Update documentation snapshot (new lint security checks)

docs/checks/DefaultCleartextTraffic.md.html

@@ -32,7 +32,7 @@
 Editing
 :   This check runs on the fly in the IDE editor
 See
-:   http://goo.gle/DefaultCleartextTraffic
+:   https://goo.gle/DefaultCleartextTraffic
 Implementation
 :   [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/MissingNetworkSecurityConfigDetector.kt)
 Tests
@@ -85,17 +85,17 @@
 
 ```
 // build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
 
 // build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
 
 // build.gradle.kts with version catalogs:
 lintChecks(libs.com.android.security.lint.lint)
 
 # libs.versions.toml
 [versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
 [libraries]
 # For clarity and text wrapping purposes the following declaration is
 # shown split up across lines, but in TOML it needs to be on a single
@@ -107,7 +107,7 @@
 }
 ```
 
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
 there may be newer versions available.
 
 [Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).

docs/checks/DefaultTrustedUserCerts.md.html

@@ -32,7 +32,7 @@
 Editing
 :   This check runs on the fly in the IDE editor
 See
-:   http://goo.gle/DefaultTrustedUserCerts
+:   https://goo.gle/DefaultTrustedUserCerts
 Implementation
 :   [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/MissingNetworkSecurityConfigDetector.kt)
 Tests
@@ -87,17 +87,17 @@
 
 ```
 // build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
 
 // build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
 
 // build.gradle.kts with version catalogs:
 lintChecks(libs.com.android.security.lint.lint)
 
 # libs.versions.toml
 [versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
 [libraries]
 # For clarity and text wrapping purposes the following declaration is
 # shown split up across lines, but in TOML it needs to be on a single
@@ -109,7 +109,7 @@
 }
 ```
 
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
 there may be newer versions available.
 
 [Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).

docs/checks/DisabledAllSafeBrowsing.md.html

@@ -32,7 +32,7 @@
 Editing
 :   This check runs on the fly in the IDE editor
 See
-:   http://goo.gle/DisabledAllSafeBrowsing
+:   https://goo.gle/DisabledAllSafeBrowsing
 Implementation
 :   [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/SafeBrowsingDetector.kt)
 Tests
@@ -89,17 +89,17 @@
 
 ```
 // build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
 
 // build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
 
 // build.gradle.kts with version catalogs:
 lintChecks(libs.com.android.security.lint.lint)
 
 # libs.versions.toml
 [versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
 [libraries]
 # For clarity and text wrapping purposes the following declaration is
 # shown split up across lines, but in TOML it needs to be on a single
@@ -111,7 +111,7 @@
 }
 ```
 
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
 there may be newer versions available.
 
 [Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).

docs/checks/ExposedRootPath.md.html

@@ -32,7 +32,7 @@
 Editing
 :   This check runs on the fly in the IDE editor
 See
-:   http://goo.gle/ExposedRootPath
+:   https://goo.gle/ExposedRootPath
 Implementation
 :   [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/MisconfiguredFileProviderDetector.kt)
 Tests
@@ -87,17 +87,17 @@
 
 ```
 // build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
 
 // build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
 
 // build.gradle.kts with version catalogs:
 lintChecks(libs.com.android.security.lint.lint)
 
 # libs.versions.toml
 [versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
 [libraries]
 # For clarity and text wrapping purposes the following declaration is
 # shown split up across lines, but in TOML it needs to be on a single
@@ -109,7 +109,7 @@
 }
 ```
 
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
 there may be newer versions available.
 
 [Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).

docs/checks/InsecureDnsSdkLevel.md.html

@@ -32,7 +32,7 @@
 Editing
 :   This check runs on the fly in the IDE editor
 See
-:   http://goo.gle/InsecureDnsSdkLevel
+:   https://goo.gle/InsecureDnsSdkLevel
 Implementation
 :   [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/DnsConfigDetector.kt)
 Tests
@@ -87,17 +87,17 @@
 
 ```
 // build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
 
 // build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
 
 // build.gradle.kts with version catalogs:
 lintChecks(libs.com.android.security.lint.lint)
 
 # libs.versions.toml
 [versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
 [libraries]
 # For clarity and text wrapping purposes the following declaration is
 # shown split up across lines, but in TOML it needs to be on a single
@@ -109,7 +109,7 @@
 }
 ```
 
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
 there may be newer versions available.
 
 [Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).

docs/checks/InsecurePermissionProtectionLevel.md.html

@@ -32,7 +32,7 @@
 Editing
 :   This check runs on the fly in the IDE editor
 See
-:   http://goo.gle/InsecurePermissionProtectionLevel
+:   https://goo.gle/InsecurePermissionProtectionLevel
 Implementation
 :   [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/PermissionDetector.kt)
 Tests
@@ -90,17 +90,17 @@
 
 ```
 // build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
 
 // build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
 
 // build.gradle.kts with version catalogs:
 lintChecks(libs.com.android.security.lint.lint)
 
 # libs.versions.toml
 [versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
 [libraries]
 # For clarity and text wrapping purposes the following declaration is
 # shown split up across lines, but in TOML it needs to be on a single
@@ -112,7 +112,7 @@
 }
 ```
 
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
 there may be newer versions available.
 
 [Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).

