Skip to content

feature: add ANTI_SIDELOADING present/missing KB entries for Android#290

Merged
3asm merged 1 commit into
masterfrom
feature/add-anti-sideloading-entries
Jun 20, 2026
Merged

feature: add ANTI_SIDELOADING present/missing KB entries for Android#290
3asm merged 1 commit into
masterfrom
feature/add-anti-sideloading-entries

Conversation

@burogurama

@burogurama burogurama commented Jun 20, 2026

Copy link
Copy Markdown
Member

Adds two new Android KB entries for installation-source verification:

  • ANTI_SIDELOADING_MISSING (_HARDENING) — app does not verify its installer and runs normally when sideloaded.
  • ANTI_SIDELOADING_PRESENT (_SECURE) — app detects a sideloaded installation and responds.

@burogurama burogurama marked this pull request as ready for review June 20, 2026 12:35
@burogurama burogurama requested a review from a team June 20, 2026 12:36
@burogurama burogurama self-assigned this Jun 20, 2026
@codecov

codecov Bot commented Jun 20, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.48%. Comparing base (ca63797) to head (6050e87).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff           @@
##           master     #290   +/-   ##
=======================================
  Coverage   94.48%   94.48%           
=======================================
  Files           5        5           
  Lines         290      290           
=======================================
  Hits          274      274           
  Misses         16       16           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@ostorlab-ai-pr-review ostorlab-ai-pr-review Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review Summary

Total Issues Found: 1
Critical Issues: 0
Suggestions: 1

Key Findings:
One suggestion-level finding: the security_issue field in Android _SECURE metadata entries is incorrectly set to true for positive security findings (protections that are present). This creates a semantic inconsistency with the iOS equivalent and may affect multiple Android entries across the repo. No critical or blocking issues were identified. Overall code quality is good; a repo-wide audit of the security_issue flag convention is recommended.

"title": "Sideloading Detection Implemented",
"privacy_issue": false,
"security_issue": true,
"targeted_by_malware": false,

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider setting security_issue to false for _SECURE entries. A _SECURE finding indicates the protection is present and the app is properly hardened — this is a positive result, not a security issue. The iOS equivalent _SECURE entry (IPA_ANTI_TAMPERING_DETECTED) uses "security_issue": false, which is semantically more correct. Note: the Android DYNAMIC_FRIDA_PROTECTION_PRESENT entry also has "security_issue": true, so this may be an ongoing inconsistency worth clarifying across the repo.

Suggested change
"targeted_by_malware": false,
"security_issue": false,

@3asm 3asm merged commit cf30b4f into master Jun 20, 2026
8 of 9 checks passed
@3asm 3asm deleted the feature/add-anti-sideloading-entries branch June 20, 2026 19:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants