PendingIntent
File:
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/measurement/internal/zzai.java
-
Implicit Intent: localIntent2 used to create instance of PendingIntent. A malicious application could potentially intercept, redirect and/or modify (in a limited manner) this Intent. Pending Intents retain the UID of your application and all related permissions, allowing another application to act as yours. File: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/measurement/internal/zzai.java More details: https://www.securecoding.cert.org/confluence/display/android/DRD21-J.+Always+pass+explicit+intents+to+a+PendingIntent
- Implicit Intent: localIntent2 used to create instance of PendingIntent. A malicious application could potentially intercept, redirect and/or modify (in a limited manner) this Intent. Pending Intents retain the UID of your application and all related permissions, allowing another application to act as yours. File: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/measurement/internal/zzai.java More details: https://www.securecoding.cert.org/confluence/display/android/DRD21-J.+Always+pass+explicit+intents+to+a+PendingIntent
File:
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/common/zzc.java
-
Implicit Intent: localIntent used to create instance of PendingIntent. A malicious application could potentially intercept, redirect and/or modify (in a limited manner) this Intent. Pending Intents retain the UID of your application and all related permissions, allowing another application to act as yours. File: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/common/zzc.java More details: https://www.securecoding.cert.org/confluence/display/android/DRD21-J.+Always+pass+explicit+intents+to+a+PendingIntent
- Implicit Intent: localIntent used to create instance of PendingIntent. A malicious application could potentially intercept, redirect and/or modify (in a limited manner) this Intent. Pending Intents retain the UID of your application and all related permissions, allowing another application to act as yours. File: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/common/zzc.java More details: https://www.securecoding.cert.org/confluence/display/android/DRD21-J.+Always+pass+explicit+intents+to+a+PendingIntent
File:
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/messaging/FirebaseMessaging.java
-
Implicit Intent: localIntent used to create instance of PendingIntent. A malicious application could potentially intercept, redirect and/or modify (in a limited manner) this Intent. Pending Intents retain the UID of your application and all related permissions, allowing another application to act as yours. File: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/messaging/FirebaseMessaging.java More details: https://www.securecoding.cert.org/confluence/display/android/DRD21-J.+Always+pass+explicit+intents+to+a+PendingIntent
- Implicit Intent: localIntent used to create instance of PendingIntent. A malicious application could potentially intercept, redirect and/or modify (in a limited manner) this Intent. Pending Intents retain the UID of your application and all related permissions, allowing another application to act as yours. File: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/messaging/FirebaseMessaging.java More details: https://www.securecoding.cert.org/confluence/display/android/DRD21-J.+Always+pass+explicit+intents+to+a+PendingIntent
This section lists any issues related to crypto vulnerabilities in the application
Until we perfect this, for manually testing, run the following command to see all the options and their meanings: adb shell am . Make sure to update qark frequently to get all the enhancements! You'll also find some good examples here: http://xgouchet.fr/android/index.php?article42/launch-intents-using-adb
Until we perfect this, please review these files manually. Due to parsing errors, it is possible that an issue may not have been reported correctly.
This section is related to any operating system related issues. This information was identified from the application's manifest and we encourage you to understand the type of vulnerabilities that live ourside your application's sandbox but may affect your application in some way or the other.
OS Version specific bugs
Plugin content output if any
File:
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/apktool/AndroidManifest.xml
-
User created permission: <permission android:name="com.kbank.otp.permission.MAPS_RECEIVE" android:protectionLevel="signature"/>
-
User created permission: <permission android:name="com.kbank.otp.permission.C2D_MESSAGE" android:protectionLevel="signature"/>
- User created permission: <permission android:name="com.kbank.otp.permission.MAPS_RECEIVE" android:protectionLevel="signature"/>
- User created permission: <permission android:name="com.kbank.otp.permission.C2D_MESSAGE" android:protectionLevel="signature"/>
File:
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/apktool/AndroidManifest.xml
-
<receiver android:enabled="true" android:exported="false" android:name="com.google.android.gms.measurement.AppMeasurementReceiver"/>
<receiver android:exported="true" android:name="com.google.firebase.iid.FirebaseInstanceIdReceiver" android:permission="com.google.android.c2dm.permission.SEND">
-
Use of android:launchMode=singleTask is found
This results in AMS either resuming the earlier activity or loads it in a task with same affinity or the activity is started as a new task. This may result in Task Poisoning.
https://www.usenix.org/system/files/conference/usenixsecurity15/sec15-paper-ren-chuangang.pdf
<activity android:configChanges="locale|layoutDirection" android:label="@string/title_application" android:launchMode="singleTask" android:name="com.kbank.otp.MainActivity" android:screenOrientation="portrait" android:windowSoftInputMode="adjustPan|stateHidden">
-
API Key Found
<?xml version="1.0" ?><manifest android:versionCode="24" android:versionName="4.2.1" package="com.kbank.otp" platformBuildVersionCode="23" platformBuildVersionName="6.0-2704002" xmlns:android="http://schemas.android.com/apk/res/android">
<uses-sdk android:minSdkVersion="9" android:targetSdkVersion="23"/>
<uses-feature android:glEsVersion="0x20000" android:required="true"/>
<uses-permission android:name="com.google.android.c2dm.permission.RECEIVE"/>
<permission android:name="com.kbank.otp.permission.C2D_MESSAGE" android:protectionLevel="signature"/>
<uses-permission android:name="com.kbank.otp.permission.C2D_MESSAGE"/>
<meta-data android:name="com.google.android.maps.v2.API_KEY" android:value="AIzaSyCSzNhgjE648S215MjCk02Oq69MegrIpYs"/>
<activity android:exported="false" android:name="com.google.android.gms.common.api.GoogleApiActivity" android:theme="@android:style/Theme.Translucent.NoTitleBar"/>
<receiver android:exported="true" android:name="com.google.firebase.iid.FirebaseInstanceIdReceiver" android:permission="com.google.android.c2dm.permission.SEND">
<action android:name="com.google.android.c2dm.intent.RECEIVE"/>
<action android:name="com.google.android.c2dm.intent.REGISTRATION"/>
<provider android:authorities="com.kbank.otp.firebaseinitprovider" android:exported="false" android:initOrder="100" android:name="com.google.firebase.provider.FirebaseInitProvider"/>
- <receiver android:enabled="true" android:exported="false" android:name="com.google.android.gms.measurement.AppMeasurementReceiver"/> <receiver android:exported="true" android:name="com.google.firebase.iid.FirebaseInstanceIdReceiver" android:permission="com.google.android.c2dm.permission.SEND">
- Use of android:launchMode=singleTask is found This results in AMS either resuming the earlier activity or loads it in a task with same affinity or the activity is started as a new task. This may result in Task Poisoning. https://www.usenix.org/system/files/conference/usenixsecurity15/sec15-paper-ren-chuangang.pdf <activity android:configChanges="locale|layoutDirection" android:label="@string/title_application" android:launchMode="singleTask" android:name="com.kbank.otp.MainActivity" android:screenOrientation="portrait" android:windowSoftInputMode="adjustPan|stateHidden">
- API Key Found <?xml version="1.0" ?><manifest android:versionCode="24" android:versionName="4.2.1" package="com.kbank.otp" platformBuildVersionCode="23" platformBuildVersionName="6.0-2704002" xmlns:android="http://schemas.android.com/apk/res/android"> <uses-sdk android:minSdkVersion="9" android:targetSdkVersion="23"/> <uses-feature android:glEsVersion="0x20000" android:required="true"/> <uses-permission android:name="com.google.android.c2dm.permission.RECEIVE"/> <permission android:name="com.kbank.otp.permission.C2D_MESSAGE" android:protectionLevel="signature"/> <uses-permission android:name="com.kbank.otp.permission.C2D_MESSAGE"/> <meta-data android:name="com.google.android.maps.v2.API_KEY" android:value="AIzaSyCSzNhgjE648S215MjCk02Oq69MegrIpYs"/> <activity android:exported="false" android:name="com.google.android.gms.common.api.GoogleApiActivity" android:theme="@android:style/Theme.Translucent.NoTitleBar"/> <receiver android:exported="true" android:name="com.google.firebase.iid.FirebaseInstanceIdReceiver" android:permission="com.google.android.c2dm.permission.SEND"> <action android:name="com.google.android.c2dm.intent.RECEIVE"/> <action android:name="com.google.android.c2dm.intent.REGISTRATION"/> <provider android:authorities="com.kbank.otp.firebaseinitprovider" android:exported="false" android:initOrder="100" android:name="com.google.firebase.provider.FirebaseInitProvider"/>
File:
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/app/NotificationCompatSideChannelService.java
-
Be careful with use of Check permission function
App maybe vulnerable to Privilege escalation or Confused Deputy Attack. This function can grant access to malicious application, lacking the appropriate permission, by assuming your applications permissions. This means a malicious application, without appropriate permissions, can bypass its permission check by using your applicationpermission to get access to otherwise denied resources. Use - checkCallingPermission instead.
Filepath: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/app/NotificationCompatSideChannelService.java
Reference: https://developer.android.com/reference/android/content/Context.html#checkCallingOrSelfPermission(java.lang.String)
- Be careful with use of Check permission function App maybe vulnerable to Privilege escalation or Confused Deputy Attack. This function can grant access to malicious application, lacking the appropriate permission, by assuming your applications permissions. This means a malicious application, without appropriate permissions, can bypass its permission check by using your applicationpermission to get access to otherwise denied resources. Use - checkCallingPermission instead. Filepath: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/app/NotificationCompatSideChannelService.java Reference: https://developer.android.com/reference/android/content/Context.html#checkCallingOrSelfPermission(java.lang.String)
File:
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/iid/zzf.java
-
Be careful with use of Check permission function
App maybe vulnerable to Privilege escalation or Confused Deputy Attack. This function can grant access to malicious application, lacking the appropriate permission, by assuming your applications permissions. This means a malicious application, without appropriate permissions, can bypass its permission check by using your applicationpermission to get access to otherwise denied resources. Use - checkCallingPermission instead.
Filepath: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/iid/zzf.java
Reference: https://developer.android.com/reference/android/content/Context.html#checkCallingOrSelfPermission(java.lang.String)
- Be careful with use of Check permission function App maybe vulnerable to Privilege escalation or Confused Deputy Attack. This function can grant access to malicious application, lacking the appropriate permission, by assuming your applications permissions. This means a malicious application, without appropriate permissions, can bypass its permission check by using your applicationpermission to get access to otherwise denied resources. Use - checkCallingPermission instead. Filepath: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/iid/zzf.java Reference: https://developer.android.com/reference/android/content/Context.html#checkCallingOrSelfPermission(java.lang.String)
File:
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/iid/FirebaseInstanceIdInternalReceiver.java
-
Be careful with use of Check permission function
App maybe vulnerable to Privilege escalation or Confused Deputy Attack. This function can grant access to malicious application, lacking the appropriate permission, by assuming your applications permissions. This means a malicious application, without appropriate permissions, can bypass its permission check by using your applicationpermission to get access to otherwise denied resources. Use - checkCallingPermission instead.
Filepath: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/iid/FirebaseInstanceIdInternalReceiver.java
Reference: https://developer.android.com/reference/android/content/Context.html#checkCallingOrSelfPermission(java.lang.String)
- Be careful with use of Check permission function App maybe vulnerable to Privilege escalation or Confused Deputy Attack. This function can grant access to malicious application, lacking the appropriate permission, by assuming your applications permissions. This means a malicious application, without appropriate permissions, can bypass its permission check by using your applicationpermission to get access to otherwise denied resources. Use - checkCallingPermission instead. Filepath: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/iid/FirebaseInstanceIdInternalReceiver.java Reference: https://developer.android.com/reference/android/content/Context.html#checkCallingOrSelfPermission(java.lang.String)
File:
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/MoneyTransferActivity.java
-
Application contains hardcoded http url
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/MoneyTransferActivity.java.
http://localhost
Ignore if HSTS is implemented
- Application contains hardcoded http url /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/MoneyTransferActivity.java. http://localhost Ignore if HSTS is implemented
File:
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/org/jraf/android/backport/switchwidget/TwoStatePreference.java
-
Reading files stored on External Storage makes it vulnerable to data injection attacks
Note that this code does no error checking and there is no security enforced with these files.
For example, any application holding WRITE_EXTERNAL_STORAGE can write to these files.
Filepath: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/content/ContextCompatKitKat.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/content/ContextCompatFroyo.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/content/ContextCompat.java
Reference: https://developer.android.com/reference/android/content/Context.html#getExternalFilesDir(java.lang.String)
-
Reading files stored on External Storage Public Directory makes it vulnerable to data injection attacks
Note that this code does no error checking and there is no security enforced with these files.
For example, any application holding WRITE_EXTERNAL_STORAGE can write to these files.
Filepath: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/WebFragment.java
Reference: https://developer.android.com/reference/android/content/Context.html#getExternalStoragePublicDirectory(java.lang.String)