docs/checks/InsecureStickyBroadcastsMethod.md.html

@@ -0,0 +1,188 @@
+<meta charset="utf-8">
+(#) Usage of insecure sticky broadcasts
+
+!!! WARNING: Usage of insecure sticky broadcasts
+   This is a warning.
+
+Id
+:   `InsecureStickyBroadcastsMethod`
+Summary
+:   Usage of insecure sticky broadcasts
+Severity
+:   Warning
+Category
+:   Security
+Platform
+:   Any
+Vendor
+:   Google - Android 3P Vulnerability Research
+Contact
+:   https://github.com/google/android-security-lints
+Feedback
+:   https://github.com/google/android-security-lints/issues
+Min
+:   Lint 4.1
+Compiled
+:   Lint 8.0 and 8.1
+Artifact
+:   [com.android.security.lint:lint](com_android_security_lint_lint.md.html)
+
+Affects
+:   Kotlin and Java files
+Editing
+:   This check runs on the fly in the IDE editor
+See
+:   https://goo.gle/InsecureStickyBroadcastsMethod
+Implementation
+:   [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/StickyBroadcastsDetector.kt)
+Tests
+:   [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/test/java/com/example/lint/checks/StickyBroadcastsDetectorTest.kt)
+Copyright Year
+:   2024
+
+Sticky broadcasts can be accessed, sent, or modified by anyone,
+resulting in potential security issues. For this reason, it was
+deprecated in API level 21 and other mechanisms such as databases or
+non-sticky broadcasts should be used instead.
+
+(##) Example
+
+Here is an example of lint warnings produced by this check:
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~text
+src/fake/pkg/MainActivity.java:12:Warning: Sticky broadcasts can be
+accessed, sent or modified by anyone. Use non-sticky broadcasts instead.
+[InsecureStickyBroadcastsMethod]
+    sendStickyOrderedBroadcast();
+    ----------------------------
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Here is the source file referenced above:
+
+`src/fake/pkg/MainActivity.java`:
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~java linenumbers
+package fake.pkg;
+
+import android.app.Activity;
+import android.os.Bundle;
+
+@Suppress("DEPRECATION")
+public class MainActivity extends Activity {
+
+    @Override
+     protected void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+        sendStickyOrderedBroadcast();
+        }
+}
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+You can also visit the
+[source code](https://github.com/google/android-security-lints/tree/main/checks/src/test/java/com/example/lint/checks/StickyBroadcastsDetectorTest.kt)
+for the unit tests for this check to see additional scenarios.
+
+The above example was automatically extracted from the first unit test
+found for this lint check, `StickyBroadcastsDetector.stickyBroadcastMethodCall_showsWarning`.
+To report a problem with this extracted sample, visit
+https://github.com/google/android-security-lints/issues.
+
+(##) Including
+
+!!!
+   This is not a built-in check. To include it, add the below dependency
+   to your project. This lint check is included in the lint documentation,
+   but the Android team may or may not agree with its recommendations.
+
+```
+// build.gradle.kts
+lintChecks("com.android.security.lint:lint:1.0.2")
+
+// build.gradle
+lintChecks 'com.android.security.lint:lint:1.0.2'
+
+// build.gradle.kts with version catalogs:
+lintChecks(libs.com.android.security.lint.lint)
+
+# libs.versions.toml
+[versions]
+com-android-security-lint-lint = "1.0.2"
+[libraries]
+# For clarity and text wrapping purposes the following declaration is
+# shown split up across lines, but in TOML it needs to be on a single
+# line (see https://github.com/toml-lang/toml/issues/516) so adjust
+# when pasting into libs.versions.toml:
+com-android-security-lint-lint = {
+    module = "com.android.security.lint:lint",
+    version.ref = "com-android-security-lint-lint"
+}
+```
+
+1.0.2 is the version this documentation was generated from;
+there may be newer versions available.
+
+[Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).
+(##) Suppressing
+
+You can suppress false positives using one of the following mechanisms:
+
+* Using a suppression annotation like this on the enclosing
+  element:
+
+  ```kt
+  // Kotlin
+  @Suppress("InsecureStickyBroadcastsMethod")
+  fun method() {
+     sendStickyOrderedBroadcast(...)
+  }
+  ```
+
+  or
+
+  ```java
+  // Java
+  @SuppressWarnings("InsecureStickyBroadcastsMethod")
+  void method() {
+     sendStickyOrderedBroadcast(...);
+  }
+  ```
+
+* Using a suppression comment like this on the line above:
+
+  ```kt
+  //noinspection InsecureStickyBroadcastsMethod
+  problematicStatement()
+  ```
+
+* Using a special `lint.xml` file in the source tree which turns off
+  the check in that folder and any sub folder. A simple file might look
+  like this:
+  ```xml
+  &lt;?xml version="1.0" encoding="UTF-8"?&gt;
+  &lt;lint&gt;
+      &lt;issue id="InsecureStickyBroadcastsMethod" severity="ignore" /&gt;
+  &lt;/lint&gt;
+  ```
+  Instead of `ignore` you can also change the severity here, for
+  example from `error` to `warning`. You can find additional
+  documentation on how to filter issues by path, regular expression and
+  so on
+  [here](https://googlesamples.github.io/android-custom-lint-rules/usage/lintxml.md.html).
+
+* In Gradle projects, using the DSL syntax to configure lint. For
+  example, you can use something like
+  ```gradle
+  lintOptions {
+      disable 'InsecureStickyBroadcastsMethod'
+  }
+  ```
+  In Android projects this should be nested inside an `android { }`
+  block.
+
+* For manual invocations of `lint`, using the `--ignore` flag:
+  ```
+  $ lint --ignore InsecureStickyBroadcastsMethod ...`
+  ```
+
+* Last, but not least, using baselines, as discussed
+  [here](https://googlesamples.github.io/android-custom-lint-rules/usage/baselines.md.html).
+
+<!-- Markdeep: --><style class="fallback">body{visibility:hidden;white-space:pre;font-family:monospace}</style><script src="markdeep.min.js" charset="utf-8"></script><script src="https://morgan3d.github.io/markdeep/latest/markdeep.min.js" charset="utf-8"></script><script>window.alreadyProcessedMarkdeep||(document.body.style.visibility="visible")</script>

docs/checks/InsecureStickyBroadcastsPermission.md.html

@@ -0,0 +1,168 @@
+<meta charset="utf-8">
+(#) Usage of insecure sticky broadcasts
+
+!!! WARNING: Usage of insecure sticky broadcasts
+   This is a warning.
+
+Id
+:   `InsecureStickyBroadcastsPermission`
+Summary
+:   Usage of insecure sticky broadcasts
+Severity
+:   Warning
+Category
+:   Security
+Platform
+:   Android
+Vendor
+:   Google - Android 3P Vulnerability Research
+Contact
+:   https://github.com/google/android-security-lints
+Feedback
+:   https://github.com/google/android-security-lints/issues
+Min
+:   Lint 4.1
+Compiled
+:   Lint 8.0 and 8.1
+Artifact
+:   [com.android.security.lint:lint](com_android_security_lint_lint.md.html)
+
+Affects
+:   Manifest files
+Editing
+:   This check runs on the fly in the IDE editor
+See
+:   https://goo.gle/InsecureStickyBroadcastsPermission
+Implementation
+:   [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/StickyBroadcastsDetector.kt)
+Tests
+:   [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/test/java/com/example/lint/checks/StickyBroadcastsDetectorTest.kt)
+Copyright Year
+:   2024
+
+Sticky broadcasts can be accessed, sent, or modified by anyone,
+resulting in potential security issues. For this reason, it was
+deprecated in API level 21 and other mechanisms such as databases or
+non-sticky broadcasts should be used instead.
+
+(##) Example
+
+Here is an example of lint warnings produced by this check:
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~text
+AndroidManifest.xml:2:Warning: Sticky broadcasts can be accessed, sent
+or modified by anyone. Use non-sticky broadcasts instead.
+[InsecureStickyBroadcastsPermission]
+    &lt;uses-permission android:name="android.permission.BROADCAST_STICKY"/&gt;
+    ---------------------------------------------------------------------
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Here is the source file referenced above:
+
+`AndroidManifest.xml`:
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~xml linenumbers
+&lt;manifest xmlns:android='http://schemas.android.com/apk/res/android' package='test.pkg'&gt;
+                    &lt;uses-permission android:name="android.permission.BROADCAST_STICKY"/&gt;
+                    &lt;application&gt;
+                        &lt;activity android:name='com.example.MainActivity'&gt;&lt;/activity&gt;
+                    &lt;/application&gt;
+                    &lt;/manifest&gt;
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+You can also visit the
+[source code](https://github.com/google/android-security-lints/tree/main/checks/src/test/java/com/example/lint/checks/StickyBroadcastsDetectorTest.kt)
+for the unit tests for this check to see additional scenarios.
+
+The above example was automatically extracted from the first unit test
+found for this lint check, `StickyBroadcastsDetector.stickyBroadcastPermissionInManifest_showsWarning`.
+To report a problem with this extracted sample, visit
+https://github.com/google/android-security-lints/issues.
+
+(##) Including
+
+!!!
+   This is not a built-in check. To include it, add the below dependency
+   to your project. This lint check is included in the lint documentation,
+   but the Android team may or may not agree with its recommendations.
+
+```
+// build.gradle.kts
+lintChecks("com.android.security.lint:lint:1.0.2")
+
+// build.gradle
+lintChecks 'com.android.security.lint:lint:1.0.2'
+
+// build.gradle.kts with version catalogs:
+lintChecks(libs.com.android.security.lint.lint)
+
+# libs.versions.toml
+[versions]
+com-android-security-lint-lint = "1.0.2"
+[libraries]
+# For clarity and text wrapping purposes the following declaration is
+# shown split up across lines, but in TOML it needs to be on a single
+# line (see https://github.com/toml-lang/toml/issues/516) so adjust
+# when pasting into libs.versions.toml:
+com-android-security-lint-lint = {
+    module = "com.android.security.lint:lint",
+    version.ref = "com-android-security-lint-lint"
+}
+```
+
+1.0.2 is the version this documentation was generated from;
+there may be newer versions available.
+
+[Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).
+(##) Suppressing
+
+You can suppress false positives using one of the following mechanisms:
+
+* Adding the suppression attribute
+  `tools:ignore="InsecureStickyBroadcastsPermission"` on the
+  problematic XML element (or one of its enclosing elements). You may
+  also need to add the following namespace declaration on the root
+  element in the XML file if it's not already there:
+  `xmlns:tools="http://schemas.android.com/tools"`.
+
+  ```xml
+  &lt;?xml version="1.0" encoding="UTF-8"?&gt;
+  &lt;manifest xmlns:tools="http://schemas.android.com/tools"&gt;
+      ...
+      &lt;uses-permission tools:ignore="InsecureStickyBroadcastsPermission" .../&gt;
+    ...
+  &lt;/manifest&gt;
+  ```
+
+* Using a special `lint.xml` file in the source tree which turns off
+  the check in that folder and any sub folder. A simple file might look
+  like this:
+  ```xml
+  &lt;?xml version="1.0" encoding="UTF-8"?&gt;
+  &lt;lint&gt;
+      &lt;issue id="InsecureStickyBroadcastsPermission" severity="ignore" /&gt;
+  &lt;/lint&gt;
+  ```
+  Instead of `ignore` you can also change the severity here, for
+  example from `error` to `warning`. You can find additional
+  documentation on how to filter issues by path, regular expression and
+  so on
+  [here](https://googlesamples.github.io/android-custom-lint-rules/usage/lintxml.md.html).
+
+* In Gradle projects, using the DSL syntax to configure lint. For
+  example, you can use something like
+  ```gradle
+  lintOptions {
+      disable 'InsecureStickyBroadcastsPermission'
+  }
+  ```
+  In Android projects this should be nested inside an `android { }`
+  block.
+
+* For manual invocations of `lint`, using the `--ignore` flag:
+  ```
+  $ lint --ignore InsecureStickyBroadcastsPermission ...`
+  ```
+
+* Last, but not least, using baselines, as discussed
+  [here](https://googlesamples.github.io/android-custom-lint-rules/usage/baselines.md.html).
+
+<!-- Markdeep: --><style class="fallback">body{visibility:hidden;white-space:pre;font-family:monospace}</style><script src="markdeep.min.js" charset="utf-8"></script><script src="https://morgan3d.github.io/markdeep/latest/markdeep.min.js" charset="utf-8"></script><script>window.alreadyProcessedMarkdeep||(document.body.style.visibility="visible")</script>

docs/checks/MissingAutoVerifyAttribute.md.html

@@ -32,7 +32,7 @@
 Editing
 :   This check runs on the fly in the IDE editor
 See
-:   http://goo.gle/MissingAutoVerifyAttribute
+:   https://goo.gle/MissingAutoVerifyAttribute
 Implementation
 :   [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/CustomSchemeDetector.kt)
 Tests
@@ -93,17 +93,17 @@
 
 ```
 // build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
 
 // build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
 
 // build.gradle.kts with version catalogs:
 lintChecks(libs.com.android.security.lint.lint)
 
 # libs.versions.toml
 [versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
 [libraries]
 # For clarity and text wrapping purposes the following declaration is
 # shown split up across lines, but in TOML it needs to be on a single
@@ -115,7 +115,7 @@
 }
 ```
 
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
 there may be newer versions available.
 
 [Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).

docs/checks/SensitiveExternalPath.md.html

@@ -32,7 +32,7 @@
 Editing
 :   This check runs on the fly in the IDE editor
 See
-:   http://goo.gle/SensitiveExternalPath
+:   https://goo.gle/SensitiveExternalPath
 Implementation
 :   [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/MisconfiguredFileProviderDetector.kt)
 Tests
@@ -86,17 +86,17 @@
 
 ```
 // build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
 
 // build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
 
 // build.gradle.kts with version catalogs:
 lintChecks(libs.com.android.security.lint.lint)
 
 # libs.versions.toml
 [versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
 [libraries]
 # For clarity and text wrapping purposes the following declaration is
 # shown split up across lines, but in TOML it needs to be on a single
@@ -108,7 +108,7 @@
 }
 ```
 
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
 there may be newer versions available.
 
 [Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).

docs/checks/StrandhoggVulnerable.md.html

@@ -32,7 +32,7 @@
 Editing
 :   This check runs on the fly in the IDE editor
 See
-:   http://goo.gle/StrandhoggVulnerable
+:   https://goo.gle/StrandhoggVulnerable
 Implementation
 :   [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/StrandhoggDetector.kt)
 Tests
@@ -87,17 +87,17 @@
 
 ```
 // build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
 
 // build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
 
 // build.gradle.kts with version catalogs:
 lintChecks(libs.com.android.security.lint.lint)
 
 # libs.versions.toml
 [versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
 [libraries]
 # For clarity and text wrapping purposes the following declaration is
 # shown split up across lines, but in TOML it needs to be on a single
@@ -109,7 +109,7 @@
 }
 ```
 
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
 there may be newer versions available.
 
 [Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).

docs/checks/TapjackingVulnerable.md.html

@@ -32,7 +32,7 @@
 Editing
 :   This check runs on the fly in the IDE editor
 See
-:   http://goo.gle/TapjackingVulnerable
+:   https://goo.gle/TapjackingVulnerable
 Implementation
 :   [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/TapjackingDetector.kt)
 Tests
@@ -87,17 +87,17 @@
 
 ```
 // build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
 
 // build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
 
 // build.gradle.kts with version catalogs:
 lintChecks(libs.com.android.security.lint.lint)
 
 # libs.versions.toml
 [versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
 [libraries]
 # For clarity and text wrapping purposes the following declaration is
 # shown split up across lines, but in TOML it needs to be on a single
@@ -109,7 +109,7 @@
 }
 ```
 
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
 there may be newer versions available.
 
