Aanwezigheid in de binary telt als verzending
Een bevinding ziet een onderdeel in een pakket aan voor bewijs dat het ook verzendt.
- Familie
- Methode
- Status
- actief
- Geldt voor
- mobile-app, desktop, firmware
Wat er gebeurt
Analysis of a package finds the strings, classes or endpoints of a collecting component and the finding reports that the product sends data to that party. Packages routinely carry code that is never reached: pulled in through a dependency, kept for a build variant for another market, or left behind after a feature was removed. Presence establishes what could run, not what did.
Waarom het ertoe doet
Naming a recipient that never received anything is the mistake that ends an investigation. It is also the mistake that makes the genuine findings in the same report unusable, because a single overreach lets everything else be dismissed as the same kind of claim.
Veelvoorkomende oorzaken
- a string or class match reported as a data flow
- a component present for a build variant distributed in another region
- an endpoint constant compiled in with no code path that reaches it
- a dependency that arrived through another dependency and is never initialised
Dit is het níet
A component that does transmit on its own account is Bundled component collection, a fault of the system. This entry is the step before it: the evidence shows presence and the claim asserts sending.
Hoe je het vaststelt
Indicator
The finding rests on static analysis alone, and a dynamic capture of the running product shows no request to the component's endpoints during a run that exercises the relevant functionality. Presence in the package with no observed traffic is the fault in the claim.
Methode
static-source
Kwaliteit van de detectie
85 van 100
De grenzen van deze bevinding
Wat dit patroon zou weerleggen
- A dynamic capture shows requests to the component's endpoints.met de hand te toetsende bevinding vervaltThe finding then stands as an observed transmission and should be reported as one.
- The finding already states that it establishes presence only.met de hand te toetsende bevinding vervaltPresence is a legitimate finding when labelled as such. This entry is about the leap, not about static analysis.
- A code path is shown to reach the component under conditions the capture did not cover, such as a login or a region.met de hand te toetsende bevinding wordt zwakker
- The component transmits over a channel the capture could not observe.niet uit de meting af te leidende bevinding wordt zwakkerAbsence of observed traffic is then not evidence of absence, and the finding has to say so.
Wat dit patroon níet vaststelt
- harm; the catalogue standardises a finding so it can be referred to, it does not weigh it
- severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case
- unlawfulness; that is for a supervisory authority or a court
- intent; a fault is usually a build decision, not a plan
- absence: not finding it in one capture is not evidence that it is not there
Reproduceren
- manual
METHOD.mdno dedicated reproduction exists yet; follow the general method and the indicator above
Juridisch kader
Veelgehoorde tegenwerpingen
The library is in there, so it does something.
Packages carry code that is never reached. What it does is a question for a capture, and until then the finding is about the package rather than about a transmission.
Dynamic measurement is too hard for this product.
Then report presence as presence. A weaker finding that holds is worth more than a strong one that is withdrawn.
Other researchers report it the same way.
The party you name will not accept that, and neither will a supervisory authority reading a report where one claim is over-reached.
Geldt wanneer
to-a-finding