- Reading files stored on External Storage makes it vulnerable to data injection attacks Note that this code does no error checking and there is no security enforced with these files. For example, any application holding WRITE_EXTERNAL_STORAGE can write to these files. Filepath: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/content/ContextCompatKitKat.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/content/ContextCompatFroyo.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/content/ContextCompat.java Reference: https://developer.android.com/reference/android/content/Context.html#getExternalFilesDir(java.lang.String)
- Reading files stored on External Storage Public Directory makes it vulnerable to data injection attacks Note that this code does no error checking and there is no security enforced with these files. For example, any application holding WRITE_EXTERNAL_STORAGE can write to these files. Filepath: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/WebFragment.java Reference: https://developer.android.com/reference/android/content/Context.html#getExternalStoragePublicDirectory(java.lang.String)
File:
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/org/jraf/android/backport/switchwidget/TwoStatePreference.java
-
File System Access is by default enabled
setAllowFileAccess() and setAllowContentAccess() are by default true. This should be set to false to restrict access to local data since it is used to display content from locally stored HTML or fetch HTML and other content from the server.
Reference: https://developer.android.com/reference/android/webkit/WebSettings.html
Filepath: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/MoneyTransferActivity.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/WebFragment.java
- File System Access is by default enabled setAllowFileAccess() and setAllowContentAccess() are by default true. This should be set to false to restrict access to local data since it is used to display content from locally stored HTML or fetch HTML and other content from the server. Reference: https://developer.android.com/reference/android/webkit/WebSettings.html Filepath: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/MoneyTransferActivity.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/WebFragment.java
File:
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/org/jraf/android/backport/switchwidget/TwoStatePreference.java
-
Debug logs are detected
This may allow potential leakage of information from Android applications.
Debug logs should never be compiled into an application except during development.
https://developer.android.com/reference/android/util/Log.html
Filepath:
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/util/LogWriter.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/app/NotificationManagerCompat.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/media/MediaBrowserServiceCompat.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/media/MediaBrowserCompat.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/widget/TextViewCompatDonut.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/view/ViewCompat.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v7/app/AppCompatDelegateImplV14.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v7/app/AppCompatDelegate.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v7/app/TwilightManager.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v7/widget/ViewUtils.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v7/widget/AppCompatPopupWindow.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v7/widget/AppCompatDrawableManager.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/MoneyTransferActivity.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/TheApplication.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/TransactionsFragment_.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/MainActivity.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/services/FirebaseMessagingService.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/services/FirebaseInstanceIDService.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/services/FirebaseTokenService.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/atm/AtmFragment.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/internal/zzs.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/internal/zzqm.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/common/zzd.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/common/util/zzx.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/common/internal/zzo.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/FirebaseApp.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/iid/zzg.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/iid/zzf.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/iid/FirebaseInstanceIdService.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/iid/FirebaseInstanceIdInternalReceiver.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/iid/FirebaseInstanceIdReceiver.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/messaging/zzb.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/messaging/FirebaseMessagingService.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/messaging/zza.java
34 debug logs were found in the application
-
Verbose logs are detected
This may allow potential leakage of information from Android applications.
Verbose logs should never be compiled into an application except during development.
https://developer.android.com/reference/android/util/Log.html
Filepath:
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/app/FragmentState.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/app/LoaderManagerImpl.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/app/BackStackRecord.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/app/FragmentManagerImpl.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/app/BackStackState.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/content/LocalBroadcastManager.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/graphics/drawable/VectorDrawableCompat.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/internal/zzsu.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/internal/zzs.java
9 verbose logs were found in the application
- Debug logs are detected This may allow potential leakage of information from Android applications. Debug logs should never be compiled into an application except during development. https://developer.android.com/reference/android/util/Log.html Filepath: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/util/LogWriter.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/app/NotificationManagerCompat.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/media/MediaBrowserServiceCompat.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/media/MediaBrowserCompat.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/widget/TextViewCompatDonut.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/view/ViewCompat.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v7/app/AppCompatDelegateImplV14.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v7/app/AppCompatDelegate.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v7/app/TwilightManager.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v7/widget/ViewUtils.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v7/widget/AppCompatPopupWindow.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v7/widget/AppCompatDrawableManager.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/MoneyTransferActivity.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/TheApplication.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/TransactionsFragment_.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/MainActivity.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/services/FirebaseMessagingService.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/services/FirebaseInstanceIDService.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/services/FirebaseTokenService.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/atm/AtmFragment.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/internal/zzs.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/internal/zzqm.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/common/zzd.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/common/util/zzx.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/common/internal/zzo.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/FirebaseApp.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/iid/zzg.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/iid/zzf.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/iid/FirebaseInstanceIdService.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/iid/FirebaseInstanceIdInternalReceiver.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/iid/FirebaseInstanceIdReceiver.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/messaging/zzb.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/messaging/FirebaseMessagingService.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/messaging/zza.java 34 debug logs were found in the application
- Verbose logs are detected This may allow potential leakage of information from Android applications. Verbose logs should never be compiled into an application except during development. https://developer.android.com/reference/android/util/Log.html Filepath: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/app/FragmentState.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/app/LoaderManagerImpl.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/app/BackStackRecord.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/app/FragmentManagerImpl.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/app/BackStackState.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/content/LocalBroadcastManager.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/graphics/drawable/VectorDrawableCompat.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/internal/zzsu.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/internal/zzs.java 9 verbose logs were found in the application
File:
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/tasks/Tasks.java
-
The Content provider API provides a method call
The framework does no permission checking on this entry into the content provider besides the basic ability for the application to get access to the provider at all. Any implementation of this method must do its own permission checks on incoming calls to make sure they are allowed.Failure to do so will allow unauthorized components to interact with the content provider.
Filepath: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/tasks/Tasks.java
Reference: https://bitbucket.org/secure-it-i/android-app-vulnerability-benchmarks/src/d5305b9481df3502e60e98fa352d5f58e4a69044/ICC/WeakChecksOnDynamicInvocation-InformationExposure/?at=master
-
The Content provider API provides a method call
The framework does no permission checking on this entry into the content provider besides the basic ability for the application to get access to the provider at all. Any implementation of this method must do its own permission checks on incoming calls to make sure they are allowed.Failure to do so will allow unauthorized components to interact with the content provider.
Filepath: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/tasks/Tasks.java
Reference: https://bitbucket.org/secure-it-i/android-app-vulnerability-benchmarks/src/d5305b9481df3502e60e98fa352d5f58e4a69044/ICC/WeakChecksOnDynamicInvocation-InformationExposure/?at=master
- The Content provider API provides a method call The framework does no permission checking on this entry into the content provider besides the basic ability for the application to get access to the provider at all. Any implementation of this method must do its own permission checks on incoming calls to make sure they are allowed.Failure to do so will allow unauthorized components to interact with the content provider. Filepath: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/tasks/Tasks.java Reference: https://bitbucket.org/secure-it-i/android-app-vulnerability-benchmarks/src/d5305b9481df3502e60e98fa352d5f58e4a69044/ICC/WeakChecksOnDynamicInvocation-InformationExposure/?at=master
- The Content provider API provides a method call The framework does no permission checking on this entry into the content provider besides the basic ability for the application to get access to the provider at all. Any implementation of this method must do its own permission checks on incoming calls to make sure they are allowed.Failure to do so will allow unauthorized components to interact with the content provider. Filepath: /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/tasks/Tasks.java Reference: https://bitbucket.org/secure-it-i/android-app-vulnerability-benchmarks/src/d5305b9481df3502e60e98fa352d5f58e4a69044/ICC/WeakChecksOnDynamicInvocation-InformationExposure/?at=master
File:
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/org/jraf/android/backport/switchwidget/TwoStatePreference.java
-
Application dynamically registers a broadcast receiver
Application that register a broadcast receiver dynamically is vulnerable to granting unrestricted access to the broadcast receiver.
The receiver will be called with any broadcast Intent that matches filter.
https://developer.android.com/reference/android/content/Context.html#registerReceiver(android.content.BroadcastReceiver, android.content.IntentFilter)
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/media/TransportMediatorJellybeanMR2.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/WebFragment.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/measurement/internal/zzs.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/internal/zzrj.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/common/GoogleApiAvailability.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/common/util/zzj.java
/home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/iid/FirebaseInstanceIdService.java
- Application dynamically registers a broadcast receiver Application that register a broadcast receiver dynamically is vulnerable to granting unrestricted access to the broadcast receiver. The receiver will be called with any broadcast Intent that matches filter. https://developer.android.com/reference/android/content/Context.html#registerReceiver(android.content.BroadcastReceiver, android.content.IntentFilter) /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/android/support/v4/media/TransportMediatorJellybeanMR2.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/kbank/otp/WebFragment.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/measurement/internal/zzs.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/internal/zzrj.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/common/GoogleApiAvailability.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/android/gms/common/util/zzj.java /home/miki/Documents/GITHUB/AndroidPermissions/apks/banking_set2_qark/com.kbank.otp/classes_dex2jar/com/google/firebase/iid/FirebaseInstanceIdService.java
This is a list of resources you may refer to understand more about android security in general and also how specific programming mistakes or insecure-by-default settings may manifest themselves into vulnerabilities. We are currently hand picking credible resources to add to the list. Please check for updates to get a revised list of references.
List of resources
-
For general Android security information: http://developer.android.com/training/articles/security-tips.html
- For information on proper TLS implementation: http://developer.android.com/training/articles/security-ssl.html
- A great guide to Android security, from the Japanese Smartphone Security Association: https://www.jssec.org/report/android_securecoding_en_20140801.html
QUICK ANDROID REVIEW KIT
Version 0.9Source:
Github:
https://www.github.com/linkedin/qark
Authors:
Anthony Trummer: https://www.linkedin.com/in/tonytrummerTushar Dalvi: https://www.linkedin.com/in/tdalvi
QARK Version 0.9