 [Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).

docs/checks/UnintendedExposedUrl.md.html

@@ -32,7 +32,7 @@
 Editing
 :   This check runs on the fly in the IDE editor
 See
-:   http://goo.gle/UnintendedExposedUrl
+:   https://goo.gle/UnintendedExposedUrl
 Implementation
 :   [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/UnintendedExposedUrlDetector.kt)
 Tests
@@ -102,17 +102,17 @@
 
 ```
 // build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
 
 // build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
 
 // build.gradle.kts with version catalogs:
 lintChecks(libs.com.android.security.lint.lint)
 
 # libs.versions.toml
 [versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
 [libraries]
 # For clarity and text wrapping purposes the following declaration is
 # shown split up across lines, but in TOML it needs to be on a single
@@ -124,7 +124,7 @@
 }
 ```
 
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
 there may be newer versions available.
 
 [Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).

docs/checks/UnintendedPrivateIpAddress.md.html

@@ -32,7 +32,7 @@
 Editing
 :   This check runs on the fly in the IDE editor
 See
-:   http://goo.gle/UnintendedPrivateIpAddress
+:   https://goo.gle/UnintendedPrivateIpAddress
 Implementation
 :   [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/UnintendedExposedUrlDetector.kt)
 Tests
@@ -103,17 +103,17 @@
 
 ```
 // build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
 
 // build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
 
 // build.gradle.kts with version catalogs:
 lintChecks(libs.com.android.security.lint.lint)
 
 # libs.versions.toml
 [versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
 [libraries]
 # For clarity and text wrapping purposes the following declaration is
 # shown split up across lines, but in TOML it needs to be on a single
@@ -125,7 +125,7 @@
 }
 ```
 
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
 there may be newer versions available.
 
 [Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).

docs/checks/UnsafeCryptoAlgorithmUsage.md.html

@@ -32,7 +32,7 @@
 Editing
 :   This check runs on the fly in the IDE editor
 See
-:   http://goo.gle/UnsafeCryptoAlgorithmUsage
+:   https://goo.gle/UnsafeCryptoAlgorithmUsage
 Implementation
 :   [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/BadCryptographyUsageDetector.kt)
 Tests
@@ -95,17 +95,17 @@
 
 ```
 // build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
 
 // build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
 
 // build.gradle.kts with version catalogs:
 lintChecks(libs.com.android.security.lint.lint)
 
 # libs.versions.toml
 [versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
 [libraries]
 # For clarity and text wrapping purposes the following declaration is
 # shown split up across lines, but in TOML it needs to be on a single
@@ -117,7 +117,7 @@
 }
 ```
 
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
 there may be newer versions available.
 
 [Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).

docs/checks/UnsanitizedFilenameFromContentProvider-2.md.html

@@ -0,0 +1,204 @@
+<meta charset="utf-8">
+(#) Trusting ContentProvider filenames without any sanitization
+
+!!! WARNING: Trusting ContentProvider filenames without any sanitization
+   This is a warning.
+
+Id
+:   `UnsanitizedFilenameFromContentProvider`
+Summary
+:   Trusting ContentProvider filenames without any sanitization
+Severity
+:   Warning
+Category
+:   Security
+Platform
+:   Android
+Vendor
+:   Google - Android 3P Vulnerability Research
+Contact
+:   https://github.com/google/android-security-lints
+Feedback
+:   https://github.com/google/android-security-lints/issues
+Min
+:   Lint 4.1
+Compiled
+:   Lint 8.0 and 8.1
+Artifact
+:   [com.android.security.lint:lint](com_android_security_lint_lint.md.html)
+
+Affects
+:   Kotlin and Java files
+Editing
+:   This check runs on the fly in the IDE editor
+See
+:   https://goo.gle/UnsanitizedFilenameFromContentProvider
+Implementation
+:   [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/UnsafeFilenameDetector.kt)
+Tests
+:   [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/test/java/com/example/lint/checks/UnsafeFilenameDetectorTest.kt)
+Copyright Year
+:   2024
+
+When communicating between applications with files, the server app can
+provide the client app with a maliciously constructed filename. The
+client app should never trust this filename and should either sanitize
+it or completely discard it.
+
+(##) Example
+
+Here is an example of lint warnings produced by this check:
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~text
+src/TestClass.java:10:Warning: Using fileName is unsafe as it is a
+filename obtained directly from a ContentProvider. You should sanitize
+it before using it for creating a File.
+[UnsanitizedFilenameFromContentProvider]
+    File fileObject = new File("./", fileName);
+                                     --------
+src/TestClass.kt:10:Warning: Using fileName is unsafe as it is a
+filename obtained directly from a ContentProvider. You should sanitize
+it before using it for creating a File.
+[UnsanitizedFilenameFromContentProvider]
+    val fileObject = File("./", fileName)
+                                --------
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Here are the relevant source files:
+
+`src/TestClass.java`:
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~java linenumbers
+import android.database.Cursor;
+import android.provider.OpenableColumns;
+import java.io.File;
+
+class TestClass {
+  private void trustProvidedFilename_shouldWarn(Cursor cursor) {
+    int id = cursor.getColumnIndex(OpenableColumns.DISPLAY_NAME);
+    String fileName = cursor.getString(id);
+
+    File fileObject = new File("./", fileName);
+  }
+}
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+`src/TestClass.kt`:
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~kotlin linenumbers
+import android.database.Cursor
+import android.provider.OpenableColumns
+import java.io.File
+
+class TestClass {
+  private fun trustProvidedFilename_shouldWarn(cursor: Cursor) {
+    val id = cursor.getColumnIndex(OpenableColumns.DISPLAY_NAME)
+    val fileName = cursor.getString(id)
+
+    val fileObject = File("./", fileName)
+  }
+}
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+You can also visit the
+[source code](https://github.com/google/android-security-lints/tree/main/checks/src/test/java/com/example/lint/checks/UnsafeFilenameDetectorTest.kt)
+for the unit tests for this check to see additional scenarios.
+
+(##) Including
+
+!!!
+   This is not a built-in check. To include it, add the below dependency
+   to your project. This lint check is included in the lint documentation,
+   but the Android team may or may not agree with its recommendations.
+
+```
+// build.gradle.kts
+lintChecks("com.android.security.lint:lint:1.0.2")
+
+// build.gradle
+lintChecks 'com.android.security.lint:lint:1.0.2'
+
+// build.gradle.kts with version catalogs:
+lintChecks(libs.com.android.security.lint.lint)
+
+# libs.versions.toml
+[versions]
+com-android-security-lint-lint = "1.0.2"
+[libraries]
+# For clarity and text wrapping purposes the following declaration is
+# shown split up across lines, but in TOML it needs to be on a single
+# line (see https://github.com/toml-lang/toml/issues/516) so adjust
+# when pasting into libs.versions.toml:
+com-android-security-lint-lint = {
+    module = "com.android.security.lint:lint",
+    version.ref = "com-android-security-lint-lint"
+}
+```
+
+1.0.2 is the version this documentation was generated from;
+there may be newer versions available.
+
+[Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).
+(##) Suppressing
+
+You can suppress false positives using one of the following mechanisms:
+
+* Using a suppression annotation like this on the enclosing
+  element:
+
+  ```kt
+  // Kotlin
+  @Suppress("UnsanitizedFilenameFromContentProvider")
+  fun method() {
+     getColumnIndex(...)
+  }
+  ```
+
+  or
+
+  ```java
+  // Java
+  @SuppressWarnings("UnsanitizedFilenameFromContentProvider")
+  void method() {
+     getColumnIndex(...);
+  }
+  ```
+
+* Using a suppression comment like this on the line above:
+
+  ```kt
+  //noinspection UnsanitizedFilenameFromContentProvider
+  problematicStatement()
+  ```
+
+* Using a special `lint.xml` file in the source tree which turns off
+  the check in that folder and any sub folder. A simple file might look
+  like this:
+  ```xml
+  &lt;?xml version="1.0" encoding="UTF-8"?&gt;
+  &lt;lint&gt;
+      &lt;issue id="UnsanitizedFilenameFromContentProvider" severity="ignore" /&gt;
+  &lt;/lint&gt;
+  ```
+  Instead of `ignore` you can also change the severity here, for
+  example from `error` to `warning`. You can find additional
+  documentation on how to filter issues by path, regular expression and
+  so on
+  [here](https://googlesamples.github.io/android-custom-lint-rules/usage/lintxml.md.html).
+
+* In Gradle projects, using the DSL syntax to configure lint. For
+  example, you can use something like
+  ```gradle
+  lintOptions {
+      disable 'UnsanitizedFilenameFromContentProvider'
+  }
+  ```
+  In Android projects this should be nested inside an `android { }`
+  block.
+
+* For manual invocations of `lint`, using the `--ignore` flag:
+  ```
+  $ lint --ignore UnsanitizedFilenameFromContentProvider ...`
+  ```
+
+* Last, but not least, using baselines, as discussed
+  [here](https://googlesamples.github.io/android-custom-lint-rules/usage/baselines.md.html).
+
+<!-- Markdeep: --><style class="fallback">body{visibility:hidden;white-space:pre;font-family:monospace}</style><script src="markdeep.min.js" charset="utf-8"></script><script src="https://morgan3d.github.io/markdeep/latest/markdeep.min.js" charset="utf-8"></script><script>window.alreadyProcessedMarkdeep||(document.body.style.visibility="visible")</script>

