Repository navigation
feat(mobile): add Insufficient Crypto lesson and challenges to the Android app- #1069 - #1107
Open
SeanDuggan wants to merge 26 commits into
Open
SeanDuggan wants to merge 26 commits into
SeanDuggan wants to merge 26 commits into
Conversation
Adds the Gradle project, manifest, resources, launch/login/main activities, navigation, preferences, authentication, key validation and progress tracking utilities, and the home, progress, scoreboard and ADB reference screens. Lesson and challenge screens referenced by the navigation graph are added in the following PRs, so those destinations are not usable until then. Part of the split of OWASP#894 (mobile app).
Disable cleartext traffic app-wide via a network security config and reject non-https server URLs at login, registration and key validation. Debug builds additionally trust user-installed CAs for local development.
The shell now builds with an empty KeyValidator.Module enum and empty nav, menu and module-info registries. Each lesson/challenge category PR registers its own entries. Removes the myapp://open deep link and the KeyValidator unit test, which return with the first category.
Removes lesson/challenge strings and the Insufficient Cryptography ADB reference card. These return with their own category PRs.
The app asks /mobileModuleStatus which modules the signed-in student can open and greys out the rest in the navigation drawer and progress list, with the server's reason shown when tapped. This mirrors the platform's open floor / CTF rules: module closed, event not running, module blocked. Advisory only: the server re-checks every module start and key request. It fails open, so signed-out or offline use and failed requests grey out nothing. Status refreshes on resume, drawer open, sign in and sign out.
…JDK path Changing server_preference while signed in kept the old server's session cookie, so it would be sent to the new server. Log out when the server actually changes. Remove org.gradle.java.home, which pinned a Windows Android Studio path and overrode JAVA_HOME on other machines.
Replace the individually listed local planning docs with a single *.md rule.
Remove CHALLENGE_SOLUTIONS.txt and missing_challenges.txt, which refer to no files in the repository.
Adds the Insufficient Cryptography module pair to the Android app, with the matching server-side lesson/challenge JSPs and i18n content. Android: - InsufficientCryptoLessonFragment / InsufficientCryptoChallengeFragment and their layouts - Register both modules in KeyValidator, ModuleInfoHelper, MainActivity navigation and mobile_navigation.xml - Strings for both modules - Unit tests for lesson and challenge Server content: - Lesson JSP (dbf3915e...) and challenge JSP (c3d4e5f6...) - Lesson properties, challenge strings, cheatsheet solutions - mobileBlurb.appLink in mobileGenericStrings.properties Both modules are server-scored only (no offline key hashes): without a signed-in server session a submitted key is rejected; with one, the key is verified via /mobileFlagSubmit and recorded in core.results. Tested: 16/16 unit tests; emulator run over HTTPS covering wrong and correct key for lesson and challenge, matching core.results rows, and the drawer Completed group.
…llenge description
… registration Adds the lesson and challenge rows to coreSchema.sql plus the matching cheatSheetCreate calls so both modules exist and score on a fresh install.
The logcat grep example rendered a literal "search_term" on the ADB Commands screen.
…fficient-cryptography
Register the topic in level-classification.toml (M10, CWE-327) and regenerate docs/mobile-levels.md so the docs level-catalogue check passes.
…lter The mobile category where clause drives open/close by category and the GetterIT module-count check. Categories added by this PR were missing, so those levels were counted as web levels.
Getter looks up each module's moduleNameLangPointer and 'category.' + moduleCategoryLangPointer in moduleNames.properties. The new levels had no entries, so the lookups threw MissingResourceException and the module, challenge and tournament listings came back incomplete.
The Android app lives in mobile/, not mobile/MobileShepherd/.
…l' into mobile-split/04-android-app-shell
Insecure Communication is deferred to 4.0.1. Remove its key hash entries, ProGuard rules and the cleartext-traffic comment.
…-insufficient-cryptography
…ng to it The lesson footer now names the risk (for example 'OWASP Mobile Top 10 - M4: Insufficient Input/Output Validation') without an external URL, and no uri.properties key is required.
Drop the About dialog button that opened owasp.org and the unused hidden Top 10 FAB with its string. Lessons now name the relevant risk as plain text.
…-insufficient-cryptography
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the Insufficient Cryptography lesson and challenge (OWASP Mobile Top 10 M10) to the Android app, with the matching lesson and challenge JSPs, i18n strings and cheat sheet solutions.
What's included
Android
InsufficientCryptoLessonFragmentandInsufficientCryptoChallengeFragment, with their layoutsKeyValidator,ModuleInfoHelper,MainActivityandmobile_navigation.xmlServer content
dbf3915e…) and challenge JSP (c3d4e5f6…)mobileBlurb.appLinkinmobileGenericStrings.propertiesScoring
Both modules are server-scored only, with no offline key hashes. Without a signed-in server session a submitted key is rejected. With a session, the key is verified through
/mobileFlagSubmitand recorded incore.results.Testing
woolwas accepted. Acore.resultsrow was written.shared_prefs/recovery_vault.xml(Base64, then XOR0x42). A wrong key gave "Incorrect key." and the real token completed the module, with a matchingcore.resultsrow.Notes for reviewers
mobileBlurb.appLinkis also added by the sibling category branches, so expect a trivial conflict when they rebase.