Host not allowed!
Missing device token! Register your device!
Invalid device token! Update your device registration!
Expired device registration code!
Invalid user id! Update your device registration!
Invalid registration code!
Invalid access code!
No connection to the security system!
Something went wrong!?


1 Register your business or organization
2 Create a Business BCeID
- Your business/organization will need a Business BCeID to log in.
- Your business/organization can have only one Business BCeID, but you should create separate accounts for each person using it.
3Find a location for your store
- Contact the local government or First Nation to make sure they are accepting applications for cannabis stores in their community.
- Ask about the local requirements for zoning, bylaws and business licences.
- You must own, lease, or have an agreement to lease the location.
Stores in rural areas have different location requirements.
4Submit your application
Your application requires:
You must apply for a separate licence for each store.
5 Get local government approval
- Your application must be approved by the local government or First Nation before you can be licensed. Ask them about any local approvals or zoning requirements.
- Local governments must hold a public consultation for the area around your store.
- First Nations may follow the local government approval process, or one of their own.
6 Receive conditional approval
If your application meets local and provincial requirements, you will get conditional approval from the province. Conditional approval means you will receive your licence after passing a final inspection.
Now you can:
- Secure ownership or a lease of your store.
- Make sure you meet the terms and conditions (e.g. hours of operations) of your licence.
- Make changes to your store to match the description you submitted in your application, including:
- Floor plan
- Exterior signage
- Window covering
7 Pass a store inspection
- The inspection ensures your store meets provincial regulation.
- You can schedule an inspection when you are ready.
You cannot have any cannabis in your store at the time of the inspection.
8 Receive your licence
- You will receive your licence after passing your inspection and paying a first-year licensing fee.