docs/checks/UnsanitizedFilenameFromContentProvider.md.html

@@ -25,9 +25,9 @@
 See
 :   https://developer.android.com/privacy-and-security/risks/untrustworthy-contentprovider-provided-filename
 Implementation
-:   [Source Code](https://cs.android.com/android-studio/platform/tools/base/+/mirror-goog-studio-main:lint/libs/lint-checks/src/main/java/com/android/tools/lint/checks/UnsafeFilenameDetector.kt)
+:   [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/UnsafeFilenameDetector.kt)
 Tests
-:   [Source Code](https://cs.android.com/android-studio/platform/tools/base/+/mirror-goog-studio-main:lint/libs/lint-tests/src/test/java/com/android/tools/lint/checks/UnsafeFilenameDetectorTest.kt)
+:   [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/test/java/com/example/lint/checks/UnsafeFilenameDetectorTest.kt)
 Copyright Year
 :   2024
 
@@ -89,7 +89,7 @@
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 You can also visit the
-[source code](https://cs.android.com/android-studio/platform/tools/base/+/mirror-goog-studio-main:lint/libs/lint-tests/src/test/java/com/android/tools/lint/checks/UnsafeFilenameDetectorTest.kt)
+[source code](https://github.com/google/android-security-lints/tree/main/checks/src/test/java/com/example/lint/checks/UnsafeFilenameDetectorTest.kt)
 for the unit tests for this check to see additional scenarios.
 
 (##) Suppressing

docs/checks/VulnerableCryptoAlgorithm.md.html

@@ -32,7 +32,7 @@
 Editing
 :   This check runs on the fly in the IDE editor
 See
-:   http://goo.gle/VulnerableCryptoAlgorithm
+:   https://goo.gle/VulnerableCryptoAlgorithm
 Implementation
 :   [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/BadCryptographyUsageDetector.kt)
 Tests
@@ -92,17 +92,17 @@
 
 ```
 // build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
 
 // build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
 
 // build.gradle.kts with version catalogs:
 lintChecks(libs.com.android.security.lint.lint)
 
 # libs.versions.toml
 [versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
 [libraries]
 # For clarity and text wrapping purposes the following declaration is
 # shown split up across lines, but in TOML it needs to be on a single
@@ -114,7 +114,7 @@
 }
 ```
 
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
 there may be newer versions available.
 
 [Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).

docs/checks/WeakPrng.md.html

@@ -32,7 +32,7 @@
 Editing
 :   This check runs on the fly in the IDE editor
 See
-:   http://goo.gle/WeakPrng
+:   https://goo.gle/WeakPrng
 Implementation
 :   [Source Code](https://github.com/google/android-security-lints/tree/main/checks/src/main/java/com/example/lint/checks/WeakPrngDetector.kt)
 Tests
@@ -93,17 +93,17 @@
 
 ```
 // build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
 
 // build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
 
 // build.gradle.kts with version catalogs:
 lintChecks(libs.com.android.security.lint.lint)
 
 # libs.versions.toml
 [versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
 [libraries]
 # For clarity and text wrapping purposes the following declaration is
 # shown split up across lines, but in TOML it needs to be on a single
@@ -115,7 +115,7 @@
 }
 ```
 
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
 there may be newer versions available.
 
