Programación segura en Java/Android

April 15, 2014
tuxotron
Android, Programación, Seguridad

El CERT mantiene una lista de reglas y buenas prácticas que recomiendan seguir cuando escribimos código en el lenguaje de programación Java de Oracle. La versión 1.0 de esta lista se apoya en las versiones 1.6 y 1.7 de Java.

La lista se divide en las siguientes secciones:

00. Input Validation and Data Sanitization (IDS)
01. Declarations and Initialization (DCL)
02. Expressions (EXP)
03. Numeric Types and Operations (NUM)
04. Object Orientation (OBJ)
05. Methods (MET)
06. Exceptional Behavior (ERR)
07. Visibility and Atomicity (VNA)
08. Locking (LCK)
09. Thread APIs (THI)
10. Thread Pools (TPS)
11. Thread-Safety Miscellaneous (TSM)
12. Input Output (FIO)
13. Serialization (SER)
14. Platform Security (SEC)
15. Runtime Environment (ENV)
16. Java Native Interface (JNI)
49. Miscellaneous (MSC)
50. Android (DRD)

Como podemos ver la última sección de la misma está orientada a Android, en la que se comentan los siguientes temas:

DRD00-J. Do not store sensitive information on external storage (SD card)
DRD01-J. Limit the accessibility to your sensitive content provider
DRD02-J. Do not allow WebView to access sensitive local resource through file scheme
DRD03-J. Do not broadcast sensitive information using an implicit intent
DRD04-J. Do not log sensitive information
DRD05-J. Do not grant URI permissions on implicit intents
DRD06-J. Do not act on malicious intents
DRD07-J. Protect exported services with strong permissions
DRD08-J. Always canonicalize a URL received by a content provider
DRD09-J: Restrict access to sensitive activities
DRD10-J. Do not release apps that are debuggable
DRD11-J. Ensure that sensitive data is kept secure
DRD12-J. Do not trust data that is world writable
DRD13-J. Do not allow JavaScript in Web Apps
DRD14-J. Check that a calling app has appropriate permissions before responding
DRD15-J. Consider privacy concerns when using Geolocation API
DRD16-J. Explicitly define the exported attribute for private components
DRD17-J. Do not use the Android cryptographic security provider encryption default for AES
DRD18-J. Do not use the default behavior in a cryptographic library if it does not use recommended practices
DRD19-J. Properly verify server certificate on SSL/TLS

Si eres de los que prefieres un libro, The CERT Oracle Secure Standard for Java (imagen que encabeza esta entrada), es una buena opción, aunque no cubre el apartado de Android, al menos en la revisión actual.