Subjects: {{ education.subjects | array_to_sentence_string: 'and' }}
{% endif %} {% if education.honors_awards %}Honors & Awards: {{ education.honors_awards | array_to_sentence_string: 'and' }}
{% endif %} {% if education.activities %}Activities: {{ education.activities | array_to_sentence_string: 'and' }}
{% endif %}


We will use the provided information on the next billing cycle, starting on {{ vm.resolve.contractInfo.NextBillingDate | absoluteDateTimeFormat: 'll' }}.
{{ vm.resolve.errorData.errorMessage | translate }}
Retry or reach us if you're not able to upgrade.


Super Platform Engine Development Funtime!
Player
x:
y:
v:
f:
fps:
Missed Platforms:
Collision Debug:
Collision Index:
Score:
AI Platform:
AI Speed:


STAC Python Library
Through this library you can verify the results obtained from the learning algorithms applying the statistic tests to the experiments, which, among other uses, support the decision making process (the election of the most suitable algorithm, for example).
Normality tests
| shapiro(x[, a, reta]) |
Perform the Shapiro-Wilk test for normality. |
| normaltest(a[, axis]) |
Tests whether a sample differs from a normal distribution. |
| kstest(rvs, cdf[, args, N, alternative, mode]) |
Perform the Kolmogorov-Smirnov test for goodness of fit. |
Homoscedasticity tests
| levene(*args, **kwds) |
Perform Levene test for equal variances. |
Parametric two group comparison tests
| ttest_ind(a, b[, axis, equal_var]) |
Calculates the T-test for the means of TWO INDEPENDENT samples of scores. |
| ttest_rel(a, b[, axis]) |
Calculates the T-test on TWO RELATED samples of scores, a and b. |
Non-parametric two group comparison tests
| wilcoxon(x[, y, zero_method, correction]) |
Calculate the Wilcoxon signed-rank test. |
| mannwhitneyu(x, y[, use_continuity]) |
Computes the Mann-Whitney rank test on samples x and y. |
Parametric multiple comparison tests
Post-hoc tests
| bonferroni_test(pivots, n) |
Performs a Bonferroni-Dunn post-hoc test using the pivot quantities obtained by an ANOVA test. |
Non-Parametric multiple comparison tests
Post-hoc 1 vs all tests
| bonferroni_dunn_test(ranks[, control]) |
Performs a Bonferroni-Dunn post-hoc test using the pivot quantities obtained by a ranking test. |
| holm_test(ranks[, control]) |
Performs a Holm post-hoc test using the pivot quantities obtained by a ranking test. |
| finner_test(ranks[, control]) |
Performs a Finner post-hoc test using the pivot quantities obtained by a ranking test. |
| hochberg_test(ranks[, control]) |
Performs a Hochberg post-hoc test using the pivot quantities obtained by a ranking test. |
| li_test(ranks[, control]) |
Performs a Li post-hoc test using the pivot quantities obtained by a ranking test. |
Post-hoc all vs all tests
| nemenyi_multitest(ranks) |
Performs a Nemenyi post-hoc test using the pivot quantities obtained by a ranking test. |
| holm_multitest(ranks) |
Performs a Holm post-hoc test using the pivot quantities obtained by a ranking test. |
| finner_multitest(ranks) |
Performs a Finner post-hoc test using the pivot quantities obtained by a ranking test. |
| hochberg_multitest(ranks) |
Performs a Hochberg post-hoc test using the pivot quantities obtained by a ranking test. |
| shaffer_multitest(ranks) |
Performs a Shaffer post-hoc test using the pivot quantities obtained by a ranking test. |