 [Additional details about com.android.security.lint:lint](com_android_security_lint_lint.md.html).

docs/checks/categories.md.html

@@ -562,7 +562,7 @@
   - [PermissionImpliesUnsupportedChromeOsHardware: Permission Implies Unsupported Chrome OS Hardware](PermissionImpliesUnsupportedChromeOsHardware.md.html)
   - [UnsupportedChromeOsHardware: Unsupported Chrome OS Hardware Feature](UnsupportedChromeOsHardware.md.html)
 
-* Security (76)
+* Security (79)
 
   - [AcceptsUserCertificates: Allowing User Certificates](AcceptsUserCertificates.md.html)
   - [AddJavascriptInterface: `addJavascriptInterface` Called](AddJavascriptInterface.md.html)
@@ -592,6 +592,8 @@
   - [InsecureBaseConfiguration: Insecure Base Configuration](InsecureBaseConfiguration.md.html)
   - [InsecureDnsSdkLevel: Application vulnerable to DNS spoofing attacks](InsecureDnsSdkLevel.md.html)
   - [InsecurePermissionProtectionLevel: Custom permission created with a normal `protectionLevel`](InsecurePermissionProtectionLevel.md.html)
+  - [InsecureStickyBroadcastsMethod: Usage of insecure sticky broadcasts](InsecureStickyBroadcastsMethod.md.html)
+  - [InsecureStickyBroadcastsPermission: Usage of insecure sticky broadcasts](InsecureStickyBroadcastsPermission.md.html)
   - [IntentFilterExportedReceiver: Unspecified `android:exported` in manifest](IntentFilterExportedReceiver.md.html)
   - [IntentWithNullActionLaunch: Unsafe intent launched with no action set](IntentWithNullActionLaunch.md.html)
   - [InvalidPermission: Invalid Permission Attribute](InvalidPermission.md.html)
@@ -630,6 +632,7 @@
   - [UnsafeNativeCodeLocation: Native code outside library directory](UnsafeNativeCodeLocation.md.html)
   - [UnsafeProtectedBroadcastReceiver: Unsafe Protected `BroadcastReceiver`](UnsafeProtectedBroadcastReceiver.md.html)
   - [UnsanitizedFilenameFromContentProvider: Trusting ContentProvider filenames without any sanitization](UnsanitizedFilenameFromContentProvider.md.html)
+  - [UnsanitizedFilenameFromContentProvider: Trusting ContentProvider filenames without any sanitization](UnsanitizedFilenameFromContentProvider.md.html)
   - [UnspecifiedImmutableFlag: Missing `PendingIntent` mutability flag](UnspecifiedImmutableFlag.md.html)
   - [UseCheckPermission: Using the result of check permission calls](UseCheckPermission.md.html)
   - [UsingC2DM: Using C2DM](UsingC2DM.md.html)

docs/checks/com_android_security_lint_lint.md.html

@@ -13,27 +13,30 @@
 Compiled
 :   Lint 8.0 and 8.1
 Artifact
-:   com.android.security.lint:lint:1.0.1
+:   com.android.security.lint:lint:1.0.2
 
 (##) Included Issues
 
-|Issue Id                                                                      |Issue Description                                                                |
-|------------------------------------------------------------------------------|---------------------------------------------------------------------------------|
-|[VulnerableCryptoAlgorithm](VulnerableCryptoAlgorithm.md.html)                |Application uses vulnerable cryptography algorithms                              |
-|[UnsafeCryptoAlgorithmUsage](UnsafeCryptoAlgorithmUsage.md.html)              |Application uses unsafe cipher modes or paddings with cryptographic algorithms   |
-|[MissingAutoVerifyAttribute](MissingAutoVerifyAttribute.md.html)              |Application has custom scheme intent filters with missing `autoVerify` attributes|
-|[InsecureDnsSdkLevel](InsecureDnsSdkLevel.md.html)                            |Application vulnerable to DNS spoofing attacks                                   |
-|[StrandhoggVulnerable](StrandhoggVulnerable.md.html)                          |Application vulnerable to Strandhogg attacks                                     |
-|[TapjackingVulnerable](TapjackingVulnerable.md.html)                          |Application's UI is vulnerable to tapjacking attacks                             |
-|[DefaultCleartextTraffic](DefaultCleartextTraffic.md.html)                    |Application by default permits cleartext traffic                                 |
-|[DefaultTrustedUserCerts](DefaultTrustedUserCerts.md.html)                    |Application by default trusts user-added CA certificates                         |
-|[UnintendedExposedUrl](UnintendedExposedUrl.md.html)                          |Application may have a debugging or development URL publicly exposed             |
-|[UnintendedPrivateIpAddress](UnintendedPrivateIpAddress.md.html)              |Application may have a private IP address publicly exposed                       |
-|[ExposedRootPath](ExposedRootPath.md.html)                                    |Application specifies the device root directory                                  |
-|[SensitiveExternalPath](SensitiveExternalPath.md.html)                        |Application may expose sensitive info like PII by storing it in external storage |
-|[WeakPrng](WeakPrng.md.html)                                                  |Application uses non-cryptographically secure pseudorandom number generators     |
-|[DisabledAllSafeBrowsing](DisabledAllSafeBrowsing.md.html)                    |Application has disabled safe browsing for all WebView objects                   |
-|[InsecurePermissionProtectionLevel](InsecurePermissionProtectionLevel.md.html)|Custom permission created with a normal `protectionLevel`                        |
+|Issue Id                                                                                  |Issue Description                                                                |
+|------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------|
+|[VulnerableCryptoAlgorithm](VulnerableCryptoAlgorithm.md.html)                            |Application uses vulnerable cryptography algorithms                              |
+|[UnsafeCryptoAlgorithmUsage](UnsafeCryptoAlgorithmUsage.md.html)                          |Application uses unsafe cipher modes or paddings with cryptographic algorithms   |
+|[MissingAutoVerifyAttribute](MissingAutoVerifyAttribute.md.html)                          |Application has custom scheme intent filters with missing `autoVerify` attributes|
+|[InsecureDnsSdkLevel](InsecureDnsSdkLevel.md.html)                                        |Application vulnerable to DNS spoofing attacks                                   |
+|[StrandhoggVulnerable](StrandhoggVulnerable.md.html)                                      |Application vulnerable to Strandhogg attacks                                     |
+|[TapjackingVulnerable](TapjackingVulnerable.md.html)                                      |Application's UI is vulnerable to tapjacking attacks                             |
+|[DefaultCleartextTraffic](DefaultCleartextTraffic.md.html)                                |Application by default permits cleartext traffic                                 |
+|[DefaultTrustedUserCerts](DefaultTrustedUserCerts.md.html)                                |Application by default trusts user-added CA certificates                         |
+|[UnintendedExposedUrl](UnintendedExposedUrl.md.html)                                      |Application may have a debugging or development URL publicly exposed             |
+|[UnintendedPrivateIpAddress](UnintendedPrivateIpAddress.md.html)                          |Application may have a private IP address publicly exposed                       |
+|[ExposedRootPath](ExposedRootPath.md.html)                                                |Application specifies the device root directory                                  |
+|[SensitiveExternalPath](SensitiveExternalPath.md.html)                                    |Application may expose sensitive info like PII by storing it in external storage |
+|[WeakPrng](WeakPrng.md.html)                                                              |Application uses non-cryptographically secure pseudorandom number generators     |
+|[DisabledAllSafeBrowsing](DisabledAllSafeBrowsing.md.html)                                |Application has disabled safe browsing for all WebView objects                   |
+|[InsecurePermissionProtectionLevel](InsecurePermissionProtectionLevel.md.html)            |Custom permission created with a normal `protectionLevel`                        |
+|[UnsanitizedFilenameFromContentProvider](UnsanitizedFilenameFromContentProvider-2.md.html)|Trusting ContentProvider filenames without any sanitization                      |
+|[InsecureStickyBroadcastsMethod](InsecureStickyBroadcastsMethod.md.html)                  |Usage of insecure sticky broadcasts                                              |
+|[InsecureStickyBroadcastsPermission](InsecureStickyBroadcastsPermission.md.html)          |Usage of insecure sticky broadcasts                                              |
 