Cards require a small amount of markup and classes to provide you with as much control as possible. These classes
and markup are flexible though and can typically be remixed and extended with ease. For example, if your
card has no flush content like images, feel free to put the .card-block
class on the .card
element to consolidate your markup.
Icing powder caramels macaroon. Toffee sugar plum brownie pastry gummies jelly.
Go somewhereSweet halvah dragée jelly-o halvah carrot cake oat cake. Donut jujubes jelly chocolate cake.
Go somewhereCards with horizontal image.
Overlap Image Cards
Donut toffee candy brownie soufflé macaroon.
Donut toffee candy brownie soufflé macaroon.
Donut toffee candy brownie soufflé macaroon.
Weekly weather cards.
Cards include their own variant classes for quickly changing the background-color
and border-color
of a card. Darker colors require the use of .card-inverse
.
Cards include a class for quickly
toggling the text color. By default, cards use dark text and assume a light background. Add .card-inverse
for white text and specify the background-color
and border-color
to go with it.
You can also use .card-inverse
with the contextual backgrounds variants.
Donut toffee candy brownie soufflé macaroon.
456 items
Donut toffee candy brownie soufflé macaroon.
Donut toffee candy brownie soufflé macaroon.
945 items
Donut toffee candy brownie soufflé macaroon.
In need of a colored card, but not the hefty background colors they bring? Replace the default modifier classes
with the .card-outline-*
ones to style just the border-color
of a card.
Donut toffee candy brownie soufflé macaroon.
456 items
Donut toffee candy brownie soufflé macaroon.
Donut toffee candy brownie soufflé macaroon.
945 items
Donut toffee candy brownie soufflé macaroon.
Use card groups to render cards as a single, attached element with equal width and height columns. By default,
card groups use display: table;
and table-layout: fixed;
to achieve their uniform
sizing. However, enabling flexbox mode can switch that to use display: flex;
and provide the
same effect.
This card has supporting text below as a natural lead-in to additional content.
Last updated 3 mins ago
This card has supporting text below as a natural lead-in to additional content.
Last updated 3 mins ago
This card has supporting text below as a natural lead-in to additional content.
Last updated 3 mins ago
This card has supporting text below as a natural lead-in to additional content.
Last updated 3 mins ago
Need a set of equal width and height cards that aren’t attached to one another? Use card decks. By default, card
decks require two wrapping elements: .card-deck-wrapper
and a .card-deck
. We use
table styles for the sizing and the gutters on .card-deck
. The .card-deck-wrapper
is used to negative margin out the border-spacing
on the .card-deck
.
This card has supporting text below as a natural lead-in to additional content.
Last updated 3 mins ago
This card has supporting text below as a natural lead-in to additional content.
Last updated 3 mins ago
This card has supporting text below as a natural lead-in to additional content.
Last updated 3 mins ago
This card has supporting text below as a natural lead-in to additional content.
Last updated 3 mins ago
Cards can be organized into Masonry-like columns with just CSS by wrapping them in .card-columns
.
Only applies to small devices and above.
Heads up! This is not available in IE9 and below as they have no support
for the column-* CSS properties.
Some quick example text to build on the card title and make up the bulk of the card's content.
Go somewhereDonut toffee candy brownie soufflé macaroon.
945 items
456 items
Jelly-o sesame snaps cheesecake topping. Cupcake fruitcake macaroon donut pastry gummies tiramisu chocolate bar muffin. Dessert bonbon caramels brownie chocolate bar chocolate tart dragée.
Cupcake fruitcake macaroon donut pastry gummies tiramisu chocolate bar muffin.
Last updated 3 mins ago
Donut toffee candy brownie soufflé macaroon.


RT @bcrypt: fascinating list of things that are accidentally Turing-Complete: http://beza1e1.tuxen.de/articles/accidentally_turing_complete.html
3/24/2014, 8:48:10 PM
Favs: 0
Retweets: 0
link--- layout: tweet ---
RT @bcrypt: fascinating list of things that are accidentally Turing-Complete: http://beza1e1.tuxen.de/articles/accidentally_turing_complete.html
3/24/2014, 8:48:10 PM
Favs: 0
Retweets: 0
link


Hi guys I visited France and saw lots of things like Eiffel Tower:
Sacre Coeur:
Disneyland:
and many more!


Home > JavaScript Questions > What is the difference between == and ===?
The == operator checks equality only whereas === checks equality, and data type, i.e., a value must be of the same type.
Example..Strict equality (===) means values which we are comparing must have the same type.
This means "2" will not be equal to 2 ("2"===2 it will return false)
Type converting equality (==) means automatically it will covert the variable to value irrespective of data type; either it is a string or a number.
This means "2" will be equal to 2 ("2" == 2 it will return true).


Now with Bookmark Exchange!
BrainTool saves all your links and notes in a plain text file that is stored on your Google Drive. You need to grant it permission to read and write this file. There are no BT servers and nothing is stored anywhere except within the file, named BrainTool.org, which is fully under your control. For details see the privacy policy
Look here for quick tips or see our website for more information.
NB The initial tree shows some examples of how to use tags. Feel free to build on it or delete anything you don't want by hovering over the row and hitting the trash button.
*BrainTool is still new and evolving. Please leave a positive review or send constructive criticism to<EMAIL_ADDRESS>Thank You!
| Options | |
|
| |
| Other options coming soon | |
| Font Size: | |
| Window size/position: | |
| New items: | On Top | On Bottom |
| Navigation away: | New Tab | Same Tab |
| More info here. Email<EMAIL_ADDRESS>with input |
Authenticating with Google
and loading your BrainTool file
...


|
Anchors
Basic metacharacters
Character classes
Comments
Control and code
Grouping
Look around
Mode modifiers
Quantifiers
Specific characters
|
Anchors are used to tie (part of) an expression to a certain position.
| |
Item
|
|
Matches at:
|
|
| |
^
|
|
Start of a string. If used in multiline mode also matches beginning of each line, (i.e. after a newline).
|
|
| |
$
|
|
End of a string. If used in multiline mode also matches end of each line, (i.e. before a newline).
|
|
| |
\A
|
|
Start of a string.
|
|
| |
\b
|
|
Word boundary.
This is the position between an \W and \w or between \w and \W . (In a character class \b represents a backspace.)
|
|
| |
\B
|
|
Any position that is not a word boundary.
|
|
| |
\z
|
|
End of string.
|
|
|
\Z
|
|
End of string if the string does not end with a newline. If it ends with a newline \Z matches just before that.
|
|
|


It's important that our school focuses on fulfiling these objectives.
See our chinese school objectives
Our school site is fully equipped with perfect location...
Read More
The school invites suitably educated Christians to be volunteer teachers.


{% extends "overseer/base.html" %} {% load overseer_helpers %} {% block content %}
The subscription token for your request is not valid. Maybe you already confirmed your subscription?


How to call Lane
Click on the phone below
Enter your phone number
Click the "Connect" button
When you do this, your phone will ring, then my phone will ring, and then we'll be connected.


new Renderable()
- Source:
Methods
Draw()
Draw Virtual Method
- Source:
GetHeight()
Get Height
- Source:
GetOpacity() → {Number}
Get Opacity
- Source:
Returns:
Get Renderable Opacity
- Type
- Number
GetWidth()
Get Width
- Source:
IsClickable()
Set Clickable
- Source:
IsOnCamera()
Is On Camera
- Source:
IsVisible() → {Boolean}
Is Visible
- Source:
Returns:
Returns Visibility of the Renderable
- Type
- Boolean
OnClick()
On Click
- Source:
OnMouseOut()
On Mouse Out
- Source:
OnMouseOver()
On Mouse Over
- Source:
OnUpdate()
On Update Callback
- Source:
SetOnCamera()
Set On Camera
- Source:
SetOpacity()
Set Opacity
- Source:
SetShape()
Set Shape
- Source:
SetVisible()
Set Visible
- Source:
Update()
Update
- Source:


FLEX
HTML & CSS
ONLY
Home
CSS Grid
Flex/Media
Bootstrap
Traditional
CSS Flex
Documentation
Froggy!
Learn Flexbox Fun Way!
Can I USE?
Can you?
Complete Guide to Flexbox
Guide on all things flex
Icon. Visionary. Designer.
Jen Simmons


The Crime Writers’ Association Dagger in the Library longlist was announced this week. This prize is unusual in two ways. Firstly, rather than being for individual books, this prestigious award goes to an author with a worthy body of work. Secondly, unlike other crime writing awards, the longlist is nominated solely by library staff.
Further to this, reading groups will have a strong influence in who the eventual winner is, which will be announced on June 17 2017. If your reading group would like to get involved, please visit the Reading Groups for Everyone website.
The following titles have been selected by their respective authors as the ones they would most recommend for reading groups. However, as mentioned above, the prize recognises authors’ entire outputs, so you could search our catalogue for the authors’ names instead.
The Backs, by Alison Bruce
“Jane Osborne left Cambridge and vowed she’d never return. An unexpected twist of fortune results in DC Goodhew bringing her back to the remnants of her old life and a confrontation with the man who killed her sister. Meanwhile a burning car on the outskirts of Cambridge leads to the discovery of the body of its owner, Paul Marshall.”
Alison Bruce visited us for Suffolk Libraries Bookfest last year and recently paid us a return visit.
The Ashes of London, by Andrew Taylor
“London, September 1666. The Great Fire rages through the city, consuming everything in its path. Even the impregnable cathedral of St. Paul’s is engulfed in flames and reduced to ruins.
“Among the crowds watching its destruction is James Marwood, son of a disgraced printer, and reluctant government informer. In the aftermath of the fire, a semi-mummified body is discovered in the ashes of St. Paul’s, in a tomb that should have been empty. The man’s body has been mutilated and his thumbs have been tied behind his back. Under orders from the government, Marwood is tasked with hunting down the killer across the devastated city.
“But at a time of dangerous internal dissent and the threat of foreign invasion, Marwood finds his investigation leads him into treacherous waters - and across the path of a determined, beautiful and vengeful young woman.”
Little Girl Lost, by Brian McGilloway
“During a winter blizzard a small girl is found wandering half-naked at the edge of an ancient woodland. Her hands are covered in blood, but it is not her own. Unwilling or unable to speak, the only person she seems to trust is the young officer who rescued her, Detective Sergeant Lucy Black.”
Dark Tides, by Chris Ewan
“When Claire Cooper was eight years old her mother mysteriously vanished during Hop-tu-naa, the Manx Halloween. At 14, Claire is still struggling to come to terms with her disappearance when she’s befriended by a group of five teenagers who mark every Hop-tu-naa by performing dares. But Claire’s arrival begins to alter the group’s dynamic until one year a prank goes terribly wrong, changing all their futures and tearing the friends apart.
“Six years later, one of the friends is killed on Hop-tu-naa in an apparent accident. But Claire, now a police officer, has her doubts. Is a single footprint found near the body a deliberate taunt?”
Dominion, by C. J. Sansom
“1952. Twelve years have passed since Churchill lost to the appeasers and Britain surrendered to Nazi Germany after Dunkirk. As the long German war against Russia rages on in the east, the British people find themselves under dark authoritarian rule: the press, radio and television are controlled; the streets patrolled by violent auxiliary police and British Jews face ever greater constraints. There are terrible rumours too about what is happening in the basement of the German Embassy at Senate House.
“Defiance, though, is growing. In Britain, Winston Churchill’s Resistance organization is increasingly a thorn in the government’s side. And in a Birmingham mental hospital an incarcerated scientist, Frank Muncaster, may hold a secret that could change the balance of the world struggle for ever.
“Civil Servant David Fitzgerald, secretly acting as a spy for the Resistance, is given the mission to rescue his old friend Frank and get him out of the country. Before long he, together with a disparate group of Resistance activists, will find themselves fugitives in the midst of London’s Great Smog, as David’s wife Sarah finds herself drawn into a world more terrifying than she ever could have imagined. And hard on their heels is Gestapo Sturmbannfuhrer Gunther Hoth, brilliant, implacable hunter of men…”
Written in Bones, by James Oswald
“When a body is found in a tree in The Meadows, Edinburgh’s scenic parkland, the forensics suggest the corpse has fallen from a great height. Detective Inspector Tony McLean wonders whether it was an accident, or a murder designed to send a chilling message?”
The Death Season, by Kate Ellis
“When DI Wesley Peterson is summoned to investigate a killing, he assumes that the case is a routine matter. But soon dark secrets and deadly deceptions start to emerge from the victim’s past, and Wesley begins to realise that a simple incident of cold-blooded murder is altogether more calculated and complicated that he could ever imagine.
“Meanwhile, archaeologist Neil Watson is pulled from the historic Paradise Court to a ruined village from the First World War. Even with the help of the attractive and enigmatic Lucy, Neil cannot shake the feeling that something is missing from his explorations: a cryptic clue that might have been lost when Sandrock tumbled into the sea many years ago. A clue that could help Wesley solve his most puzzling case to date.”
The Silent Room, by Mari Hannah
“A security van sets off for Durham prison, a disgraced Special Branch officer in the back. It never arrives. En route it is hijacked by armed men, the prisoner sprung. Suspended from duty on suspicion of aiding and abetting the audacious escape of his former boss, Detective Sergeant Matthew Ryan is locked out of the investigation.
“With a manhunt underway, Ryan is warned to stay away. Keen to preserve his career and prove his innocence, he backs off. But when the official investigation falls apart, under surveillance and with his life in danger, he goes dark, enlisting others in his quest to discover the truth.”
The Death of Lucy Kyte, by Nicola Upson
“When bestselling crime author Josephine Tey inherited a remote Suffolk cottage from her godmother, it came full of secrets. There were the infamous Red Barn murders, committed in the grounds a century before, and still casting a shadow over the village. And there was Lucy Kyte, the mysterious beneficiary of her godmother’s will, who no-one in the close-knit village would admit to knowing.
“As Josephine settles into the strange little house and attempts to make friends with the frightened locals, she knows that there is something dark that has a tight hold on the heart of this small community. Is it just the sinister ghosts of the Red Barn murders, or is there something very much alive that she needs to beware of?”
Faithful Place, by Tana French
“The photo shows a boy who was murdered a year ago. The caption says, ‘I KNOW WHO KILLED HIM’.
“Detective Stephen Moran hasn’t seen Holly Mackey since she was a 9-year-old witness to the events of Faithful Place. Now she’s 16 and she’s shown up outside his squad room, with a photograph and a story. Even in her exclusive boarding school, in the graceful golden world that Stephen has always longed for, bad things happen and people have secrets. The previous year, Christopher Harper, from the neighbouring boys’ school, was found murdered on the grounds. And today, in the Secret Place - the school noticeboard where girls can pin up their secrets anonymously - Holly found the card.”