 (##) Including
 
@@ -44,17 +47,17 @@
 
 ```
 // build.gradle.kts
-lintChecks("com.android.security.lint:lint:1.0.1")
+lintChecks("com.android.security.lint:lint:1.0.2")
 
 // build.gradle
-lintChecks 'com.android.security.lint:lint:1.0.1'
+lintChecks 'com.android.security.lint:lint:1.0.2'
 
 // build.gradle.kts with version catalogs:
 lintChecks(libs.com.android.security.lint.lint)
 
 # libs.versions.toml
 [versions]
-com-android-security-lint-lint = "1.0.1"
+com-android-security-lint-lint = "1.0.2"
 [libraries]
 # For clarity and text wrapping purposes the following declaration is
 # shown split up across lines, but in TOML it needs to be on a single
@@ -66,7 +69,7 @@
 }
 ```
 
-1.0.1 is the version this documentation was generated from;
+1.0.2 is the version this documentation was generated from;
 there may be newer versions available.
 
 (##) Changes
@@ -78,13 +81,17 @@
   StrandhoggVulnerable, TapjackingVulnerable, UnintendedExposedUrl,
   UnintendedPrivateIpAddress, UnsafeCryptoAlgorithmUsage,
   VulnerableCryptoAlgorithm, WeakPrng.
+* 1.0.2: Adds InsecureStickyBroadcastsMethod,
+  InsecureStickyBroadcastsPermission,
+  UnsanitizedFilenameFromContentProvider.
 
 (##) Version Compatibility
 
 There are multiple older versions available of this library:
 
 | Version            | Date     | Issues | Compatible | Compiled      | Requires |
 |-------------------:|----------|-------:|------------|--------------:|---------:|
+|               1.0.2|          |      18|         Yes|    8.0 and 8.1|8.0 and 8.1|
 |               1.0.1|          |      15|         Yes|    8.0 and 8.1|8.0 and 8.1|
 
 <!-- Markdeep: --><style class="fallback">body{visibility:hidden;white-space:pre;font-family:monospace}</style><script src="markdeep.min.js" charset="utf-8"></script><script src="https://morgan3d.github.io/markdeep/latest/markdeep.min.js" charset="utf-8"></script><script>window.alreadyProcessedMarkdeep||(document.body.style.visibility="visible")</script>

docs/checks/index.md.html

@@ -268,6 +268,8 @@
   - [InsecureBaseConfiguration: Insecure Base Configuration](InsecureBaseConfiguration.md.html)
   - [InsecureDnsSdkLevel: Application vulnerable to DNS spoofing attacks](InsecureDnsSdkLevel.md.html)
   - [InsecurePermissionProtectionLevel: Custom permission created with a normal `protectionLevel`](InsecurePermissionProtectionLevel.md.html)
+  - [InsecureStickyBroadcastsMethod: Usage of insecure sticky broadcasts](InsecureStickyBroadcastsMethod.md.html)
+  - [InsecureStickyBroadcastsPermission: Usage of insecure sticky broadcasts](InsecureStickyBroadcastsPermission.md.html)
   - [InstantApps: Instant App Issues](InstantApps.md.html)
   - [Instantiatable: Registered class is not instantiatable](Instantiatable.md.html)
   - [IntentFilterExportedReceiver: Unspecified `android:exported` in manifest](IntentFilterExportedReceiver.md.html)
@@ -675,6 +677,7 @@
   - [UnsafeProtectedBroadcastReceiver: Unsafe Protected `BroadcastReceiver`](UnsafeProtectedBroadcastReceiver.md.html)
   - [UnsafeRepeatOnLifecycleDetector: RepeatOnLifecycle should be used with viewLifecycleOwner in Fragments](UnsafeRepeatOnLifecycleDetector.md.html)
   - [UnsanitizedFilenameFromContentProvider: Trusting ContentProvider filenames without any sanitization](UnsanitizedFilenameFromContentProvider.md.html)
+  - [UnsanitizedFilenameFromContentProvider: Trusting ContentProvider filenames without any sanitization](UnsanitizedFilenameFromContentProvider.md.html) (from com.android.security.lint:lint:1.0.2)
   - [UnspecifiedImmutableFlag: Missing `PendingIntent` mutability flag](UnspecifiedImmutableFlag.md.html)
   - [UnspecifiedRegisterReceiverFlag: Missing `registerReceiver()` exported flag](UnspecifiedRegisterReceiverFlag.md.html)
   - [UnsupportedChromeOsCameraSystemFeature: Looking for Rear Camera only feature](UnsupportedChromeOsCameraSystemFeature.md.html)

docs/checks/libraries.md.html

@@ -6,7 +6,7 @@
 Lint-specific libraries:
 
 * [androidx.lint:lint-gradle](androidx_lint_lint-gradle.md.html) (6 checks)
-* [com.android.security.lint:lint](com_android_security_lint_lint.md.html) (15 checks)
+* [com.android.security.lint:lint](com_android_security_lint_lint.md.html) (18 checks)
 * [com.uber.autodispose2:autodispose-lint](com_uber_autodispose2_autodispose-lint.md.html) (1 checks)
 * [com.google.dagger:dagger-lint](com_google_dagger_dagger-lint.md.html) (4 checks)
 * [com.vanniktech:lint-rules-rxjava2](com_vanniktech_lint-rules-rxjava2.md.html) (7 checks)

docs/checks/severity.md.html

@@ -368,7 +368,7 @@
   - [WrongViewCast: Mismatched view type](WrongViewCast.md.html)
   - [XmlEscapeNeeded: Missing XML Escape](XmlEscapeNeeded.md.html)
 
-* Warning (419)
+* Warning (422)
 