2010 calendar - {{ event_count_2010 }} races remaining
2011 calendar - {{ event_count_2011 }} races entered
{% if event_count_2012 %}
2012 calendar - {{ event_count_2012 }} races entered
{% endif %}
Next tri date: {{ next_event.start_date|date:"j M Y" }} ({{ next_event_wait }} days to go...)
Recently added
{% for e in last_added %}
{% endfor %}
{{ e.name }} {{ e.start_date|date:"j F Y" }}


{% extends "base.html" %} {% block "titlesuffix" %}404{% endblock %} {% block "content" %} Not sure what you were looking for, but I couldn't find it... Maybe go back home? {% endblock %}


Free Online Classifieds Ads in India - Next step to Classifieds Advertisement
Search Classifieds to get better deals in your locality.
Buy, sell anything instantly by posting an online classifieds ads on this platform. Click "Post Free Ads" to post a classified ad and get instant replies from buyers & sellers.
Classified Categories
- Services
- Advertising
- Astrologer
- Print & Designing
- Baby sitter - Nanny
- Hotels - Resorts - Spa
- Airline - Bus - Train Tickets
- Business Proposals
- Car Rental - Taxi
- Catering - Tiffin Facilities
- Computer - Website Services
- Mobile Services
- Courier Services
- Restaurants - Food Services
- Lawyer
- Travel Agents
- Placements - Recruitment Services
- Event Management - DJ
- Investment - Insurance - Financial Services
- Security Services
- Health - Beauty - Fitness
- Audit Services
- Moving & Packing
- Repairing
- Labor Services
- Other Services


Forms Authentication is ASP.net is simple but the FormsIdentity and GenericPrincipal/RolePrincipal are a little too simple. All we get are IIdentity.Name and IPrincipal.IsInRole(x)
Most real applications need a bit more, like the user's full name or email address, or domain-specific data.
Custom Principal
The usual way to do this was to create a custom principal, the UserData field in the forms authentication cookie, and the asp.net pipeline event "PostAuthenticateRequest".
Here's our custom principal:
public class UserPrincipal : GenericPrincipal { public UserPrincipal(IIdentity identity, string[] roles) : base(identity, roles) { } public string Email { get; set; } }
Here's the login action. Instead of the normal FormsAuthentication.SetAuthCookie, we do it manually (see below):
[AllowAnonymous] [HttpPost] public ActionResult Login(LoginModel model, string returnUrl) { if (ModelState.IsValid) //Required, string length etc { var userStore = new UserRepository(); var user = userStore.FindUser(model.UserName, model.Password); if (user != null) { //FormsAuthentication.SetAuthCookie(user.Name, false); SetAuthCookie(user); //redirect to returnUrl if (!string.IsNullOrEmpty(returnUrl) && Url.IsLocalUrl(returnUrl) && !returnUrl.Equals("/Error/NotFound", StringComparison.OrdinalIgnoreCase)) { return Redirect(returnUrl); } return Redirect("~/"); } ModelState.AddModelError("UserName", "User or password not found"); } return View(model); }
And here's where we set the authentication cookie, here putting our user object as Json into the userData field of the cookie.
private void SetAuthCookie(User user) { var userData = JsonConvert.SerializeObject(user); var authTicket = new FormsAuthenticationTicket( 1, //version user.Name, DateTime.Now, //issue date DateTime.Now.AddMinutes(30), //expiration false, //isPersistent userData, FormsAuthentication.FormsCookiePath); //cookie path var cookie = new HttpCookie(FormsAuthentication.FormsCookieName, FormsAuthentication.Encrypt(authTicket)); Response.Cookies.Add(cookie); }
Finally, we hook up the PostAuthenticationRequest event. Normal forms authentication will have recognised the authentication cookie and created a GenericPrincipal and FormsIdentity. We unpack the userData field, and create our custom principal.
protected void Application_PostAuthenticateRequest(Object sender, EventArgs e) { var context = HttpContext.Current; if (context.User == null || !context.User.Identity.IsAuthenticated) { return; } var formsIdentity = context.User.Identity as FormsIdentity; if (formsIdentity == null) { return; } var id = formsIdentity; var ticket = id.Ticket; var userData = ticket.UserData; // Get the stored user-data, in this case, our roles var user = JsonConvert.DeserializeObject<User>(userData); var customPrincipal = new UserPrincipal(formsIdentity, user.RolesList.ToArray()); customPrincipal.Email = user.Email; Thread.CurrentPrincipal = Context.User = customPrincipal; }
The userdata is encrypted and safe from tampering, but it can make the cookie rather large.
.Net 4.5 making claims
Now in ASP.net 4.5, we have Windows Identity Foundation (WIF, pronounced "dub-i-f") and claims principals and identities. Usually this is discussed with "federation" and single-sign-on identity providers, but actually claims can be useful in "traditional" stand-alone websites like we've just discussed.
ClaimsPrincipals and Identities have a list of Claims. This can be just a property bag with names and values, but there are many standard claim names, defined by OASIS, in the ClaimTypes enum. In addition to ClaimTypes.Name and ClaimTypes.Role, there are Email, GivenName, Surname, DateOfBirth, MobilePhone and so on. These standard defined types mean libraries can discover these claims without defining common interfaces or contracts. But it is also extensible with application specific claims. The old fixed custom principal is starting to look old-fashioned.
The WIF session authentication module can take over from forms authentication, storing the claims in cookies. You don't need to use the federation aspects. The module handles cookies a little better than forms authentication- if it gets too large, it's chunked over several cookies. There is also a ReferenceMode = true, which keeps the claims data in server side memory and only sends a simple key in the cookie (it's obviously not webfarm safe).
FormsAuthentication with Claims
First, the configuration. You'll need to define the configuration sections. We are still using forms authentication, so keep the authentication mode=Forms. Add the WIF session authentication module, which will handle the cookie.
<configuration>
<configSections>
<section name="system.identityModel"
type="System.IdentityModel.Configuration.SystemIdentityModelSection,
System.IdentityModel, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
<section name="system.identityModel.services"
type="System.IdentityModel.Services.Configuration.SystemIdentityModelServicesSection,
System.IdentityModel.Services, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
</configSections>
<system.web>
<compilation debug="true" targetFramework="4.5" />
<httpRuntime targetFramework="4.5" />
<authentication mode="Forms">
<forms loginUrl="~/Account/Login" />
</authentication>
</system.web>
<system.webServer>
<modules>
<add name="SessionAuthenticationModule"
type="System.IdentityModel.Services.SessionAuthenticationModule,
System.IdentityModel.Services, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=b77a5c561934e089"
preCondition="managedHandler" />
</modules>
</system.webServer>
If you aren't using SSL, you need to add the following (note the configSection defined above):
<system.identityModel.services> <federationConfiguration> <cookieHandler requireSsl="false" /> </federationConfiguration> </system.identityModel.services>
In the login page, set the user properties into claims.
private void SetClaimsCookie(User user) { var claims = new List<Claim>(); claims.Add(new Claim(ClaimTypes.Name, user.Name)); claims.Add(new Claim(ClaimTypes.Email, user.Email)); foreach (var role in user.RolesList) { claims.Add(new Claim(ClaimTypes.Role, role)); } //needs an authentication issuer otherwise not authenticated var claimsIdentity = new ClaimsIdentity(claims, "Forms"); var claimsPrincipal = new ClaimsPrincipal(claimsIdentity); var sessionAuthenticationModule = FederatedAuthentication.SessionAuthenticationModule; var token = new SessionSecurityToken(claimsPrincipal); sessionAuthenticationModule.WriteSessionTokenToCookie(token); }
You don't need the PostAuthenticateRequest event- the WIF session module is doing that bit.
And that's it! [Authorize("Admin")] attributes work as normal. Retrieving the claims is simple.
var cp = (ClaimsPrincipal)User; var email = cp.FindFirst(ClaimTypes.Email);
Logging out looks like this:
public ActionResult SignOut() { var sessionAuthenticationModule = FederatedAuthentication.SessionAuthenticationModule; sessionAuthenticationModule.CookieHandler.Delete(); //FormsAuthentication.SignOut(); return Redirect("~/"); }