   - [AcceptsUserCertificates: Allowing User Certificates](AcceptsUserCertificates.md.html)
   - [AccessibilityFocus: Forcing accessibility focus](AccessibilityFocus.md.html)
@@ -521,6 +521,8 @@
   - [InsecureBaseConfiguration: Insecure Base Configuration](InsecureBaseConfiguration.md.html)
   - [InsecureDnsSdkLevel: Application vulnerable to DNS spoofing attacks](InsecureDnsSdkLevel.md.html)
   - [InsecurePermissionProtectionLevel: Custom permission created with a normal `protectionLevel`](InsecurePermissionProtectionLevel.md.html)
+  - [InsecureStickyBroadcastsMethod: Usage of insecure sticky broadcasts](InsecureStickyBroadcastsMethod.md.html)
+  - [InsecureStickyBroadcastsPermission: Usage of insecure sticky broadcasts](InsecureStickyBroadcastsPermission.md.html)
   - [InstantApps: Instant App Issues](InstantApps.md.html)
   - [IntentFilterExportedReceiver: Unspecified `android:exported` in manifest](IntentFilterExportedReceiver.md.html)
   - [IntentFilterUniqueDataAttributes: Data tags should only declare unique attributes](IntentFilterUniqueDataAttributes.md.html)
@@ -726,6 +728,7 @@
   - [UnsafeOptInUsageWarning: Unsafe opt-in usage intended to be warning-level severity](UnsafeOptInUsageWarning.md.html)
   - [UnsafeProtectedBroadcastReceiver: Unsafe Protected `BroadcastReceiver`](UnsafeProtectedBroadcastReceiver.md.html)
   - [UnsanitizedFilenameFromContentProvider: Trusting ContentProvider filenames without any sanitization](UnsanitizedFilenameFromContentProvider.md.html)
+  - [UnsanitizedFilenameFromContentProvider: Trusting ContentProvider filenames without any sanitization](UnsanitizedFilenameFromContentProvider.md.html)
   - [UnsupportedChromeOsCameraSystemFeature: Looking for Rear Camera only feature](UnsupportedChromeOsCameraSystemFeature.md.html)
   - [Untranslatable: Translated Untranslatable](Untranslatable.md.html)
   - [UnusedAttribute: Attribute unused on older versions](UnusedAttribute.md.html)

docs/checks/vendors.md.html

@@ -609,21 +609,24 @@
   - [ModuleCompanionObjects: Module companion objects should not be annotated with @Module](ModuleCompanionObjects.md.html)
   - [ModuleCompanionObjectsNotInModuleParent: Companion objects should not be annotated with @Module](ModuleCompanionObjectsNotInModuleParent.md.html)
 
-* Google - Android 3P Vulnerability Research (15)
+* Google - Android 3P Vulnerability Research (18)
 
   - [DefaultCleartextTraffic: Application by default permits cleartext traffic](DefaultCleartextTraffic.md.html)
   - [DefaultTrustedUserCerts: Application by default trusts user-added CA certificates](DefaultTrustedUserCerts.md.html)
   - [DisabledAllSafeBrowsing: Application has disabled safe browsing for all WebView objects](DisabledAllSafeBrowsing.md.html)
   - [ExposedRootPath: Application specifies the device root directory](ExposedRootPath.md.html)
   - [InsecureDnsSdkLevel: Application vulnerable to DNS spoofing attacks](InsecureDnsSdkLevel.md.html)
   - [InsecurePermissionProtectionLevel: Custom permission created with a normal `protectionLevel`](InsecurePermissionProtectionLevel.md.html)
+  - [InsecureStickyBroadcastsMethod: Usage of insecure sticky broadcasts](InsecureStickyBroadcastsMethod.md.html)
+  - [InsecureStickyBroadcastsPermission: Usage of insecure sticky broadcasts](InsecureStickyBroadcastsPermission.md.html)
   - [MissingAutoVerifyAttribute: Application has custom scheme intent filters with missing `autoVerify` attributes](MissingAutoVerifyAttribute.md.html)
   - [SensitiveExternalPath: Application may expose sensitive info like PII by storing it in external storage](SensitiveExternalPath.md.html)
   - [StrandhoggVulnerable: Application vulnerable to Strandhogg attacks](StrandhoggVulnerable.md.html)
   - [TapjackingVulnerable: Application's UI is vulnerable to tapjacking attacks](TapjackingVulnerable.md.html)
   - [UnintendedExposedUrl: Application may have a debugging or development URL publicly exposed](UnintendedExposedUrl.md.html)
   - [UnintendedPrivateIpAddress: Application may have a private IP address publicly exposed](UnintendedPrivateIpAddress.md.html)
   - [UnsafeCryptoAlgorithmUsage: Application uses unsafe cipher modes or paddings with cryptographic algorithms](UnsafeCryptoAlgorithmUsage.md.html)
+  - [UnsanitizedFilenameFromContentProvider: Trusting ContentProvider filenames without any sanitization](UnsanitizedFilenameFromContentProvider.md.html)
   - [VulnerableCryptoAlgorithm: Application uses vulnerable cryptography algorithms](VulnerableCryptoAlgorithm.md.html)
   - [WeakPrng: Application uses non-cryptographically secure pseudorandom number generators](WeakPrng.md.html)
 

docs/checks/year.md.html

@@ -3,7 +3,7 @@
 
 Order: [Alphabetical](index.md.html) | [By category](categories.md.html) | [By vendor](vendors.md.html) | [By severity](severity.md.html) | By year | [Libraries](libraries.md.html)
 
-* 2024 (37)
+* 2024 (40)
 
   - [AccessibilityFocus: Forcing accessibility focus](AccessibilityFocus.md.html)
   - [AccessibilityScrollActions: Incomplete Scroll Action support](AccessibilityScrollActions.md.html)
@@ -19,6 +19,8 @@
   - [GradleProjectIsolation: Avoid using APIs that are not project isolation safe](GradleProjectIsolation.md.html)
   - [InsecureDnsSdkLevel: Application vulnerable to DNS spoofing attacks](InsecureDnsSdkLevel.md.html)
   - [InsecurePermissionProtectionLevel: Custom permission created with a normal `protectionLevel`](InsecurePermissionProtectionLevel.md.html)
+  - [InsecureStickyBroadcastsMethod: Usage of insecure sticky broadcasts](InsecureStickyBroadcastsMethod.md.html)
+  - [InsecureStickyBroadcastsPermission: Usage of insecure sticky broadcasts](InsecureStickyBroadcastsPermission.md.html)
   - [InternalAgpApiUsage: Avoid using internal Android Gradle Plugin APIs](InternalAgpApiUsage.md.html)
   - [InternalGradleApiUsage: Avoid using internal Gradle APIs](InternalGradleApiUsage.md.html)
   - [InvalidLanguageTagDelimiter: Underscore (`_`) is an unsupported delimiter for subtags](InvalidLanguageTagDelimiter.md.html)
@@ -34,6 +36,7 @@
   - [UnclosedTrace: Incorrect trace section usage](UnclosedTrace.md.html)
   - [UnnecessaryRequiredFeature: Potentially unnecessary required feature](UnnecessaryRequiredFeature.md.html)
   - [UnsanitizedFilenameFromContentProvider: Trusting ContentProvider filenames without any sanitization](UnsanitizedFilenameFromContentProvider.md.html)
+  - [UnsanitizedFilenameFromContentProvider: Trusting ContentProvider filenames without any sanitization](UnsanitizedFilenameFromContentProvider.md.html)
   - [UnusedSharedTransitionModifierParameter: SharedTransitionScope calls should use the provided Modifier parameter](UnusedSharedTransitionModifierParameter.md.html)
   - [ViewModelConstructorInComposable: Constructing a view model in a composable](ViewModelConstructorInComposable.md.html)
   - [WithPluginClasspathUsage: Flags usage of GradleRunner#withPluginClasspath](WithPluginClasspathUsage.md.html)