First Name
Last Name
Email Address
Country
Choose a country
United States
Canada
Mexico
Bibliography
Phone Number
Affiliations
Occupation
Choose an occupation
Dentist
Coder
Dancer
StuntMan
Cat's Name
Favorite Gadget
Special Talent
Choose a talent
Juggling
Armpit Fart
Fast Walking
Flipcup
Favorite Drink
Favorite Superpower
Weapon of Choice
Comments


Testify
Testing utilities for Crystal lang specs.
Specs or unit test style?
The both! Based on std's Crystal Spec, Testify is an OOP abstraction for creating unit and integration tests. This allows structuring some tests in an objective of maintenability, extendability and reusability.
Some tests require a Spec style:
it "should create an account and send a welcome email" do
# ...
end
Other tests require a unitary way:
def test_send_html_email
# ...
end
def test_send_text_email
# ...
end
def test_get_with_default_value
# ...
end
def test_get_without_default_value
# ...
end
def test_delete_by_id
# ...
end
Other tests require the benefits of OOP. Advanced example:
# Common tests for all model.
abstract class ModelTest < Testify::Test
def before_all
db.connect
db.create_tables
end
def after_all
db.clean
end
def before_each
db.init
end
def after_each
db.reset
end
abstract def db : DBHelper
abstract def model_class : Model.class
abstract def get_model_values : Hash
abstract def get_updated_model_values : Hash
@[Data("get_model_values")]
def test_create(values, expected)
model = model_class.create(values)
model.should be_a Model
model.to_h should eq expected
end
@[Data("get_updated_model_values")]
def test_update(values, expected)
model_class.create(get_model_values)
model_class.update(values).to_h.should eq expected
# ...
end
def test_delete_by_id
id = model_class.create(get_model_values)
id.should be_a(Int32)
model_class.delete(id).rows_affected.should eq 1
model_class.find?(id).should eq nil
end
def test_find_by_id
# ...
end
end
In this example, thanks to ModelTest
class defined above.
Because we define a common behavior that can be used by all the models that inherit it.
With the main benefits:
- Common lifecycle hooks (before_all, before_each, ...).
- Some tests common to all models do not need to be repeated.
- Clean structured fashion for all models.
- Reusability (example:
AdminTest < UserTest
that reuses common tests, states andData
source).
Common tests will be automatically executed (by inheritance):
# Test cases for the User model.
class UserTest < ModelTest
getter db : DBHelper = DBHelper.new
getter model_class : Model.class = User
# `Data` source.
def get_model_values : Hash
{
"username" => "foo",
"email" =><EMAIL_ADDRESS># ...
}
end
# Updated `Data` source.
def get_updated_model_values : Hash
user_h = get_model_values
user_h["username"] = "bar"
user_h["email"] =<EMAIL_ADDRESS>user_h
end
# Just write other tests specific to the model User...
end
Installation
- Add the dependency to your
shard.yml
:
dependencies:
testify:
github: nicolab/crystal-testify
version: ~> 1.0.1 # Check the latest version!
- Run
shards install
Usage
📘 API doc.
Based and fully compliant with:
Define the test(s) class(es):
require "testify"
class ExampleTest < Testify::Test
@hey = "Crystal is awesome!"
def test_something
true.should eq true
end
def test_my_mood
@hey.should eq "Crystal is awesome!"
end
# ...
end
class AnotherTest < Testify::Test
def test_foo
true.should eq true
# ...
end
# ...
end
# Runs all test cases
Testify.run_all
A Test
class can be run alone:
# Runs only ExampleTest tests
ExampleTest.run
# Runs only AnotherTest tests
AnotherTest.run
Internally, Testify.run_all
executes the run
method of each Test
class defined.
POO
All benefits related to a class are available, like:
- macros: hooks
- finalize
- annotations
- Macros, inheritance, modules, variables, methods, visibility, ... powerful 🚀
Under the hood:
- A class defines a "describe" block.
- Methods
test_
andftest_
, define ait
block. ptest_
method,Pending
andSkip
annotations, define apending
block.ftest_
method andFocus
annotation, addfocus: true
to ait
block.Tags("foo")
annotation on atest
method, addtags: "foo"
to ait
block.Tags("foo")
annotation on aTest
class, addtags: "foo"
to adescribe
block.
Lifecycle
Optionally if you need life cycle hooks related to your tests.
class ExampleTest < Testify::Test
def before_all
puts "before_all"
end
def before_each
puts "before_each"
end
def around_all(test)
puts "around_all - before"
test.run
puts "around_all - after"
end
def around_each(test)
puts "around_each - before"
test.run
puts "around_each - after"
end
def after_all
puts "before_all"
end
def after_each
puts "before_each"
end
# ...
end
Initialize
Optionally if you need to initialize some variables.
class ExampleTest < Testify::Test
# You can initialize variables, constants, contexts, ...
def initialize
# Configure here...
end
end
Test cases
A test case, it's like:
it "my feature" do
# ...
end
Except that this is written in the OOP way, in a method:
class ExampleTest < Testify::Test
# A test case
def test_my_feature
# ...
end
# Another test.
def test_another_thing
# ...
end
# ...
end
Pending test / Skip test
Pending test, it's like:
pending "my feature" do
# ...
end
This can be written:
class ExampleTest < Testify::Test
# Prefixed by `p`
def ptest_my_feature
# ...
end
# Pending test with `Pending` annotation.
@[Pending]
def test_my_feature
# ...
end
# Pending test with `Skip` annotation.
# Same as `Pending`, just another syntactic flavor.
@[Skip]
def test_my_feature
# ...
end
# ...
end
A class can be skipped:
@[Pending]
# or @[Skip]
class ExampleTest < Testify::Test
# ...
end
It's like marking a describe
block as pending
.
All tests contained in the current class will be skipped.
Focused test
Focused test, it's like:
it "my feature", focus: true do
# ...
end
This can be written:
class ExampleTest < Testify::Test
# Prefixed by `f`
def ftest_my_feature
end
# Focused test with `Focus` annotation.
@[Focus]
def test_my_feature
end
end
A class can be focused:
@[Focus]
class ExampleTest < Testify::Test
# ...
end
It's like focusing a describe
block.
Only the tests contained in the focused class will be executed.
Tags
Tags test with Tags
annotation, it's like:
it "my feature", tags: "slow" do
# ...
end
This can be written:
class ExampleTest < Testify::Test
@[Tags("slow")]
def test_my_feature
end
end
A class can be tagged:
@[Tags("foo")]
class ExampleTest < Testify::Test
# ...
end
It's like tagging a describe
block.
Tacker / Tracer
Tracking utilities to trace some behaviors (like a method call, an event listener, a spawn
, a Channel
, ...).
Development
Install dev dependencies:
shards install
Run:
crystal spec
Clean before commit:
crystal tool format
./bin/ameba
Contributing
- Fork it (https://github.com/Nicolab/crystal-testify/fork)
- Create your feature branch (
git checkout -b my-new-feature
) - Commit your changes (
git commit -am 'Add some feature'
) - Push to the branch (
git push origin my-new-feature
) - Create a new Pull Request
LICENSE
MIT (c) 2021, Nicolas Talle.
Author
| | |---| | Nicolas Talle | | |